[v14] External Audit Storage: rename from ExternalCloudAudit (part 1)

api/client/client.go

@@ -44,6 +44,7 @@ import (
 	"github.com/gravitational/teleport/api/breaker"
 	"github.com/gravitational/teleport/api/client/accesslist"
 	"github.com/gravitational/teleport/api/client/discoveryconfig"
+	"github.com/gravitational/teleport/api/client/externalauditstorage"
 	"github.com/gravitational/teleport/api/client/externalcloudaudit"
 	"github.com/gravitational/teleport/api/client/okta"
 	"github.com/gravitational/teleport/api/client/proto"
@@ -56,6 +57,7 @@ import (
 	auditlogpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/auditlog/v1"
 	devicepb "github.com/gravitational/teleport/api/gen/proto/go/teleport/devicetrust/v1"
 	discoveryconfigv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/discoveryconfig/v1"
+	externalauditstoragev1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/externalauditstorage/v1"
 	externalcloudauditv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/externalcloudaudit/v1"
 	integrationpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/integration/v1"
 	kubeproto "github.com/gravitational/teleport/api/gen/proto/go/teleport/kube/v1"
@@ -816,6 +818,15 @@ func (c *Client) ExternalCloudAuditClient() *externalcloudaudit.Client {
 	return externalcloudaudit.NewClient(externalcloudauditv1.NewExternalCloudAuditServiceClient(c.conn))
 }
 
+// ExternalAuditStorageClient returns an unadorned External Cloud Audit client,
+// using the underlying Auth gRPC connection.
+// Clients connecting to non-Enterprise clusters, or older Teleport versions,
+// still get a external audit client when calling this method, but all RPCs will
+// return "not implemented" errors (as per the default gRPC behavior).
+func (c *Client) ExternalAuditStorageClient() *externalauditstorage.Client {
+	return externalauditstorage.NewClient(externalauditstoragev1.NewExternalAuditStorageServiceClient(c.conn))
+}
+
 // TrustClient returns an unadorned Trust client, using the underlying
 // Auth gRPC connection.
 func (c *Client) TrustClient() trustpb.TrustServiceClient {

api/client/events.go

@@ -23,8 +23,6 @@ import (
 	accesslistv1conv "github.com/gravitational/teleport/api/types/accesslist/convert/v1"
 	"github.com/gravitational/teleport/api/types/discoveryconfig"
 	discoveryconfigv1conv "github.com/gravitational/teleport/api/types/discoveryconfig/convert/v1"
-	"github.com/gravitational/teleport/api/types/externalcloudaudit"
-	externalcloudauditv1conv "github.com/gravitational/teleport/api/types/externalcloudaudit/convert/v1"
 	"github.com/gravitational/teleport/api/types/secreports"
 	secreprotsv1conv "github.com/gravitational/teleport/api/types/secreports/convert/v1"
 	"github.com/gravitational/teleport/api/types/userloginstate"
@@ -164,10 +162,6 @@ func EventToGRPC(in types.Event) (*proto.Event, error) {
 		out.Resource = &proto.Event_SessionRecordingConfig{
 			SessionRecordingConfig: r,
 		}
-	case *externalcloudaudit.ExternalCloudAudit:
-		out.Resource = &proto.Event_ExternalCloudAudit{
-			ExternalCloudAudit: externalcloudauditv1conv.ToProto(r),
-		}
 	case *types.AuthPreferenceV2:
 		out.Resource = &proto.Event_AuthPreference{
 			AuthPreference: r,

api/client/externalauditstorage/externalauditstorage.go

@@ -0,0 +1,122 @@
+// Copyright 2023 Gravitational, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package externalauditstorage
+
+import (
+	"context"
+
+	"github.com/gravitational/trace"
+
+	externalauditstoragev1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/externalauditstorage/v1"
+	"github.com/gravitational/teleport/api/types/externalauditstorage"
+	conv "github.com/gravitational/teleport/api/types/externalauditstorage/convert/v1"
+)
+
+// Client is an External Audit Storage client.
+type Client struct {
+	grpcClient externalauditstoragev1.ExternalAuditStorageServiceClient
+}
+
+// NewClient creates a new ExternalAuditStorage client.
+func NewClient(grpcClient externalauditstoragev1.ExternalAuditStorageServiceClient) *Client {
+	return &Client{
+		grpcClient: grpcClient,
+	}
+}
+
+// TestDraftExternalAuditStorageBuckets tests the connection to the current draft buckets.
+func (c *Client) TestDraftExternalAuditStorageBuckets(ctx context.Context) error {
+	_, err := c.grpcClient.TestDraftExternalAuditStorageBuckets(ctx, &externalauditstoragev1.TestDraftExternalAuditStorageBucketsRequest{})
+	return trace.Wrap(err)
+}
+
+// TestDraftExternalAuditStorageGlue tests the configuration to the current draft glue table and database.
+func (c *Client) TestDraftExternalAuditStorageGlue(ctx context.Context) error {
+	_, err := c.grpcClient.TestDraftExternalAuditStorageGlue(ctx, &externalauditstoragev1.TestDraftExternalAuditStorageGlueRequest{})
+	return trace.Wrap(err)
+}
+
+// TestDraftExternalAuditStorageAthena tests the configuration to the current draft athena.
+func (c *Client) TestDraftExternalAuditStorageAthena(ctx context.Context) error {
+	_, err := c.grpcClient.TestDraftExternalAuditStorageAthena(ctx, &externalauditstoragev1.TestDraftExternalAuditStorageAthenaRequest{})
+	return trace.Wrap(err)
+}
+
+// GetDraftExternalAuditStorage returns the draft External Audit Storage configuration resource.
+func (c *Client) GetDraftExternalAuditStorage(ctx context.Context) (*externalauditstorage.ExternalAuditStorage, error) {
+	resp, err := c.grpcClient.GetDraftExternalAuditStorage(ctx, &externalauditstoragev1.GetDraftExternalAuditStorageRequest{})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	externalAudit, err := conv.FromProtoDraft(resp.GetExternalAuditStorage())
+	return externalAudit, trace.Wrap(err)
+}
+
+// UpsertDraftExternalAuditStorage upserts a draft External Audit Storage resource.
+func (c *Client) UpsertDraftExternalAuditStorage(ctx context.Context, in *externalauditstorage.ExternalAuditStorage) (*externalauditstorage.ExternalAuditStorage, error) {
+	resp, err := c.grpcClient.UpsertDraftExternalAuditStorage(ctx, &externalauditstoragev1.UpsertDraftExternalAuditStorageRequest{
+		ExternalAuditStorage: conv.ToProto(in),
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	out, err := conv.FromProtoDraft(resp.GetExternalAuditStorage())
+	return out, trace.Wrap(err)
+}
+
+// GenerateDraftExternalAuditStorage create a new draft External Audit Storage
+// resource with randomized resource names and upserts it as the current
+// draft.
+func (c *Client) GenerateDraftExternalAuditStorage(ctx context.Context, integrationName, region string) (*externalauditstorage.ExternalAuditStorage, error) {
+	resp, err := c.grpcClient.GenerateDraftExternalAuditStorage(ctx, &externalauditstoragev1.GenerateDraftExternalAuditStorageRequest{
+		IntegrationName: integrationName,
+		Region:          region,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	out, err := conv.FromProtoDraft(resp.GetExternalAuditStorage())
+	return out, trace.Wrap(err)
+}
+
+// DeleteDraftExternalAuditStorage removes draft External Audit Storage resource.
+func (c *Client) DeleteDraftExternalAuditStorage(ctx context.Context) error {
+	_, err := c.grpcClient.DeleteDraftExternalAuditStorage(ctx, &externalauditstoragev1.DeleteDraftExternalAuditStorageRequest{})
+	return trace.Wrap(err)
+}
+
+// PromoteToClusterExternalAuditStorage promotes the current draft External
+// Audit Storage configuration to be used in the cluster.
+func (c *Client) PromoteToClusterExternalAuditStorage(ctx context.Context) error {
+	_, err := c.grpcClient.PromoteToClusterExternalAuditStorage(ctx, &externalauditstoragev1.PromoteToClusterExternalAuditStorageRequest{})
+	return trace.Wrap(err)
+}
+
+// GetClusterExternalAuditStorage gets cluster External Audit Storage.
+func (c *Client) GetClusterExternalAuditStorage(ctx context.Context) (*externalauditstorage.ExternalAuditStorage, error) {
+	resp, err := c.grpcClient.GetClusterExternalAuditStorage(ctx, &externalauditstoragev1.GetClusterExternalAuditStorageRequest{})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	externalAudit, err := conv.FromProtoCluster(resp.GetClusterExternalAuditStorage())
+	return externalAudit, trace.Wrap(err)
+}
+
+// DisableClusterExternalAuditStorage disables the External Audit Storage feature,
+// which means default cloud audit will be used.
+func (c *Client) DisableClusterExternalAuditStorage(ctx context.Context) error {
+	_, err := c.grpcClient.DisableClusterExternalAuditStorage(ctx, &externalauditstoragev1.DisableClusterExternalAuditStorageRequest{})
+	return trace.Wrap(err)
+}