Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

(elasticsearch): add support for audit logs #12105

Closed
1 task done
Ruben-E opened this issue Dec 16, 2020 · 1 comment · Fixed by #12106
Closed
1 task done

(elasticsearch): add support for audit logs #12105

Ruben-E opened this issue Dec 16, 2020 · 1 comment · Fixed by #12106
Assignees
@iliapolo
Labels
@aws-cdk/aws-elasticsearch Related to Amazon Elasticsearch Service effort/small Small work item – less than a day of effort feature-request A feature should be added or improved. p1

Comments

@Ruben-E
Copy link
Contributor

Ruben-E commented Dec 16, 2020

In September AWS offers audit logs for all Elasticsearch requests: https://aws.amazon.com/about-aws/whats-new/2020/09/elasticsearch-audit-logs-now-available-on-amazon-elasticsearch-service/.

Enabling this is not yet supported in the L2 Domain construct.

Use Case

  • To enable audit logs for a domain with CDK so all requests can be logged

Proposed Solution

Cloudformation supports it via the same way other logs can be enabled:

"LogPublishingOptions": {
    "AUDIT_LOGS": {
        "Enabled": true
        "CloudWatchLogsLogGroupArn": { ... }
    },
    "ES_APPLICATION_LOGS": {
        "Enabled": false
    },
}

Other

  • 👋 I may be able to implement this feature request

This is a 🚀 Feature Request
@Ruben-E Ruben-E added feature-request A feature should be added or improved. needs-triage This issue or PR still needs to be triaged. labels Dec 16, 2020
@github-actions github-actions bot added the @aws-cdk/aws-elasticsearch Related to Amazon Elasticsearch Service label Dec 16, 2020
Ruben-E added a commit to Ruben-E/aws-cdk that referenced this issue Dec 16, 2020
@Ruben-E
feat(elasticsearch): added support for audit logs
d284a05 
Implemented support for audit logs like other logs (application, slow search and slow index) are implemented.
Audit logs can only be enabled when fine grained access control is enabled. Added a check for that. Als updated the docs.

closes aws#12105
@Ruben-E Ruben-E mentioned this issue Dec 16, 2020
Merged
@iliapolo iliapolo added effort/small Small work item – less than a day of effort p1 and removed needs-triage This issue or PR still needs to be triaged. labels Dec 16, 2020
@mergify mergify bot closed this as completed in #12106 Dec 16, 2020
mergify bot pushed a commit that referenced this issue Dec 16, 2020
@Ruben-E
feat(elasticsearch): support audit logs (#12106)
d10ea63 
Implemented support for audit logs like other logs (application, slow search and slow index) are implemented.
Audit logs can only be enabled when fine grained access control is enabled and ES version >= 6.7 [see here](https://aws.amazon.com/about-aws/whats-new/2020/09/elasticsearch-audit-logs-now-available-on-amazon-elasticsearch-service/).

The check for fine grained access control enabled is implemented. Version check is implicitly implemented since fine grained access control cannot be enabled < 6.7.

Closes #12105

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
@github-actions
Copy link

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.

flochaz pushed a commit to flochaz/aws-cdk that referenced this issue Jan 5, 2021
@Ruben-E @flochaz
feat(elasticsearch): support audit logs (aws#12106)
c9d8382 
Implemented support for audit logs like other logs (application, slow search and slow index) are implemented.
Audit logs can only be enabled when fine grained access control is enabled and ES version >= 6.7 [see here](https://aws.amazon.com/about-aws/whats-new/2020/09/elasticsearch-audit-logs-now-available-on-amazon-elasticsearch-service/).

The check for fine grained access control enabled is implemented. Version check is implicitly implemented since fine grained access control cannot be enabled < 6.7.

Closes aws#12105

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@iliapolo iliapolo

Labels
@aws-cdk/aws-elasticsearch Related to Amazon Elasticsearch Service effort/small Small work item – less than a day of effort feature-request A feature should be added or improved. p1
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

feat(elasticsearch): support audit logs Ruben-E/aws-cdk
2 participants
@iliapolo @Ruben-E