Auditing events for IAM

Account events

The following table lists the actions that generate an event:

Access groups events

The following table lists the actions that generate an event:

Members events

The following table lists the actions that generate an event:

Rules events

The following table lists the actions that generate an event:

Policy tempalte events

The following table lists the actions that generate an event:

Access group tempalte events

The following table lists the actions that generate an event:

Trusted profile tempalte events

The following table lists the actions that generate an event:

Settings tempalte events

The following table lists the actions that generate an event:

Login events

In the IBM Cloud, an administrator, or a user that has the correct access in your account, has different options to manage a user's login settings. For example, an administrator can order external authentication options, enable a one-time passcode to be used during login, enable the use of security questions at login, or set a password expiration time period. For more information, see Types of multifactor authentication.

• A user can log in by using a user ID and password.
• A federated user that uses a corporate or enterprise single sign-on ID can log in to IBM Cloud from the command-line interface (CLI) by using either a one-time passcode or an API key. For more information, see Logging in with a federated ID.
• A user can log in by using an API key.
• A federated user that uses a corporate or enterprise single sign-on ID can log in to IBM Cloud by applying a trusted profile.

The following fields include extra information:

• The initiator.name includes information about the user that logs in to the account.
• The X-Global-Transaction-Id includes an ID that you can use when you open a support ticket if you need to get more information.

Logout events

When a user logs out of the IBM Cloud, the iam-identity.user.logout event is generated.

Update an account service ID

A service ID identifies a service or application similar to how a user ID identifies a user. Learn more.

When an action to update a service ID is requested, you get an event in the account with action iam-identity.account-serviceid.update.

The following fields include extra information:

• The initiator.name field includes information about who has requested to update the service ID.
• The target.name field includes information about the service ID that is changed.
• The initiator.host.agent field indicates if the request comes from the UI or the CLI. When the field is set to Not Set, the request originates in the UI. When the field is set to IBM Cloud CLI, the request originates at the command line.

Limits events

There are limitations on the number of service IDs, API keys, trusted profiles, and policies allowed in an account. An event is generated when your account reaches 90% of the of the limit for service IDs, API keys, trusted profiles, and policies.

The following is an example message when an account is approaching the maximum number of service IDs:

Warning: You have reached 90% of the maximum number of allowed Service IDs in account 10t2tyv8d1f88940dfc56af370b1f109. Your current count is 1800 and the limit is 2000. Reduce the number of Service IDs before you hit the limit to ensure that you are not blocked from creating new Service IDs.

Apply the following search query to view all limits events:

• the maximum number of allowed

Start by removing inactive identities if they are no longer needed. For more information, see Identifying inactive identities.

Update a user API key or a service ID API key

When an action to update an API key is requested, you get an event in the account with one of the following actions:

• To update a user API key, the action is iam-identity.user-apikey.update.
• To update a service ID API key, the action is iam-identity.account-serviceid.update.

The following fields include extra information:

• The initiator.name field includes information about who has requested to update the API key.
• The target.name field includes information about the API key that is changed.
• The initiator.host.agent field indicates if the request comes from the UI or the CLI. When the field is set to Not Set, the request originates in the UI. When the field is set to IBM Cloud CLI, the request originates at the command line.

Initiator not authorized. Request to update an API key or service ID fails

For example, when a user logs into your account using an API key, the user is authenticated to access your account. However, this API key may not have permissions to run actions to modify API keys or service IDs in the account. When this happens, you get one of the following messages:

• IAM Identity Service: update user-apikey APIKeyName -failure
• IAM Identity Service: update account-serviceid ServiceIDName -failure

To look for information about the user that has requested a change to an API key or to a service ID, look at the initiator fields in the event.

When a user does not have permissions to run this action in your account, you get a failure event:

• The initiator.name field is empty. This information is not available at the time the event is generated.
• The user ID has been authenticated in your IBM Cloud account.
• The action targets your account.
• The user ID is not authorized to run this action in your account.

To find out the user who has tried to modify an API key or a service ID, complete the following steps:

1. Copy the value of the initiator.id. This field includes the ID of the user that is trying to run this action in your account.

2. Get the email address that is associated with the user. To complete this step, you must have administrator permissions in the account. Run the following command:

   ibmcloud iam users --output json | grep -A 1 InitiatorID
   

   Where InitiatorID is the value of the field initiator.id, and has the format IBMid-XXXXXXXXXX.

   The output of this command returns 2 fields. The ibmUniqueId field shows the ID of the user that matched the event initiator.name field. The email field shows the email address associated with that ID.

To get the API key on which the action has been requested and failed, see the field prev_instance_name in requestData.

Resource is locked. Request to update Service ID or API key fails

When a service ID or an API key are locked, you cannot change any of its attributes. The event that is generated has an outcome of failure.

Depending on the resource type, you can get any of the following messages:

• Service ID: The message that you get says IAM Identity Service: update account-serviceid ServiceIDName -failure where ServiceIDName is the name of the service ID.
• User API key: The message that you get says IAM Identity Service: update user-apikey APIkeyName -failure where APIkeyName is the name of the API key.
• Account API key: The message that you get says IAM Identity Service: update account-apikey APIkeyName -failure where APIkeyName is the name of the API key.

In the event, the lock field in requestData is set to true. This is the reason why this action fails. To successfully change an attribute of a service ID, the lock field must be set to false.

Notice that the field severity is set to critical. Someone is trying to modify a service ID that is locked in the account.