All Users IBM Cloud Activities Must be Recorder in Activity Logs and should be visible based on new RBAC policies

Hi. IBM Cloud captures activity events and shares them back to the accounts. This is done through a combination of the Activity Tracker Event Router and Activity Tracker hosted search services. As a user within an account, those with appropriate RBAC may configure how the activity events are routed. Options include direct to a COS bucket, to Event Streams, or to the Activity Tracker hosted event search services. IBM Cloud shares thousands of different events. A good single location starting point for the different events is here.

Activity Events are captured at the account level. The events land in defined regions unless users adjust the event routing to other regions. Location based events land in the region they originated. If a vcenter service is modified in a given region, the events land in that region by default. Global events land in Frankfurt by default, and can be routed to alternate regions as configured by the account user. Examples of global events are security based events, or events that may span 1 or more region at the same time. If your region of use is not Frankfurt it is possible the events you are seeking are still landing by default in Frankfurt. Document for how to route the events is here or you may alternatively elect to maintain a service instance in Frankfurt. The default for global events landing in Frankfurt is to ensure data maintains the appropriate GDPR compliance and under EU management if this compliance is applicable to you. If not, setup a route and forward it to your target region of choice.

Activity Tracker hosted event search may be selected as a service to manage activity events. Users can provision and configure a service instance to store events for 7, 14, and 30 days in an indexed search. Users can configure alerts, parse, chart and query events. It is also possible to re-route data from within this service. Access to events can be managed through the service with IAM level controls.

What additional information do we need here? Let me know, it is a simple governance non-compliance issue.

Hello,

Logs are absolutely not helpful. There should be straight activity logs at account level which can be further drilled down to the resources based on the events. currently, I have no idea who created the cos buckets, created the route table, edited the table or security group. edited/resized the VM, created a new disk in VPC and power. so all these things can be solved.

Hello and thank you for your submission ! We were hoping that you could provide some additional clarity - is the issue that there are events that are missing from the logs, and if so can you provide examples? Or is it a single pane of glass across things like logging, monitoring and activity tracker?

Thank you for your clarification !