Documentation
¶
Overview ¶
Package audithook provides an audit event recording extension for Vault. It bridges Vault operations to external audit systems (e.g. Chronicle).
Index ¶
Constants ¶
const ( // Secret actions. ActionSecretAccessed = "secret.accessed" ActionSecretSet = "secret.set" ActionSecretDeleted = "secret.deleted" ActionSecretRotated = "secret.rotated" // Flag actions. ActionFlagEvaluated = "flag.evaluated" ActionFlagCreated = "flag.created" ActionFlagUpdated = "flag.updated" ActionFlagDeleted = "flag.deleted" ActionFlagToggled = "flag.toggled" // ActionFlagRulesSet records a whole-list replacement of a flag's // targeting rules. ActionFlagRulesSet = "flag.rules_set" // ActionFlagOverrideSet records a per-tenant override being written. ActionFlagOverrideSet = "flag.override_set" // ActionFlagOverrideDeleted records a per-tenant override being removed. ActionFlagOverrideDeleted = "flag.override_deleted" // Config actions. ActionConfigSet = "config.set" ActionConfigDeleted = "config.deleted" // ActionConfigRolledBack records a config entry's value being restored // from an earlier version. ActionConfigRolledBack = "config.rolled_back" // Override actions. ActionOverrideSet = "override.set" ActionOverrideDeleted = "override.deleted" // ActionRotationPolicySaved records a rotation policy being created or // changed. The policy's secret key is the row's key. ActionRotationPolicySaved = "rotation.policy_saved" // ActionRotationPolicyDeleted records a rotation policy being removed. ActionRotationPolicyDeleted = "rotation.policy_deleted" )
Standard audit actions for Vault operations.
const ( CategorySecret = "vault.secret" CategoryFlag = "vault.flag" CategoryConfig = "vault.config" CategoryOverride = "vault.override" CategoryRotation = "vault.rotation" )
Audit event categories.
const ( ResourceSecret = "secret" ResourceFlag = "flag" ResourceConfig = "config" ResourceOverride = "override" ResourceRotation = "rotation" )
Resource types.
const ( SeverityInfo = "info" SeverityWarning = "warning" SeverityCritical = "critical" )
Severity levels.
const ( OutcomeSuccess = "success" OutcomeFailure = "failure" )
Outcome values.
Variables ¶
This section is empty.
Functions ¶
func AllActions ¶
func AllActions() []string
AllActions returns all registered audit action strings.
Types ¶
type AuditEvent ¶
type AuditEvent struct {
Action string `json:"action"`
Resource string `json:"resource"`
Category string `json:"category"`
ResourceID string `json:"resource_id"`
Key string `json:"key"`
Metadata map[string]any `json:"metadata,omitempty"`
Outcome string `json:"outcome"`
Severity string `json:"severity"`
Reason string `json:"reason,omitempty"`
}
AuditEvent represents a single audit event emitted by the extension.
type Extension ¶
type Extension struct {
// contains filtered or unexported fields
}
Extension is an audit recording extension that forwards events to a Recorder. Actions can be filtered so only selected events are recorded.
func (*Extension) Record ¶
func (e *Extension) Record( ctx context.Context, action, severity, outcome, resource, resourceID, category, key string, err error, kvPairs ...any, )
Record emits an audit event through the recorder. kvPairs are additional metadata key-value pairs (alternating string key, any value).
type Option ¶
type Option func(*Extension)
Option configures the Extension.
func WithActions ¶
WithActions limits the extension to only record the specified actions. If not set, all actions are recorded.
func WithLogger ¶
WithLogger sets the logger for the extension.
type Recorder ¶
type Recorder interface {
Record(ctx context.Context, event *AuditEvent) error
}
Recorder records audit events to an external system.
type RecorderFunc ¶
type RecorderFunc func(ctx context.Context, event *AuditEvent) error
RecorderFunc is a function adapter for Recorder.
func (RecorderFunc) Record ¶
func (f RecorderFunc) Record(ctx context.Context, event *AuditEvent) error
Record implements Recorder.
Source Files