Skip to content

Commit

Permalink
feat: Record policy source attributes in audit log (#1889)
Browse files Browse the repository at this point in the history
Adds ability for stores to add attributes to policies so that they can
be recorded in the audit log. One example of this is recording the git
hash of the store at the point a policy is loaded by the engine to make
a decision. This information can then be used in later analysis to
correlate the state of the policy repository with the access decisions.

Example of an audit trail produced by this change:

```json
{
...
  "auditTrail": {
    "effectivePolicies": {
      "resource.leave_request.vdefault": {
        "attributes": {
          "commit_hash": "432bb16caac0a3cf7232532dac68b09a28cd2dc3",
          "driver": "git",
          "source": "store/resource_policies/policy_05.yaml"
        }
      },
      "resource.leave_request.vdefault/acme": {
        "attributes": {
          "commit_hash": "432bb16caac0a3cf7232532dac68b09a28cd2dc3",
          "driver": "git",
          "source": "store/resource_policies/policy_05_acme.yaml"
        }
      },
      "resource.leave_request.vdefault/acme.hr": {
        "attributes": {
          "commit_hash": "432bb16caac0a3cf7232532dac68b09a28cd2dc3",
          "driver": "git",
          "source": "store/resource_policies/policy_05_acme.hr.yaml"
        }
      },
      "resource.leave_request.vdefault/acme.hr.uk": {
        "attributes": {
          "commit_hash": "432bb16caac0a3cf7232532dac68b09a28cd2dc3",
          "driver": "git",
          "source": "store/resource_policies/policy_05_acme.hr.uk.yaml"
        }
      }
    }
  }
...
}
```

---------

Signed-off-by: Charith Ellawala <charith@cerbos.dev>
  • Loading branch information
charithe committed Dec 7, 2023
1 parent e7d6014 commit e66df40
Show file tree
Hide file tree
Showing 95 changed files with 10,949 additions and 4,815 deletions.
1 change: 1 addition & 0 deletions .golangci.yaml
Expand Up @@ -104,6 +104,7 @@ issues:
exclude-rules:
- path: _test\.go
linters:
- dupl
- forcetypeassert
- goconst
- gomnd
Expand Down
357 changes: 225 additions & 132 deletions api/genpb/cerbos/audit/v1/audit.pb.go

Large diffs are not rendered by default.

8 changes: 8 additions & 0 deletions api/genpb/cerbos/audit/v1/audit_hashpb.pb.go

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

0 comments on commit e66df40

Please sign in to comment.