Activity Tracker Event Routing to Your Bucket, Every Location, Private API
Activity Tracker Event Routing with a COS target written service-to-service (no API key stored), a route that sends every location's events to it (a narrower list by name), and the account settings that keep routing metadata in your region, make the target the default, and answer the routing API on private endpoints only. Without a route, events go nowhere you keep.
Verification
Static-verifiedPassed: validated and lint-clean (provider-schema-validated for AWS/Azure/GCP; Terraform-language lint elsewhere).
Conformance
- Static validation (fmt · validate · tflint)
- No applicable security policies for this provider
- Plan tests (mocked: validation rules · outputs)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live test pending (no cloud run yet)
Last verified 2026-09-14 · how we verify
Use it from the registry
terraform · opentofumodule "activity_tracker" {
source = "www.iac-bazaar.com/iac-bazaar/ibm-activity-tracker/ibmcloud"
version = "1.0.0"
}Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.
Inputs & outputs
Create a free account to read this module's contract
The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.
Documentation
ibm-activity-tracker
Activity Tracker Event Routing to a COS bucket you own: the target, a
route for every location, and the account settings that keep the API
private. Works with Terraform and OpenTofu (>= 1.6), ibm
provider >= 1.60, < 3.0.
Without a route, events go nowhere you keep.
The bucket is written service-to-service; no API key is stored.
Every location; a narrower list by name.
Verification
Static validation runs tofu fmt, init, validate, tflint and checkov.
This module has not yet had a live test, so it is published as statically
validated with its live test pending and does not carry the live-tested mark.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Usage
Related modules
tencent-cloud-audit
A CloudAudit tracking set scoped to every resource type, action and event name (narrower by name), compressed and delivered to a COS bucket you own under a prefix. The console keeps ninety days and forgets; the tracking set is what keeps more. Organization tracking collects every member account from the management account.
alicloud-actiontrail
An ActionTrail trail that records every region and both reads and writes (narrower by name), delivered to an OSS bucket you own through the service role and, when a project is given, to Log Service for queries. The console keeps ninety days and forgets; the trail is what keeps more. An organization trail collects every member account from the management account.
gcp-audit-logging
Data Access logs are off by default for every service but BigQuery, so a project that never turned them on has no record of who read the bucket, queried the table or fetched the secret. Enables all three log types for allServices, narrows per service where read volume is a real cost, and requires a reason for every exempted member - the setting an intruder with IAM rights would add.
oci-audit
Audit retention set to the 365-day ceiling OCI allows, plus the archive for everything past it: a private bucket with a retention rule (seven years by default, lockable by a date you pass), the service connector that streams every compartment's audit events into it, and the IAM policy without which the connector sits in FAILED. Your Vault key, or the Oracle-managed one by name.
aws-cloudtrail
Multi-region trail with log file validation always on, a bucket that blocks public access, versions, encrypts and denies non-TLS, a policy pinned to this trail, optional CloudWatch delivery and opt-in data events.
azure-activity-log
The subscription's Activity Log exported to a Log Analytics workspace, a storage account and/or an Event Hub, because Azure keeps it for ninety days and then forgets. All eight categories go; dropping Administrative, Security or Policy, the three an investigation asks for, is accepted by name. The workspace's retention is the workspace's setting; the years live in the storage account.