Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[cli] Log Secret Decryption events when using 3rd party secrets + service #8563

Merged
merged 1 commit into from
Dec 15, 2021

Conversation

stack72
Copy link
Contributor

@stack72 stack72 commented Dec 8, 2021

For users who use the Pulumi Service for their state BUT a 3rd party
secrets provider, we now log when that secret decryption has happened.

We have 2 forms of logs:

  • single secret when a user uses pulumi config get x --show-secrets
  • batch decryption for when a user runs a stack export or config list

The API logs to request are fire and forget. The API response is a 204
so we don't need to do anything with the response.

Description

Fixes # (issue)

Checklist

  • I have added tests that prove my fix is effective or that my feature works
  • Yes, there are changes in this PR that warrants bumping the Pulumi Service API version

@codecov
Copy link

codecov bot commented Dec 8, 2021

Codecov Report

Merging #8563 (d25e81b) into master (ee81da2) will decrease coverage by 18.60%.
The diff coverage is 0.00%.

❗ Current head d25e81b differs from pull request most recent head 94bebe0. Consider uploading reports for the commit 94bebe0 to get more accurate results
Impacted file tree graph

@@             Coverage Diff             @@
##           master    #8563       +/-   ##
===========================================
- Coverage   58.81%   40.20%   -18.61%     
===========================================
  Files         634      627        -7     
  Lines       97038    94839     -2199     
  Branches     1378     1378               
===========================================
- Hits        57076    38134    -18942     
- Misses      36711    54065    +17354     
+ Partials     3251     2640      -611     
Impacted Files Coverage Δ
pkg/backend/httpstate/client/client.go 36.87% <0.00%> (-0.91%) ⬇️
pkg/cmd/pulumi/config.go 35.31% <0.00%> (-0.26%) ⬇️
pkg/cmd/pulumi/stack.go 20.74% <0.00%> (-0.27%) ⬇️
pkg/cmd/pulumi/stack_export.go 50.56% <0.00%> (-1.77%) ⬇️
pkg/cmd/pulumi/stack_history.go 19.49% <0.00%> (-0.38%) ⬇️
pkg/cmd/pulumi/stack_output.go 27.27% <0.00%> (-1.11%) ⬇️
pkg/cmd/pulumi/util.go 38.72% <0.00%> (-2.42%) ⬇️
pkg/codegen/docs.go 0.00% <0.00%> (-100.00%) ⬇️
pkg/codegen/go/gen_spill.go 0.00% <0.00%> (-100.00%) ⬇️
pkg/codegen/dotnet/templates.go 0.00% <0.00%> (-100.00%) ⬇️
... and 167 more

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 664ed0e...94bebe0. Read the comment docs.

@stack72 stack72 requested review from a team and removed request for justinvp December 15, 2021 18:26
Copy link
Member

@justinvp justinvp left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

pkg/cmd/pulumi/util.go Outdated Show resolved Hide resolved
pkg/cmd/pulumi/util.go Show resolved Hide resolved
…vice

For users who use the Pulumi Service for their state BUT a 3rd party
secrets provider, we now log when that secret decryption has happened.

We have 2 forms of logs:

* single secret when a user uses `pulumi config get x --show-secrets`
* batch decryption for when a user runs a stack export or config list

The API logs to request are fire and forget. The API response is a 204
so we don't need to do anything with the response.
@stack72 stack72 merged commit 4ab8b24 into master Dec 15, 2021
@stack72 stack72 deleted the real-audit-logs branch December 15, 2021 21:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants