trail-logging.yml

ROSTemplateFormatVersion: '2015-09-01'
Description:
  zh-cn: 创建ACTIONTRAIL跟踪与日志记录，集成OSS存储、SLS项目与日志存储，支持事件读写配置，自动角色策略生成。
  en: Create ACTIONTRAIL trails for tracking and logging, integrating with OSS storage,
    SLS projects for log storage, supporting event read/write configurations, and
    automatically generating role policies.
Parameters:
  Enable:
    Type: Boolean
    Default: true
  RoleName:
    Type: String
    Default: mytest
    MinLength: 1
    MaxLength: 64
  EventRW:
    Type: String
    Default: Write
    AllowedValues:
    - Write
    - Read
    - All
  SlsProjectName:
    Type: String
    Default: mytest
  OssKeyPrefix:
    Type: String
    Default: ''
  OssBucketName:
    Type: String
    Default: mytest
  TrailName:
    Type: String
    Default: mytest
Resources:
  Role:
    Type: ALIYUN::RAM::Role
    Properties:
      RoleName:
        Ref: RoleName
      Policies:
      - PolicyName:
          Fn::Sub: ActionTrailPolicy-${ALIYUN::StackId}
        PolicyDocument:
          Version: '1'
          Statement:
          - Action:
            - oss:ListObjects
            - oss:PutObject
            - oss:GetBucketLocation
            Resource:
            - '*'
            Effect: Allow
          - Action:
            - log:GetProject
            Resource:
            - '*'
            Effect: Allow
          - Action:
            - log:PostLogStoreLogs
            - log:CreateLogstore
            - log:GetLogstore
            - log:CreateIndex
            - log:UpdateIndex
            - log:UpdateLogStore
            - log:GetIndex
            Resource:
            - acs:log:*:*:project/*/logstore/actiontrail_*
            - acs:log:*:*:project/*/logstore/innertrail_*
            Effect: Allow
          - Action:
            - log:CreateDashboard
            - log:UpdateDashboard
            Resource:
            - acs:log:*:*:project/*/dashboard/*
            Effect: Allow
          - Action:
            - log:CreateSavedSearch
            - log:UpdateSavedSearch
            Resource:
            - acs:log:*:*:project/*/savedsearch/actiontrail_*
            - acs:log:*:*:project/*/savedsearch/innertrail_*
            Effect: Allow
          - Action:
            - mns:PublishMessage
            Resource:
            - '*'
            Effect: Allow
          - Action:
            - resourcemanager:GetResourceDirectory
            - resourcemanager:ListAccounts
            - resourcemanager:GetResourceDirectoryAccount
            Resource:
            - '*'
            Effect: Allow
          - Action:
            - ram:DeleteServiceLinkedRole
            Resource:
            - '*'
            Effect: Allow
            Condition:
              StringEquals:
                ram:ServiceName: actiontrail.aliyuncs.com
      AssumeRolePolicyDocument:
        Version: '1'
        Statement:
        - Action: sts:AssumeRole
          Effect: Allow
          Principal:
            Service:
            - actiontrail.aliyuncs.com
  Bucket:
    Type: ALIYUN::OSS::Bucket
    Properties:
      AccessControl: private
      BucketName:
        Ref: OssBucketName
      DeletionForce: true
  SlsProject:
    Type: ALIYUN::SLS::Project
    Properties:
      Name:
        Ref: SlsProjectName
  SlsLogStore:
    Type: ALIYUN::SLS::Logstore
    Properties:
      LogstoreName:
        Fn::Sub: actiontrail_${TrailName}
      PreserveStorage: true
      ProjectName:
        Fn::GetAtt:
        - SlsProject
        - Name
      AppendMeta: true
      MaxSplitShard: 64
      AutoSplit: true
      EnableTracking: false
      ShardCount: 2
    DependsOn: SlsProject
  Trail:
    Type: ALIYUN::ACTIONTRAIL::Trail
    Properties:
      SlsProjectArn:
        Fn::Sub: acs:log:${ALIYUN::Region}::project/${SlsProjectName}
      RoleName:
        Fn::GetAtt:
        - Role
        - RoleName
      EventRW:
        Ref: EventRW
      OssKeyPrefix:
        Ref: OssKeyPrefix
      OssBucketName:
        Fn::GetAtt:
        - Bucket
        - Name
      SlsWriteRoleArn:
        Fn::Sub: acs:ram::${ALIYUN::TenantId}:role/${Role.RoleName}
      Name:
        Ref: TrailName
    DependsOn:
    - Bucket
    - Role
    - SlsLogStore
  TrailLogging:
    Type: ALIYUN::ACTIONTRAIL::TrailLogging
    Properties:
      Name:
        Fn::GetAtt:
        - Trail
        - Name
      Enable:
        Ref: Enable
Outputs:
  IsLogging:
    Value:
      Fn::GetAtt:
      - TrailLogging
      - IsLogging
  StartLoggingTime:
    Value:
      Fn::GetAtt:
      - TrailLogging
      - StartLoggingTime
  Name:
    Value:
      Fn::GetAtt:
      - Trail
      - Name