Retrieve audit log events

Changes on organizations, folders and projects and respective cloud resources are logged and collected in the audit log.

Prerequisites

To access the audit log with a user account, you must have the audit-log.entry.get permission. This permission is currently granted to users with the project owner, editor, reader or audit-log.reader role.

Service accounts require the audit-log.reader role to access audit logs. To assign this role to a user or service account, follow these steps:

1. Navigate to IAM and management > Access.
2. Click Grant access.
3. Paste the email address into the Subject field and click +Add.
4. In the role dropdown select By products or services > Audit log > Audit log reader.
5. Click Save.

View events in the STACKIT Portal

You can view audit log events directly in the STACKIT Portal. A list of all events from the last 90 days is displayed, showing the event name, the initiator, and the time the action was carried out.

To view the logs, navigate to Information > Audit log in the side navigation menu.

Depending on whether you have currently selected an organization, a folder, or a project in the portal, the audit log will show the events specific to that exact resource.

The audit log is strictly scoped to the selected resource and cannot be accessed by or from another resource.

Log event attributes

Each event in the log contains the following information:

• stackit.action: The action that triggered the event.
• stackit.log.id: A unique identifier for tracing the event.
• timeUnixNano: The creation time of the event.
• stackit.initiator: The global user ID of the user who performed the action.
• client.address: The IP address of the user who performed the action.
• stackit.resource.id: The ID of the organization, folder, or project the event belongs to.

Route events via Telemetry Router

Audit logs across all levels (organizations, folders, and projects) can be routed to any OpenTelemetry or S3 compatible destination by setting up a Telemetry Router.

Refer to the Telemetry Router Documentation to get started. For a full log example, you can refer to the Data Formats page.