Description

Ensure the OVHcloud account audit logs, which record security events such as logins, password changes, and two-factor authentication changes, are forwarded to a data stream in a Logs Data Platform (LDP) account, so they can be stored, searched, and used for alerts.

Rationale

Audit logs show who signed in and when security settings changed, which is essential for detecting account takeover and investigating incidents. Forwarding them to Logs Data Platform keeps them in a searchable store, allows alerts on suspicious events, and supports compliance retention requirements.

Impact

  • Security events are kept and can be searched

  • Enables alerts on suspicious logins or changes

  • Logs Data Platform storage is billed

Default Value

By default, account audit logs are not forwarded to Logs Data Platform.

Pre-Requisites

  • Access to the OVHcloud account owner login or an IAM administrator

  • A Logs Data Platform account in the same OVHcloud account with at least one active data stream

Test Plan

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Identity, Security & Operations.

  3. Select Account Logs. The page shows three tabs: Access policy logs, Activity logs, and Audit logs.

  4. Open the Audit logs tab and check the subscription panel for an active subscription to a Logs Data Platform data stream.

  5. Alternatively, run GET /me/logs/audit/log/subscription in the API console at https://eu.api.ovh.com/console/ (or your region's console) and check that a subscription exists.

  6. If no subscription exists, follow the implementation steps.

Implementation Steps

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Identity, Security & Operations.

  3. Select Account Logs and open the Audit logs tab.

  4. In the subscription panel, select your Logs Data Platform account, then click Subscribe on the data stream that should receive the logs.

  5. Confirm that the subscription appears as active and that audit logs start arriving in the data stream (Identity, Security & Operations > Logs Data Platform > your account > Data stream tab).

  6. Alternatively, with the API: copy the stream ID from the Data stream tab of your Logs Data Platform account (Copy stream ID), then run POST /me/logs/audit/log/subscription with the streamId.

Backout Plan

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Identity, Security & Operations.

  3. Select Account Logs, open the Audit logs tab, and click Unsubscribe on the data stream.

  4. Alternatively, run DELETE /me/logs/audit/log/subscription/{subscriptionId} in the API console.

Reference