Create Alert for OSS Bucket Permission Changes

Sign in to your Alibaba Cloud account.

Navigate to Simple Log Service (SLS) console available at https://sls.console.aliyun.com/.

In the Log Application section, select the Audit & Security tab, and choose Log Audit Service.

In the left navigation panel, under Access to Cloud Products, choose Global Configurations.

Select the cloud region of the SLS central project from the Region of the Central Project dropdown list. If the Region of the Central Project is already configured, continue the Audit process with the next step.

Ensure that Access Log is enabled for OSS, and click on the name (link) of the SLS central project, listed next to Central Project. If the name of the central project is not a link (the name is not clickable), there is no SLS central project created for managing log resources, available in the selected region. If the name of the central project is a link, click on the link to access your SLS central project.

Choose Alerts (bell icon) from the left navigation panel and select the Alert rule tab to access your alert monitoring rules.

Select oss_log from the Search Logstore dropdown list to return only the monitoring rules associated with the oss_log logstore.

Choose the active alert monitoring rule that you want examine, and select Edit. A monitoring rule is active when the Status of the rule is Running. If there are no alert monitoring rules listed on this page, there is no SLS alert configured to detect OSS bucket permission changes, otherwise, continue with the next step.

On the Edit Alert configuration panel, click on the query statement next to Query Statistics, and ensure that the following SQL query is present in the Query box: (operation: PutBucket and request_uri: acl) or operation: PutObjectAcl | select bucket, count (1) as c group by bucket. If the specified SQL query is not available in the Query box, the selected alert monitoring rule is not configured to detect OSS bucket permission changes. If the specified SQL query is present, return to the Edit Alert panel, choose Simple Log Service Notification for Destination, and ensure that the feature is enabled and has an alert policy configured to send notifications. If the Simple Log Service Notification feature is not enabled and properly configured, the selected SLS alert is not configured to send notifications whenever an OSS bucket permission change is made.

Repeat steps no. 9 and 10 for each alert monitoring rule available in your Alibaba Cloud account.

Sign in to your Alibaba Cloud account.

Navigate to Simple Log Service (SLS) console available at https://sls.console.aliyun.com/.

In the Log Application section, select the Audit & Security tab, and choose Log Audit Service.

In the left navigation panel, under Access to Cloud Products, choose Global Configurations.

Select the cloud region required for your SLS central project from the Region of the Central Project dropdown list. If the Region of the Central Project is already configured and the Central Project is available, continue the Audit process with step 8.

Enable Access Logs for OSS, set the data retention period of the SLS Logstore in the Storage Method column, and configure the log data synchronization in the Synchronization to Central Project column.

Choose Save to apply the configuration changes. This will create the SLS central project required for managing log resources.

Click on the name (link) of the SLS central project, listed next to Central Project.

Choose Alerts (bell icon) from the left navigation panel and select the Alert rule tab.

Choose Create Alert and perform the following actions:

1. For Rule Name, provide a unique name for your new Simple Log Service (SLS) alert.
2. For Check Frequency, specify a check frequency and a time range based on your requirements on data timeliness and integrity.
3. For Query Statistics, choose Create, and provide the following details:
   1. Select the Advanced Settings tab.
   2. For Type, choose Logstore.
   3. For Authorization, choose Default.
   4. For Logstore, choose oss_log.
   5. For Dedicated SQL, select Disable: Do not use dedicated SQL for query and analysis. Use common SQL for query and analysis.
   6. For Time Range, choose 15 Minutes (Relative).
   7. Paste the following SQL query in the Query box: (operation: PutBucket and request_uri: acl) or operation: PutObjectAcl | select bucket, count (1) as c group by bucket. Select Preview to test the query and choose Confirm.
4. For Group Evaluation, choose No Grouping.
5. For Trigger Condition, choose When: Data is returned, and select the appropriate severity level.
6. For Add Annotation, enter Simple Log Service (SLS) alert for detecting OSS bucket permission changes for desc and Create Alert for OSS Bucket Permission Changes for title.
7. Choose Advanced Settings and set Threshold of Continuous Triggers to 1. For No Data Alert, choose whether to trigger an alert if no data exists.
8. For Destination, choose Simple Log Service Notification, select Enable, and configure the necessary Alert Policy. You can use one of the following options to configure your alert policy: Simple Mode - where a built-in policy manages alerts and automatically creates an action policy, Standard Mode - where a built-in policy manages alerts and you only need to specify an action policy, or Advanced Mode - where you can select a built-in alert policy to merge the alerts of multiple alert monitoring rules. For example, you can set the Alert Policy to Advanced Mode and select the SLS audit built-in alert policy (sls.app.audit.builtin). You can also set a Repeat Interval at this point. If an alert is repeatedly triggered, the alert notification is sent only after the specified Repeat Interval.
9. Choose OK to create your Simple Log Service (SLS) alert for monitoring OSS bucket permission changes.