Logs in Key Management Service

Key Management Service (KMS) keeps logs of actions that are performed on symmetric and asymmetric keys. You can view and analyze these logs as events in the Audit Logs service. KMS only supports control plane logs. They describe key management and lifecycle events, such as creating, updating, deleting or rotating a key.

Prerequisites

Web console
CLI
Go SDK
Python SDK
JavaScript SDK

Make sure that you have a role that allows you to view audit events.

Install and initialize the Nebius SDK for Go.
Make sure that the service account you use with the SDK is in a group with a role that allows viewing audit events. The default editors group doesn’t have this role.

Install and initialize the Nebius SDK for Python.
Make sure that the service account you use with the SDK is in a group with a role that allows viewing audit events. The default editors group doesn’t have this role.

Install and initialize the Nebius SDK for JavaScript.
Make sure that the service account you use with the SDK is in a group with a role that allows viewing audit events. The default editors group doesn’t have this role.

How to view logs

Web console
CLI
Go SDK
Python SDK
JavaScript SDK

In the sidebar, go to Administration → Audit Logs.
Select the region to search for KMS audit events.
Select Control plane.
Filter events by the KMS service. If this filter is not displayed, click Filters and then select Service.

Run nebius audit v2 audit-event list:

nebius audit v2 audit-event list \
   --parent-id <tenant_ID> \
   --start <time_in_ISO_8601> \
   --end <time_in_ISO_8601> \
   --filter "service.name='KMS'" \
   --event-type control_plane \
   --region <region_ID>

In the command, specify:

--parent-id: Tenant ID.
--start: Start time for the search, in the ISO 8601 format.
--end: End time for the search, in the ISO 8601 format.
--region: Region to search for KMS audit events.
--filter: Filter expression. Set it to service.name='KMS' to return only KMS events. For more information, see How to filter audit events.
--event-type: Type of audit event. Set it to control_plane because KMS only supports control plane logs.

List KMS audit events:

auditService := sdk.Services().Audit().V2().AuditEvent()
startTime, err := time.Parse(time.RFC3339, "<time_in_ISO_8601>")
if err != nil {
    return fmt.Errorf("parse start time: %w", err)
}
endTime, err := time.Parse(time.RFC3339, "<time_in_ISO_8601>")
if err != nil {
    return fmt.Errorf("parse end time: %w", err)
}
events, err := auditService.List(
    ctx,
    &audit.ListAuditEventRequest{
        ParentId: "<tenant_ID>",
        Start: timestamppb.New(startTime),
        End: timestamppb.New(endTime),
        Filter: "service.name='KMS'",
        EventType: audit.EventType_CONTROL_PLANE,
        Region: "<region_ID>",
    },
)
if err != nil {
    return fmt.Errorf("list audit events: %w", err)
}
fmt.Println(events)

In the code, specify:

ParentId: Tenant ID.
Start: Start time for the search, in the ISO 8601 format with a timezone, for example, 2026-05-07T10:00:00Z.
End: End time for the search, in the ISO 8601 format with a timezone.
Filter: Filter expression. Set it to service.name='KMS' to return only KMS events. For more information, see How to filter audit events.
EventType: Type of audit event. Set it to audit.EventType_CONTROL_PLANE because KMS only supports control plane logs.
Region: Region to search for KMS audit events.

List KMS audit events:

service = audit.AuditEventServiceClient(sdk)
events = await service.list(
    audit.ListAuditEventRequest(
        parent_id="<tenant_ID>",
        start=datetime.fromisoformat("<time_in_ISO_8601>"),
        end=datetime.fromisoformat("<time_in_ISO_8601>"),
        filter="service.name='KMS'",
        event_type=audit.EventType.CONTROL_PLANE,
        region="<region_ID>",
    ),
)
print(events)

In the code, specify:

parent_id: Tenant ID.
start: Start time for the search, in the ISO 8601 format.
end: End time for the search, in the ISO 8601 format.
filter: Filter expression. Set it to service.name='KMS' to return only KMS events. For more information, see How to filter audit events.
event_type: Type of audit event. Set it to audit.EventType.CONTROL_PLANE because KMS only supports control plane logs.
region: Region to search for KMS audit events.

List KMS audit events:

const auditService = new audit.AuditEventService(sdk);
const events = await auditService.list(
  audit.ListAuditEventRequest.create({
    parentId: "<tenant_ID>",
    start: dayjs("<time_in_ISO_8601>"),
    end: dayjs("<time_in_ISO_8601>"),
    filter: "service.name='KMS'",
    eventType: audit.EventType.CONTROL_PLANE,
    region: "<region_ID>",
  }),
).result;
console.log(events);

In the code, specify:

parentId: Tenant ID.
start: Start time for the search, in the ISO 8601 format.
end: End time for the search, in the ISO 8601 format.
filter: Filter expression. Set it to service.name='KMS' to return only KMS events. For more information, see How to filter audit events.
eventType: Type of audit event. Set it to audit.EventType.CONTROL_PLANE because KMS only supports control plane logs.
region: Region to search for KMS audit events.

For more details, see Viewing events in Audit Logs. Parameters of an action, such as creating a key, are returned in the .request.parameters field of the Audit Logs event. For example:

{
  "request": {
    "parameters": {
      "metadata": {
        "id": "<key_ID>",
        "parent_id": "<project_ID>",
        "name": "<key_name>",
        "resource_version": "0",
        "labels": {}
      },
      "spec": {
        "description": "<key_description>",
        "algorithm": "<key_algorithm>"
      }
    }
  }
}

For more details, see Structure and fields of events in Audit Logs.

Security

Audit Logs

Key Management Service

SecretStash (formerly MysteryBox)

Logs in Key Management Service

Prerequisites

How to view logs

​Prerequisites

​How to view logs

Prerequisites

How to view logs