Manage Account Audit Logs

View and download the audit logs of your PhoenixAI Cloud account.

important

• Only console users with the Account admin role can view and download account audit logs.
• For instructions on managing the audit logs of your PhoenixAI clusters, see Perform SQL-based Analysis on Audit Logs.

Enable account audit log export

To enable account audit log export, you need to create a cross-account IAM role in AWS to allow PhoenixAI to access your S3 bucket, and reference it when you create an audit log export credential in the PhoenixAI Cloud console.

Follow these steps to create an audit log export credential:

1. Sign in to the PhoenixAI Cloud console.

2. In the left-side navigation pane, choose Account > Account settings.

3. On the Advanced settings tab of the Account settings page, click Create export credential.

4. On the Create export credential dialog box, create a cross-account IAM role with the provided information, configure the necessary parameters, and click Submit.

   tip

   For detailed instructions on creating a cross-account IAM role, see Create a deployment credential. Remember to use the Trust account ID, External ID, and Permission Policy provided in the dialog box to create the IAM role.

   Parameter	Required	Description
   Credential name	Yes	Enter the name of the audit log export credential. NOTE The name must be unique within your PhoenixAI cloud account.
   Trust account ID	N/A	The account ID that you use to create a cross-account IAM role. NOTE The trust account ID and the external ID are used together to identify the account that can use the IAM role.
   External ID	N/A	The external ID that you use to create a cross-account IAM role. NOTE The trust account ID and the external ID are used together to identify the account that can use the IAM role.
   Bucket name	Yes	Enter the name of your bucket used to store the audit log.
   Folder path	Yes	Enter the path under the bucket used to store the audit log.
   KMS key ARN	No	Enter the KMS key ARN if you have enabled Transparent Data Encryption for your S3 bucket.
   Permission policy	N/A	The JSON policy document that you use to create a policy.
   Role ARN	Yes	Enter the ARN of the cross-account IAM role that you have created to grant PhoenixAI permission to access your S3 bucket.

Export account audit logs

Follow these steps to view and export account audit logs:

1. Sign in to the PhoenixAI Cloud console.

2. In the left-side navigation pane, choose Account > Audit log.

3. On the Audit Log page, optionally adjust Object and Date range filters to control the scope of the audit log records to show and download, and click Apply filter to view the logs.

   Each audit log record contains the following fields:

   • Operation: The recorded operation.
   • Object: The type of the object the operation targeted.
   • Object name: The name of the object the operation targeted.
   • Changelog entry: The detailed message of the audit log record.
   • Memeber: The member who initiated the operation.
   • Source: The source from which the operation was initiated. Valid values: GUI and API.
   • Timestamp: The timestamp of the operation.

4. To download the audit log records, click Export, and then choose Export to S3 or Download to csv. If you choose Export to S3, the audit log records will be exported to the S3 bucket referenced in the audit log export credential. If you choose Download to csv, the audit log records will be downloaded to a CSV file on your local device.