How to activate vault audit#

To activate vault audit backend, first you'll need some new policies to manage it

Add policies to manage vault audit#

In the caascad/terraform/lib repo:

Declare the new policies in modules/vault_roles/policies.tf

Then report the policies names: - in the token_policies property of the vault_admin resource in modules/vault_roles/vault_roles.tf - in the policies property of the cscd_administrator resource in the modules/vault_roles/oidc_roles.tf

Activate the vault audit backend#

Once the policies have been added, add the resource vault_audit on stdout in modules/vault_base/main.tf to activate the vault audit device

Loki queries example for vault audit logs#

Vault audit logs are json object and queriable through Loki. To query the log in Grafana, you'll need to use the json parser in a LogQl query. To be sure to not have parsing issues, Json Parser errors must be excluded from the result.

Some fields are not parsed due to their type (list). They have to be explicitly specified.

{app="vault"} | json | json auth_policies="auth.policies", auth_token_policies="auth.token_policies" | __error__!="JSONParserErr"

List of available fields#

Field	Description
`app`	Name of the app
`auth_accessor`	ID of the authentification backend
`auth_client_token`	Client token
`auth_display_name`	Auth Backend Name + Alias or username
`auth_entity_id`	Entity's ID
`auth_metadata_role`	Authentification backend role name
`auth_metadata_role_name`	Authentification backend role name
`auth_metadata_service_account_name`	Bound service account names
`auth_metadata_service_account_namespace`	Bound service account namespaces
`auth_metadata_service_account_secret_name`	Generated token Name
`auth_metadata_service_account_uid`	Generated token ID
`auth_policies`	List of policies attached to the account
`auth_token_issue_time`	Generated token timestamp
`auth_token_policies`	Policies for the token
`auth_token_ttl`	Token TTL
`auth_token_type`	Token type
`container`	Container's name
`filename`	Logs file filename
`hostname`	Node hostname
`job`	Jobname
`namespace`	Container nemaspace
`node_name`	Node name
`pod`	Pod Name
`request_client_token`	Client token who made the request
`request_client_token_accessor`	Accessor token for the client who made the requet
`request_id`	Request ID
`request_mount_type`	Mount type requested
`request_namespace_id`	Namespace id of the request (always root)
`request_operation`	The operation requested (read/write/list/delete/update)
`request_path`	The path requested
`request_remote_address`	The remote address
`response_data_access_key`
`response_data_approle__accessor`
`response_data_approle__config_default_lease_ttl`
`response_data_approle__config_force_no_cache`
`response_data_approle__config_max_lease_ttl`
`response_data_approle__config_token_type`
`response_data_approle__description`
`response_data_approle__external_entropy_access`
`response_data_approle__local`
`response_data_approle__seal_wrap`
`response_data_approle__type`
`response_data_approle__uuid`
`response_data_bucket_domain_name`
`response_data_bucket_name`
`response_data_endpoint_url`
`response_data_kubernetes__accessor`
`response_data_kubernetes__config_default_lease_ttl`
`response_data_kubernetes__config_force_no_cache`
`response_data_kubernetes__config_max_lease_ttl`
`response_data_kubernetes__config_token_type`
`response_data_kubernetes__description`
`response_data_kubernetes__external_entropy_access`
`response_data_kubernetes__local`
`response_data_kubernetes__seal_wrap`
`response_data_kubernetes__type`
`response_data_kubernetes__uuid`
`response_data_kubernetes_delta__accessor`
`response_data_kubernetes_delta__config_default_lease_ttl`
`response_data_kubernetes_delta__config_force_no_cache`
`response_data_kubernetes_delta__config_max_lease_ttl`
`response_data_kubernetes_delta__config_token_type`
`response_data_kubernetes_delta__description`
`response_data_kubernetes_delta__external_entropy_access`
`response_data_kubernetes_delta__local`
`response_data_kubernetes_delta__seal_wrap`
`response_data_kubernetes_delta__type`
`response_data_kubernetes_delta__uuid`
`response_data_kubernetes_echo__accessor`
`response_data_kubernetes_echo__config_default_lease_ttl`
`response_data_kubernetes_echo__config_force_no_cache`
`response_data_kubernetes_echo__config_max_lease_ttl`
`response_data_kubernetes_echo__config_token_type`
`response_data_kubernetes_echo__description`
`response_data_kubernetes_echo__external_entropy_access`
`response_data_kubernetes_echo__local`
`response_data_kubernetes_echo__seal_wrap`
`response_data_kubernetes_echo__type`
`response_data_kubernetes_echo__uuid`
`response_data_kubernetes_jul__accessor`
`response_data_kubernetes_jul__config_default_lease_ttl`
`response_data_kubernetes_jul__config_force_no_cache`
`response_data_kubernetes_jul__config_max_lease_ttl`
`response_data_kubernetes_jul__config_token_type`
`response_data_kubernetes_jul__description`
`response_data_kubernetes_jul__external_entropy_access`
`response_data_kubernetes_jul__local`
`response_data_kubernetes_jul__seal_wrap`
`response_data_kubernetes_jul__type`
`response_data_kubernetes_jul__uuid`
`response_data_master_password`
`response_data_master_username`
`response_data_oidc__accessor`
`response_data_oidc__config_default_lease_ttl`
`response_data_oidc__config_force_no_cache`
`response_data_oidc__config_max_lease_ttl`
`response_data_oidc__config_token_type`
`response_data_oidc__description`
`response_data_oidc__external_entropy_access`
`response_data_oidc__local`
`response_data_oidc__seal_wrap`
`response_data_oidc__type`
`response_data_oidc__uuid`
`response_data_password`	Hash of the password requested
`response_data_secret_key`
`response_data_token__accessor`
`response_data_token__config_default_lease_ttl`
`response_data_token__config_force_no_cache`
`response_data_token__config_max_lease_ttl`
`response_data_token__config_token_type`
`response_data_token__description`
`response_data_token__external_entropy_access`
`response_data_token__local`
`response_data_token__seal_wrap`
`response_data_token__type`
`response_data_token__uuid`
`response_data_username`	Hash of the username
`response_mount_type`	Mount type (eg: kv, token, aws_sts, ...)
`stream`	Device where the log comes from
`time`	Timestamp
`type`	Object type

Examples#

Example of request for `auth_display_name = "approle"`#

{app="vault"} | json | json auth_policies="auth.policies", auth_token_policies="auth.token_policies" | __error__!="JSONParserErr" | auth_display_name = "approle"

Logs labels#

Field	Value
app	vault
auth_accessor	hmac-sha256:deca8d5e0a801017dc5878ce771ffecc488c9c1ecab040341f256a6bba2862d3
auth_client_token	hmac-sha256:8add859d57853d1122eec7c092e0917617f4e43ee98e1ed76da07736cc791976
auth_display_name	approle
auth_entity_id	8a8e13e5-e0b4-7442-3fb7-e8f933447306
auth_metadata_role_name	concourse-infra
auth_token_issue_time	2022-01-13T03:03:42Z
auth_token_ttl	3600
auth_token_type	service
container	vault
filename	/var/log/pods/vault_vault-cloud-ha-0_302f0c64-9080-4766-a786-c8801e023eee/vault/0.log
hostname	10.0.43.162
job	vault/vault
namespace	vault
node_name	10.0.43.162
pod	vault-cloud-ha-0
request_client_token	hmac-sha256:8add859d57853d1122eec7c092e0917617f4e43ee98e1ed76da07736cc791976
request_client_token_accessor	hmac-sha256:deca8d5e0a801017dc5878ce771ffecc488c9c1ecab040341f256a6bba2862d3
request_id	f3a293ea-a6a5-e6ca-4243-0c4e5e79c9ed
request_mount_type	kv
request_namespace_id	root
request_operation	read
request_path	secret/concourse-infra/global/docker-registry-internal-ro
request_remote_address	172.16.0.96
response_data_password	hmac-sha256:e89116a2f01bd691947d8805e8c1479eea62a78daa43ff0ec453c7900cda0b91
response_data_username	hmac-sha256:fdbde1c2f2dc29d8bc4b70a1eab50e0a7cad08d69c68e4ee52b7266fe474aa8f
response_mount_type	kv
stream	stdout
time	2022-01-13T08:42:48.345626064Z
type	response

Json object#

{
  "time": "2022-01-13T08:42:48.345626064Z",
  "type": "response",
  "auth": {
    "client_token": "hmac-sha256:8add859d57853d1122eec7c092e0917617f4e43ee98e1ed76da07736cc791976",
    "accessor": "hmac-sha256:deca8d5e0a801017dc5878ce771ffecc488c9c1ecab040341f256a6bba2862d3",
    "display_name": "approle",
    "policies": [
      "concourse-infra-approle",
      "default"
    ],
    "token_policies": [
      "concourse-infra-approle",
      "default"
    ],
    "metadata": {
      "role_name": "concourse-infra"
    },
    "entity_id": "8a8e13e5-e0b4-7442-3fb7-e8f933447306",
    "token_type": "service",
    "token_ttl": 3600,
    "token_issue_time": "2022-01-13T03:03:42Z"
  },
  "request": {
    "id": "f3a293ea-a6a5-e6ca-4243-0c4e5e79c9ed",
    "operation": "read",
    "mount_type": "kv",
    "client_token": "hmac-sha256:8add859d57853d1122eec7c092e0917617f4e43ee98e1ed76da07736cc791976",
    "client_token_accessor": "hmac-sha256:deca8d5e0a801017dc5878ce771ffecc488c9c1ecab040341f256a6bba2862d3",
    "namespace": {
      "id": "root"
    },
    "path": "secret/concourse-infra/global/docker-registry-internal-ro",
    "remote_address": "172.16.0.96"
  },
  "response": {
    "mount_type": "kv",
    "secret": {},
    "data": {
      "password": "hmac-sha256:e89116a2f01bd691947d8805e8c1479eea62a78daa43ff0ec453c7900cda0b91",
      "username": "hmac-sha256:fdbde1c2f2dc29d8bc4b70a1eab50e0a7cad08d69c68e4ee52b7266fe474aa8f"
    }
  }
}

Example of request for `auth_display_name = "kubernetes-dashboard-default"`#

{app="vault"} | json | json auth_policies="auth.policies", auth_token_policies="auth.token_policies" | __error__!="JSONParserErr" | auth_display_name = "kubernetes-dashboard-default"

Logs labels#

Field	Value
app	vault
auth_accessor	hmac-sha256:8f68cb90fbae235419d10650bb4d5119f53b28fb701426b7eff804eeb5b2b4d6
auth_client_token	hmac-sha256:d3c642a83016803522483398a2991e1721497a9ff0ab434bf807a587db0d62db
auth_display_name	kubernetes-dashboard-default
auth_entity_id	86bf1212-6aca-25e2-7d15-049bc92d1d5d
auth_metadata_role	dashboard
auth_metadata_service_account_name	default
auth_metadata_service_account_namespace	dashboard
auth_metadata_service_account_secret_name	default-token-dc54x
auth_metadata_service_account_uid	22fb05cf-1024-4c28-a683-45a8b31d4f90
auth_token_issue_time	2022-01-12T10:14:05Z
auth_token_ttl	3600
auth_token_type	service
container	vault
filename	/var/log/pods/vault_vault-cloud-ha-0_302f0c64-9080-4766-a786-c8801e023eee/vault/0.log
hostname	10.0.43.162
job	vault/vault
namespace	vault
node_name	10.0.43.162
pod	vault-cloud-ha-0
request_client_token	hmac-sha256:d3c642a83016803522483398a2991e1721497a9ff0ab434bf807a587db0d62db
request_client_token_accessor	hmac-sha256:8f68cb90fbae235419d10650bb4d5119f53b28fb701426b7eff804eeb5b2b4d6
request_id	64949643-0449-eb90-b557-9953c7efa81a
request_mount_type	kv
request_namespace_id	root
request_operation	read
request_path	secret/applications/concourse/users/admin
request_remote_address	172.16.0.218
response_data_master_password	hmac-sha256:f116a613a3a19454db9ccfe375fb857a02ede6ea2f50fedfa6a22080946aab21
response_data_master_username	hmac-sha256:7c8b25e6277ab507a5c7fb4ccfca2f9afd1185209f42a79b07d78f5bf8b2024c
response_data_password	hmac-sha256:17ac5abdbc9a81642530cfadbd42701990253ac642065968f9429509e470da65
response_data_username	hmac-sha256:7c8b25e6277ab507a5c7fb4ccfca2f9afd1185209f42a79b07d78f5bf8b2024c
response_mount_type	kv
stream	stdout
time	2022-01-12T10:14:05.712830546Z
type	response

Json objects#

{
  "time": "2022-01-12T10:14:05.712830546Z",
  "type": "response",
  "auth": {
    "client_token": "hmac-sha256:d3c642a83016803522483398a2991e1721497a9ff0ab434bf807a587db0d62db",
    "accessor": "hmac-sha256:8f68cb90fbae235419d10650bb4d5119f53b28fb701426b7eff804eeb5b2b4d6",
    "display_name": "kubernetes-dashboard-default",
    "policies": [
      "cscd-use-applications-secrets",
      "cscd-use-oidc-secrets",
      "default"
    ],
    "token_policies": [
      "cscd-use-applications-secrets",
      "cscd-use-oidc-secrets",
      "default"
    ],
    "metadata": {
      "role": "dashboard",
      "service_account_name": "default",
      "service_account_namespace": "dashboard",
      "service_account_secret_name": "default-token-dc54x",
      "service_account_uid": "22fb05cf-1024-4c28-a683-45a8b31d4f90"
    },
    "entity_id": "86bf1212-6aca-25e2-7d15-049bc92d1d5d",
    "token_type": "service",
    "token_ttl": 3600,
    "token_issue_time": "2022-01-12T10:14:05Z"
  },
  "request": {
    "id": "64949643-0449-eb90-b557-9953c7efa81a",
    "operation": "read",
    "mount_type": "kv",
    "client_token": "hmac-sha256:d3c642a83016803522483398a2991e1721497a9ff0ab434bf807a587db0d62db",
    "client_token_accessor": "hmac-sha256:8f68cb90fbae235419d10650bb4d5119f53b28fb701426b7eff804eeb5b2b4d6",
    "namespace": {
      "id": "root"
    },
    "path": "secret/applications/concourse/users/admin",
    "remote_address": "172.16.0.218"
  },
  "response": {
    "mount_type": "kv",
    "secret": {},
    "data": {
      "master_password": "hmac-sha256:f116a613a3a19454db9ccfe375fb857a02ede6ea2f50fedfa6a22080946aab21",
      "master_username": "hmac-sha256:7c8b25e6277ab507a5c7fb4ccfca2f9afd1185209f42a79b07d78f5bf8b2024c",
      "password": "hmac-sha256:17ac5abdbc9a81642530cfadbd42701990253ac642065968f9429509e470da65",
      "username": "hmac-sha256:7c8b25e6277ab507a5c7fb4ccfca2f9afd1185209f42a79b07d78f5bf8b2024c"
    }
  }
}

Example of request for `auth_display_name = "kubernetes-keycloak-keycloak-backup"`#

{app="vault"} | json | json auth_policies="auth.policies", auth_token_policies="auth.token_policies" | __error__!="JSONParserErr" | auth_display_name = "kubernetes-keycloak-keycloak-backup"

Logs labels#

Field	Value
app	vault
auth_accessor	hmac-sha256:a65fa8b76692b19e9d03c5a80621d83898cd3b91fcb1f7143abb1a83988659f0
auth_client_token	hmac-sha256:cdee0623f74ccc1c77857c55700abe915383c14f2bcd13bf859ba0200236bd6d
auth_display_name	kubernetes-keycloak-keycloak-backup
auth_entity_id	885622f2-be8e-9e81-575e-4d70d6734bdb
auth_metadata_role	keycloak-backup
auth_metadata_service_account_name	keycloak-backup
auth_metadata_service_account_namespace	keycloak
auth_metadata_service_account_secret_name	keycloak-backup-token-6bv7p
auth_metadata_service_account_uid	e0a8f80f-b44a-4e5b-8126-b25bc4296988
auth_token_issue_time	2022-01-12T23:00:14Z
auth_token_ttl	3600
auth_token_type	service
container	vault
filename	/var/log/pods/vault_vault-cloud-ha-0_302f0c64-9080-4766-a786-c8801e023eee/vault/0.log
hostname	10.0.43.162
job	vault/vault
namespace	vault
node_name	10.0.43.162
pod	vault-cloud-ha-0
request_client_token	hmac-sha256:cdee0623f74ccc1c77857c55700abe915383c14f2bcd13bf859ba0200236bd6d
request_client_token_accessor	hmac-sha256:a65fa8b76692b19e9d03c5a80621d83898cd3b91fcb1f7143abb1a83988659f0
request_id	f140b88a-a16a-470c-533d-23ae21bdaef4
request_mount_type	kv
request_namespace_id	root
request_operation	read
request_path	secret/bucket/keycloak-backup
request_remote_address	172.16.0.49
response_data_access_key	hmac-sha256:54fdb4b26f6acadc765f0b61635aca48a81d270d17354a0c972aea0d5bcebc6c
response_data_bucket_domain_name	hmac-sha256:6795535fb84ca307d59af727ed7e04a8c6e9a8a6ab0026d0b1053b8ae4b5c6ba
response_data_bucket_name	hmac-sha256:f27bfeec5f108b35d258316b4c6ae0d916fd74cf8b53c5076bd3790912aaf0c4
response_data_endpoint_url	hmac-sha256:33a9b0610020eaab43db2004032941ed62db2f1aa21ec38ba2cd20225e3d5e14
response_data_secret_key	hmac-sha256:10edcf3584f4f723d9109834bbfb1514b5e711ccf31c3412bd122d9ad675824e
response_mount_type	kv
stream	stdout
time	2022-01-12T23:00:14.809558862Z
type	response

Json objects#

{
  "time": "2022-01-12T23:00:14.809558862Z",
  "type": "response",
  "auth": {
    "client_token": "hmac-sha256:cdee0623f74ccc1c77857c55700abe915383c14f2bcd13bf859ba0200236bd6d",
    "accessor": "hmac-sha256:a65fa8b76692b19e9d03c5a80621d83898cd3b91fcb1f7143abb1a83988659f0",
    "display_name": "kubernetes-keycloak-keycloak-backup",
    "policies": [
      "cscd-use-keycloak-backup-bucket",
      "cscd-use-keycloak-backup-key",
      "default"
    ],
    "token_policies": [
      "cscd-use-keycloak-backup-bucket",
      "cscd-use-keycloak-backup-key",
      "default"
    ],
    "metadata": {
      "role": "keycloak-backup",
      "service_account_name": "keycloak-backup",
      "service_account_namespace": "keycloak",
      "service_account_secret_name": "keycloak-backup-token-6bv7p",
      "service_account_uid": "e0a8f80f-b44a-4e5b-8126-b25bc4296988"
    },
    "entity_id": "885622f2-be8e-9e81-575e-4d70d6734bdb",
    "token_type": "service",
    "token_ttl": 3600,
    "token_issue_time": "2022-01-12T23:00:14Z"
  },
  "request": {
    "id": "f140b88a-a16a-470c-533d-23ae21bdaef4",
    "operation": "read",
    "mount_type": "kv",
    "client_token": "hmac-sha256:cdee0623f74ccc1c77857c55700abe915383c14f2bcd13bf859ba0200236bd6d",
    "client_token_accessor": "hmac-sha256:a65fa8b76692b19e9d03c5a80621d83898cd3b91fcb1f7143abb1a83988659f0",
    "namespace": {
      "id": "root"
    },
    "path": "secret/bucket/keycloak-backup",
    "remote_address": "172.16.0.49"
  },
  "response": {
    "mount_type": "kv",
    "secret": {},
    "data": {
      "access_key": "hmac-sha256:54fdb4b26f6acadc765f0b61635aca48a81d270d17354a0c972aea0d5bcebc6c",
      "bucket_domain_name": "hmac-sha256:6795535fb84ca307d59af727ed7e04a8c6e9a8a6ab0026d0b1053b8ae4b5c6ba",
      "bucket_name": "hmac-sha256:f27bfeec5f108b35d258316b4c6ae0d916fd74cf8b53c5076bd3790912aaf0c4",
      "endpoint_url": "hmac-sha256:33a9b0610020eaab43db2004032941ed62db2f1aa21ec38ba2cd20225e3d5e14",
      "secret_key": "hmac-sha256:10edcf3584f4f723d9109834bbfb1514b5e711ccf31c3412bd122d9ad675824e"
    }
  }
}

Example of request for `auth_display_name = "kubernetes-vault-vault-cloud-ha"`#

{app="vault"} | json | json auth_policies="auth.policies", auth_token_policies="auth.token_policies" | __error__!="JSONParserErr" | auth_display_name = "kubernetes-vault-vault-cloud-ha"

Logs labels#

Field	Value
app	vault
auth_accessor	hmac-sha256:2495ba394e913e822fffc3a5ddac8f84f4cc9cb565be9e2d3c9af09f377b95f8
auth_client_token	hmac-sha256:a9b5f7bd93312ae93fb77920d7e376a120fa6a9f25d429c27a729b7729d60041
auth_display_name	kubernetes-vault-vault-cloud-ha
auth_entity_id	cfa695e9-da1b-722c-af0d-3815fd3b0c22
auth_metadata_role	vault
auth_metadata_service_account_name	vault-cloud-ha
auth_metadata_service_account_namespace	vault
auth_metadata_service_account_secret_name	vault-cloud-ha-token-m4mhv
auth_metadata_service_account_uid	bc5f0641-cbd1-43a8-b429-f56cc0e66151
auth_token_issue_time	2022-01-13T00:01:43Z
auth_token_ttl	3600
auth_token_type	service
container	vault
filename	/var/log/pods/vault_vault-cloud-ha-0_302f0c64-9080-4766-a786-c8801e023eee/vault/0.log
hostname	10.0.43.162
job	vault/vault
namespace	vault
node_name	10.0.43.162
pod	vault-cloud-ha-0
request_client_token	hmac-sha256:a9b5f7bd93312ae93fb77920d7e376a120fa6a9f25d429c27a729b7729d60041
request_client_token_accessor	hmac-sha256:2495ba394e913e822fffc3a5ddac8f84f4cc9cb565be9e2d3c9af09f377b95f8
request_id	1176798f-bb16-4268-5136-9127359642a3
request_mount_type	system
request_namespace_id	root
request_operation	read
request_path	sys/storage/raft/snapshot
request_remote_address	127.0.0.1
response_mount_type	system
stream	stdout
time	2022-01-13T00:01:43.36515606Z
type	response

Json objects#

{
  "time": "2022-01-13T00:01:43.36515606Z",
  "type": "response",
  "auth": {
    "client_token": "hmac-sha256:a9b5f7bd93312ae93fb77920d7e376a120fa6a9f25d429c27a729b7729d60041",
    "accessor": "hmac-sha256:2495ba394e913e822fffc3a5ddac8f84f4cc9cb565be9e2d3c9af09f377b95f8",
    "display_name": "kubernetes-vault-vault-cloud-ha",
    "policies": [
      "cscd-manage-raft-snapshots",
      "default"
    ],
    "token_policies": [
      "cscd-manage-raft-snapshots",
      "default"
    ],
    "metadata": {
      "role": "vault",
      "service_account_name": "vault-cloud-ha",
      "service_account_namespace": "vault",
      "service_account_secret_name": "vault-cloud-ha-token-m4mhv",
      "service_account_uid": "bc5f0641-cbd1-43a8-b429-f56cc0e66151"
    },
    "entity_id": "cfa695e9-da1b-722c-af0d-3815fd3b0c22",
    "token_type": "service",
    "token_ttl": 3600,
    "token_issue_time": "2022-01-13T00:01:43Z"
  },
  "request": {
    "id": "1176798f-bb16-4268-5136-9127359642a3",
    "operation": "read",
    "mount_type": "system",
    "client_token": "hmac-sha256:a9b5f7bd93312ae93fb77920d7e376a120fa6a9f25d429c27a729b7729d60041",
    "client_token_accessor": "hmac-sha256:2495ba394e913e822fffc3a5ddac8f84f4cc9cb565be9e2d3c9af09f377b95f8",
    "namespace": {
      "id": "root"
    },
    "path": "sys/storage/raft/snapshot",
    "remote_address": "127.0.0.1"
  },
  "response": {
    "mount_type": "system"
  }
}

Example of request for `auth_display_name = "token-terraform"`#

{app="vault"} | json | json auth_policies="auth.policies", auth_token_policies="auth.token_policies" | __error__!="JSONParserErr" | auth_display_name = "token-terraform"

Logs labels#

Field	Value
app	vault
auth_accessor	hmac-sha256:93a73567102fe2c1c67b27364f363fb63233bd9a68cccd31294736e6404e003f
auth_client_token	hmac-sha256:2707d0d02391073c1062aae2f6683a2840b01c0250f55f78747e798247b44660
auth_display_name	token-terraform
auth_entity_id	14d88b81-4e81-f10d-2547-e4da78cbe051
auth_token_issue_time	2022-01-12T23:44:10Z
auth_token_ttl	1200
auth_token_type	service
container	vault
filename	/var/log/pods/vault_vault-cloud-ha-0_302f0c64-9080-4766-a786-c8801e023eee/vault/0.log
hostname	10.0.43.162
job	vault/vault
namespace	vault
node_name	10.0.43.162
pod	vault-cloud-ha-0
request_client_token	hmac-sha256:2707d0d02391073c1062aae2f6683a2840b01c0250f55f78747e798247b44660
request_client_token_accessor	hmac-sha256:93a73567102fe2c1c67b27364f363fb63233bd9a68cccd31294736e6404e003f
request_id	23bea25e-1c6f-c50e-f0ed-cfb0019ca8ab
request_mount_type	kv
request_namespace_id	root
request_operation	read
request_path	secret/applications/concourse/users/admin
request_remote_address	172.16.0.218
response_data_master_password	hmac-sha256:f116a613a3a19454db9ccfe375fb857a02ede6ea2f50fedfa6a22080946aab21
response_data_master_username	hmac-sha256:7c8b25e6277ab507a5c7fb4ccfca2f9afd1185209f42a79b07d78f5bf8b2024c
response_data_password	hmac-sha256:17ac5abdbc9a81642530cfadbd42701990253ac642065968f9429509e470da65
response_data_username	hmac-sha256:7c8b25e6277ab507a5c7fb4ccfca2f9afd1185209f42a79b07d78f5bf8b2024c
response_mount_type	kv
stream	stdout
time	2022-01-12T23:44:10.317152486Z
type	response

Json objects#

{
  "time": "2022-01-12T23:44:10.317152486Z",
  "type": "response",
  "auth": {
    "client_token": "hmac-sha256:2707d0d02391073c1062aae2f6683a2840b01c0250f55f78747e798247b44660",
    "accessor": "hmac-sha256:93a73567102fe2c1c67b27364f363fb63233bd9a68cccd31294736e6404e003f",
    "display_name": "token-terraform",
    "policies": [
      "cscd-create-orphan-tokens",
      "cscd-default",
      "cscd-manage-applications-secrets",
      "cscd-manage-auth",
      "cscd-manage-azure",
      "cscd-manage-bucket-secrets",
      "cscd-manage-concourse-client-secrets",
      "cscd-manage-concourse-infra-secrets",
      "cscd-manage-engines",
      "cscd-manage-oidc-secrets",
      "cscd-manage-policies",
      "cscd-manage-raft-backend",
      "cscd-manage-sts",
      "cscd-manage-transit",
      "cscd-manage-vault-audit",
      "cscd-manage-zones-secrets",
      "cscd-use-sts",
      "default"
    ],
    "token_policies": [
      "cscd-create-orphan-tokens",
      "cscd-default",
      "cscd-manage-applications-secrets",
      "cscd-manage-auth",
      "cscd-manage-azure",
      "cscd-manage-bucket-secrets",
      "cscd-manage-concourse-client-secrets",
      "cscd-manage-concourse-infra-secrets",
      "cscd-manage-engines",
      "cscd-manage-oidc-secrets",
      "cscd-manage-policies",
      "cscd-manage-raft-backend",
      "cscd-manage-sts",
      "cscd-manage-transit",
      "cscd-manage-vault-audit",
      "cscd-manage-zones-secrets",
      "cscd-use-sts",
      "default"
    ],
    "entity_id": "14d88b81-4e81-f10d-2547-e4da78cbe051",
    "token_type": "service",
    "token_ttl": 1200,
    "token_issue_time": "2022-01-12T23:44:10Z"
  },
  "request": {
    "id": "23bea25e-1c6f-c50e-f0ed-cfb0019ca8ab",
    "operation": "read",
    "mount_type": "kv",
    "client_token": "hmac-sha256:2707d0d02391073c1062aae2f6683a2840b01c0250f55f78747e798247b44660",
    "client_token_accessor": "hmac-sha256:93a73567102fe2c1c67b27364f363fb63233bd9a68cccd31294736e6404e003f",
    "namespace": {
      "id": "root"
    },
    "path": "secret/applications/concourse/users/admin",
    "remote_address": "172.16.0.218"
  },
  "response": {
    "mount_type": "kv",
    "secret": {},
    "data": {
      "master_password": "hmac-sha256:f116a613a3a19454db9ccfe375fb857a02ede6ea2f50fedfa6a22080946aab21",
      "master_username": "hmac-sha256:7c8b25e6277ab507a5c7fb4ccfca2f9afd1185209f42a79b07d78f5bf8b2024c",
      "password": "hmac-sha256:17ac5abdbc9a81642530cfadbd42701990253ac642065968f9429509e470da65",
      "username": "hmac-sha256:7c8b25e6277ab507a5c7fb4ccfca2f9afd1185209f42a79b07d78f5bf8b2024c"
    }
  }
}

Example of request for `auth_metadata_role=caascad`#

{app="vault"} | json | json auth_policies="auth.policies", auth_token_policies="auth.token_policies" | __error__!="JSONParserErr" | auth_metadata_role = "caascad"

Log labels#

Field	Value
app	vault
auth_accessor	hmac-sha256:466273c05a9fed9203d51ff4c7250f1d4a08f1ce2a5a90b6b8478d612220f2fa
auth_client_token	hmac-sha256:e73045ed7bf95edba07cb29c7d2a630d5fc22cea8b047a92a444486865aa4aa6
auth_display_name	oidc-jerome.masson.ext@orange.com
auth_entity_id	ca9b8a68-70c9-9649-176c-973925f2bfe5
auth_metadata_role	caascad
auth_token_issue_time	2022-01-10T10:23:26Z
auth_token_ttl	604800
auth_token_type	service
container	vault
filename	/var/log/pods/vault_vault-cloud-ha-0_302f0c64-9080-4766-a786-c8801e023eee/vault/0.log
hostname	10.0.43.162
job	vault/vault
namespace	vault
node_name	10.0.43.162
pod	vault-cloud-ha-0
request_client_token	hmac-sha256:e73045ed7bf95edba07cb29c7d2a630d5fc22cea8b047a92a444486865aa4aa6
request_client_token_accessor	hmac-sha256:466273c05a9fed9203d51ff4c7250f1d4a08f1ce2a5a90b6b8478d612220f2fa
request_id	ff5e0646-efb3-ca66-f753-84f292ce792b
request_mount_type	system
request_namespace_id	root
request_operation	read
request_path	sys/auth
request_remote_address	172.16.0.96
response_data_approle__accessor	hmac-sha256:1b1987873ab4791201b0fd645231d392660af11e33a8f537367ad3ac427d9328
response_data_approle__config_default_lease_ttl	0
response_data_approle__config_force_no_cache	false
response_data_approle__config_max_lease_ttl	0
response_data_approle__config_token_type	hmac-sha256:457a0cfce02638d427d9900c7e5448910ed6deeb2f9d388081f13ed4c0fc2e28
response_data_approle__description	hmac-sha256:28356e0d6d1e26b6d8aab78350e63c6bf458a833e14229d4b2c2a16a0bc2018f
response_data_approle__external_entropy_access	false
response_data_approle__local	false
response_data_approle__seal_wrap	false
response_data_approle__type	hmac-sha256:5b66401fcdc32abb157bd33a73722cdc77f01f25dc8cdd49d1b9e1496c326865
response_data_approle__uuid	hmac-sha256:1c38943bf6383430c88c9580e16197d15f0e1f426dd52bb4a96e1dbeffe8f13f
response_data_kubernetes__accessor	hmac-sha256:91b92f96cd935e128f192155a639f85e420d3484c3cc7729479877ca8e8b13d0
response_data_kubernetes__config_default_lease_ttl	0
response_data_kubernetes__config_force_no_cache	false
response_data_kubernetes__config_max_lease_ttl	0
response_data_kubernetes__config_token_type	hmac-sha256:457a0cfce02638d427d9900c7e5448910ed6deeb2f9d388081f13ed4c0fc2e28
response_data_kubernetes__description	hmac-sha256:28356e0d6d1e26b6d8aab78350e63c6bf458a833e14229d4b2c2a16a0bc2018f
response_data_kubernetes__external_entropy_access	false
response_data_kubernetes__local	false
response_data_kubernetes__seal_wrap	false
response_data_kubernetes__type	hmac-sha256:15e48b1a37df7dc00ab38e9873c9fa5c6b466d037b1a564187f0bb1a4a4fd333
response_data_kubernetes__uuid	hmac-sha256:0dbb93434588e2b02fdcbc7004d13b91bff4d5a67d56d5a7b5caac82d5535e16
response_data_kubernetes_delta__accessor	hmac-sha256:c6b228c17b326dec1305d5c7f89431afa11b1490d26982bee4e926ec68696942
response_data_kubernetes_delta__config_default_lease_ttl	0
response_data_kubernetes_delta__config_force_no_cache	false
response_data_kubernetes_delta__config_max_lease_ttl	0
response_data_kubernetes_delta__config_token_type	hmac-sha256:457a0cfce02638d427d9900c7e5448910ed6deeb2f9d388081f13ed4c0fc2e28
response_data_kubernetes_delta__description	hmac-sha256:28356e0d6d1e26b6d8aab78350e63c6bf458a833e14229d4b2c2a16a0bc2018f
response_data_kubernetes_delta__external_entropy_access	false
response_data_kubernetes_delta__local	false
response_data_kubernetes_delta__seal_wrap	false
response_data_kubernetes_delta__type	hmac-sha256:15e48b1a37df7dc00ab38e9873c9fa5c6b466d037b1a564187f0bb1a4a4fd333
response_data_kubernetes_delta__uuid	hmac-sha256:28215ac7d900af8a0244165b357dfbab254065fb5a574c07804566ff928bc08d
response_data_kubernetes_echo__accessor	hmac-sha256:3d139245d9e82aad798c1e58285102b8caa57fba0033175d6f55254c88522e31
response_data_kubernetes_echo__config_default_lease_ttl	0
response_data_kubernetes_echo__config_force_no_cache	false
response_data_kubernetes_echo__config_max_lease_ttl	0
response_data_kubernetes_echo__config_token_type	hmac-sha256:457a0cfce02638d427d9900c7e5448910ed6deeb2f9d388081f13ed4c0fc2e28
response_data_kubernetes_echo__description	hmac-sha256:28356e0d6d1e26b6d8aab78350e63c6bf458a833e14229d4b2c2a16a0bc2018f
response_data_kubernetes_echo__external_entropy_access	false
response_data_kubernetes_echo__local	false
response_data_kubernetes_echo__seal_wrap	false
response_data_kubernetes_echo__type	hmac-sha256:15e48b1a37df7dc00ab38e9873c9fa5c6b466d037b1a564187f0bb1a4a4fd333
response_data_kubernetes_echo__uuid	hmac-sha256:fab08a986e548b7e9e1394a570dc2cbaf5a3b056fadb5856f6b743ee9c9cfa17
response_data_kubernetes_jul__accessor	hmac-sha256:f928012a9b798bcce143f239ea9abbb4af910d9220cd1475d3044d96cf7e9407
response_data_kubernetes_jul__config_default_lease_ttl	0
response_data_kubernetes_jul__config_force_no_cache	false
response_data_kubernetes_jul__config_max_lease_ttl	0
response_data_kubernetes_jul__config_token_type	hmac-sha256:457a0cfce02638d427d9900c7e5448910ed6deeb2f9d388081f13ed4c0fc2e28
response_data_kubernetes_jul__description	hmac-sha256:28356e0d6d1e26b6d8aab78350e63c6bf458a833e14229d4b2c2a16a0bc2018f
response_data_kubernetes_jul__external_entropy_access	false
response_data_kubernetes_jul__local	false
response_data_kubernetes_jul__seal_wrap	false
response_data_kubernetes_jul__type	hmac-sha256:15e48b1a37df7dc00ab38e9873c9fa5c6b466d037b1a564187f0bb1a4a4fd333
response_data_kubernetes_jul__uuid	hmac-sha256:70823dc91cc11baa7dce734be2e54fc6a9d37160629621290dc73dad5fb23218
response_data_oidc__accessor	hmac-sha256:75981cca2c84a08b52b0e2938be8108c4fd7206b7d50b218e52935c3db2f4d42
response_data_oidc__config_default_lease_ttl	604800
response_data_oidc__config_force_no_cache	false
response_data_oidc__config_max_lease_ttl	604800
response_data_oidc__config_token_type	hmac-sha256:457a0cfce02638d427d9900c7e5448910ed6deeb2f9d388081f13ed4c0fc2e28
response_data_oidc__description	hmac-sha256:5d6da13414628dc0c847f2b2245e1eec6926dfc2c600c2d9069e58ee5ae27355
response_data_oidc__external_entropy_access	false
response_data_oidc__local	false
response_data_oidc__seal_wrap	false
response_data_oidc__type	hmac-sha256:a7838a92d9c8bd145766a9871526ccefc51d70445fb412dbbb7916aa3f4dd395
response_data_oidc__uuid	hmac-sha256:271edce6bd719d43d6723f8a747b96fbe46620989aa164d2b5de76af22420f61
response_data_token__accessor	hmac-sha256:92c2577c058eb4f203df204133573494150c58afeac27dfedc29a61202cede67
response_data_token__config_default_lease_ttl	0
response_data_token__config_force_no_cache	false
response_data_token__config_max_lease_ttl	0
response_data_token__config_token_type	hmac-sha256:457a0cfce02638d427d9900c7e5448910ed6deeb2f9d388081f13ed4c0fc2e28
response_data_token__description	hmac-sha256:c51aab021328cc9d0ed93d6ac9a591928d8533bb66cd6b4338278d4429ec8e96
response_data_token__external_entropy_access	false
response_data_token__local	false
response_data_token__seal_wrap	false
response_data_token__type	hmac-sha256:539dd1d23f01624b24ba32070754fadc69cedd10edbca6b48479699ef4835316
response_data_token__uuid	hmac-sha256:e7cc08f8d4a94fff5a07013cb6942e37faced7a85607a133bcabac2f3407ff00
response_mount_type	system
stream	stdout
time	2022-01-11T09:39:17.422849905Z
type	response

Json Object#

{
  "time": "2022-01-11T09:33:12.465918059Z",
  "type": "response",
  "auth": {
    "client_token": "hmac-sha256:e73045ed7bf95edba07cb29c7d2a630d5fc22cea8b047a92a444486865aa4aa6",
    "accessor": "hmac-sha256:466273c05a9fed9203d51ff4c7250f1d4a08f1ce2a5a90b6b8478d612220f2fa",
    "display_name": "oidc-jerome.masson.ext@orange.com",
    "policies": [
      "default",
      "cscd-create-orphan-tokens",
      "cscd-default",
      "cscd-manage-applications-secrets",
      "cscd-manage-auth",
      "cscd-manage-azure",
      "cscd-manage-bucket-secrets",
      "cscd-manage-concourse-client-secrets",
      "cscd-manage-concourse-infra-secrets",
      "cscd-manage-engines",
      "cscd-manage-oidc-secrets",
      "cscd-manage-policies",
      "cscd-manage-raft-backend",
      "cscd-manage-raft-snapshots",
      "cscd-manage-sts",
      "cscd-manage-transit",
      "cscd-manage-vault-audit",
      "cscd-manage-zones-secrets",
      "cscd-read-vault-audit",
      "cscd-use-auth",
      "cscd-use-azure",
      "cscd-use-engines",
      "cscd-use-policies",
      "cscd-use-raft-backend",
      "cscd-use-sts",
      "cscd-use-transit"
    ],
    "token_policies": [
      "default"
    ],
    "identity_policies": [
      "cscd-create-orphan-tokens",
      "cscd-default",
      "cscd-manage-applications-secrets",
      "cscd-manage-auth",
      "cscd-manage-azure",
      "cscd-manage-bucket-secrets",
      "cscd-manage-concourse-client-secrets",
      "cscd-manage-concourse-infra-secrets",
      "cscd-manage-engines",
      "cscd-manage-oidc-secrets",
      "cscd-manage-policies",
      "cscd-manage-raft-backend",
      "cscd-manage-raft-snapshots",
      "cscd-manage-sts",
      "cscd-manage-transit",
      "cscd-manage-vault-audit",
      "cscd-manage-zones-secrets",
      "cscd-read-vault-audit",
      "cscd-use-auth",
      "cscd-use-azure",
      "cscd-use-engines",
      "cscd-use-policies",
      "cscd-use-raft-backend",
      "cscd-use-sts",
      "cscd-use-transit"
    ],
    "metadata": {
      "role": "caascad"
    },
    "entity_id": "ca9b8a68-70c9-9649-176c-973925f2bfe5",
    "token_type": "service",
    "token_ttl": 604800,
    "token_issue_time": "2022-01-10T10:23:26Z"
  },
  "request": {
    "id": "39559804-8df7-5b75-dd85-b464c1ad4524",
    "operation": "read",
    "mount_type": "system",
    "client_token": "hmac-sha256:e73045ed7bf95edba07cb29c7d2a630d5fc22cea8b047a92a444486865aa4aa6",
    "client_token_accessor": "hmac-sha256:466273c05a9fed9203d51ff4c7250f1d4a08f1ce2a5a90b6b8478d612220f2fa",
    "namespace": {
      "id": "root"
    },
    "path": "sys/auth",
    "remote_address": "172.16.0.96"
  },
  "response": {
    "mount_type": "system",
    "data": {
      "approle/": {
        "accessor": "hmac-sha256:1b1987873ab4791201b0fd645231d392660af11e33a8f537367ad3ac427d9328",
        "config": {
          "default_lease_ttl": 0,
          "force_no_cache": false,
          "max_lease_ttl": 0,
          "token_type": "hmac-sha256:457a0cfce02638d427d9900c7e5448910ed6deeb2f9d388081f13ed4c0fc2e28"
        },
        "description": "hmac-sha256:28356e0d6d1e26b6d8aab78350e63c6bf458a833e14229d4b2c2a16a0bc2018f",
        "external_entropy_access": false,
        "local": false,
        "options": null,
        "seal_wrap": false,
        "type": "hmac-sha256:5b66401fcdc32abb157bd33a73722cdc77f01f25dc8cdd49d1b9e1496c326865",
        "uuid": "hmac-sha256:1c38943bf6383430c88c9580e16197d15f0e1f426dd52bb4a96e1dbeffe8f13f"
      },
      "kubernetes-delta/": {
        "accessor": "hmac-sha256:c6b228c17b326dec1305d5c7f89431afa11b1490d26982bee4e926ec68696942",
        "config": {
          "default_lease_ttl": 0,
          "force_no_cache": false,
          "max_lease_ttl": 0,
          "token_type": "hmac-sha256:457a0cfce02638d427d9900c7e5448910ed6deeb2f9d388081f13ed4c0fc2e28"
        },
        "description": "hmac-sha256:28356e0d6d1e26b6d8aab78350e63c6bf458a833e14229d4b2c2a16a0bc2018f",
        "external_entropy_access": false,
        "local": false,
        "options": null,
        "seal_wrap": false,
        "type": "hmac-sha256:15e48b1a37df7dc00ab38e9873c9fa5c6b466d037b1a564187f0bb1a4a4fd333",
        "uuid": "hmac-sha256:28215ac7d900af8a0244165b357dfbab254065fb5a574c07804566ff928bc08d"
      },
      "kubernetes-echo/": {
        "accessor": "hmac-sha256:3d139245d9e82aad798c1e58285102b8caa57fba0033175d6f55254c88522e31",
        "config": {
          "default_lease_ttl": 0,
          "force_no_cache": false,
          "max_lease_ttl": 0,
          "token_type": "hmac-sha256:457a0cfce02638d427d9900c7e5448910ed6deeb2f9d388081f13ed4c0fc2e28"
        },
        "description": "hmac-sha256:28356e0d6d1e26b6d8aab78350e63c6bf458a833e14229d4b2c2a16a0bc2018f",
        "external_entropy_access": false,
        "local": false,
        "options": null,
        "seal_wrap": false,
        "type": "hmac-sha256:15e48b1a37df7dc00ab38e9873c9fa5c6b466d037b1a564187f0bb1a4a4fd333",
        "uuid": "hmac-sha256:fab08a986e548b7e9e1394a570dc2cbaf5a3b056fadb5856f6b743ee9c9cfa17"
      },
      "kubernetes-jul/": {
        "accessor": "hmac-sha256:f928012a9b798bcce143f239ea9abbb4af910d9220cd1475d3044d96cf7e9407",
        "config": {
          "default_lease_ttl": 0,
          "force_no_cache": false,
          "max_lease_ttl": 0,
          "token_type": "hmac-sha256:457a0cfce02638d427d9900c7e5448910ed6deeb2f9d388081f13ed4c0fc2e28"
        },
        "description": "hmac-sha256:28356e0d6d1e26b6d8aab78350e63c6bf458a833e14229d4b2c2a16a0bc2018f",
        "external_entropy_access": false,
        "local": false,
        "options": null,
        "seal_wrap": false,
        "type": "hmac-sha256:15e48b1a37df7dc00ab38e9873c9fa5c6b466d037b1a564187f0bb1a4a4fd333",
        "uuid": "hmac-sha256:70823dc91cc11baa7dce734be2e54fc6a9d37160629621290dc73dad5fb23218"
      },
      "kubernetes/": {
        "accessor": "hmac-sha256:91b92f96cd935e128f192155a639f85e420d3484c3cc7729479877ca8e8b13d0",
        "config": {
          "default_lease_ttl": 0,
          "force_no_cache": false,
          "max_lease_ttl": 0,
          "token_type": "hmac-sha256:457a0cfce02638d427d9900c7e5448910ed6deeb2f9d388081f13ed4c0fc2e28"
        },
        "description": "hmac-sha256:28356e0d6d1e26b6d8aab78350e63c6bf458a833e14229d4b2c2a16a0bc2018f",
        "external_entropy_access": false,
        "local": false,
        "options": null,
        "seal_wrap": false,
        "type": "hmac-sha256:15e48b1a37df7dc00ab38e9873c9fa5c6b466d037b1a564187f0bb1a4a4fd333",
        "uuid": "hmac-sha256:0dbb93434588e2b02fdcbc7004d13b91bff4d5a67d56d5a7b5caac82d5535e16"
      },
      "oidc/": {
        "accessor": "hmac-sha256:75981cca2c84a08b52b0e2938be8108c4fd7206b7d50b218e52935c3db2f4d42",
        "config": {
          "allowed_response_headers": [
            "hmac-sha256:28356e0d6d1e26b6d8aab78350e63c6bf458a833e14229d4b2c2a16a0bc2018f"
          ],
          "audit_non_hmac_request_keys": [
            "hmac-sha256:28356e0d6d1e26b6d8aab78350e63c6bf458a833e14229d4b2c2a16a0bc2018f"
          ],
          "audit_non_hmac_response_keys": [
            "hmac-sha256:28356e0d6d1e26b6d8aab78350e63c6bf458a833e14229d4b2c2a16a0bc2018f"
          ],
          "default_lease_ttl": 604800,
          "force_no_cache": false,
          "max_lease_ttl": 604800,
          "passthrough_request_headers": [
            "hmac-sha256:28356e0d6d1e26b6d8aab78350e63c6bf458a833e14229d4b2c2a16a0bc2018f"
          ],
          "token_type": "hmac-sha256:457a0cfce02638d427d9900c7e5448910ed6deeb2f9d388081f13ed4c0fc2e28"
        },
        "description": "hmac-sha256:5d6da13414628dc0c847f2b2245e1eec6926dfc2c600c2d9069e58ee5ae27355",
        "external_entropy_access": false,
        "local": false,
        "options": null,
        "seal_wrap": false,
        "type": "hmac-sha256:a7838a92d9c8bd145766a9871526ccefc51d70445fb412dbbb7916aa3f4dd395",
        "uuid": "hmac-sha256:271edce6bd719d43d6723f8a747b96fbe46620989aa164d2b5de76af22420f61"
      },
      "token/": {
        "accessor": "hmac-sha256:92c2577c058eb4f203df204133573494150c58afeac27dfedc29a61202cede67",
        "config": {
          "default_lease_ttl": 0,
          "force_no_cache": false,
          "max_lease_ttl": 0,
          "token_type": "hmac-sha256:457a0cfce02638d427d9900c7e5448910ed6deeb2f9d388081f13ed4c0fc2e28"
        },
        "description": "hmac-sha256:c51aab021328cc9d0ed93d6ac9a591928d8533bb66cd6b4338278d4429ec8e96",
        "external_entropy_access": false,
        "local": false,
        "options": null,
        "seal_wrap": false,
        "type": "hmac-sha256:539dd1d23f01624b24ba32070754fadc69cedd10edbca6b48479699ef4835316",
        "uuid": "hmac-sha256:e7cc08f8d4a94fff5a07013cb6942e37faced7a85607a133bcabac2f3407ff00"
      }
    }
  }
}

How to activate vault audit#

Add policies to manage vault audit#

Activate the vault audit backend#

Loki queries example for vault audit logs#

List of available fields#

Examples#

Example of request for auth_display_name = "approle"#

Logs labels#

Json object#

Example of request for auth_display_name = "kubernetes-dashboard-default"#

Logs labels#

Json objects#

Example of request for auth_display_name = "kubernetes-keycloak-keycloak-backup"#

Logs labels#

Json objects#

Example of request for auth_display_name = "kubernetes-vault-vault-cloud-ha"#

Logs labels#

Json objects#

Example of request for auth_display_name = "token-terraform"#

Logs labels#

Json objects#

Example of request for auth_metadata_role=caascad#

Log labels#

Json Object#

Example of request for `auth_display_name = "approle"`#

Example of request for `auth_display_name = "kubernetes-dashboard-default"`#

Example of request for `auth_display_name = "kubernetes-keycloak-keycloak-backup"`#

Example of request for `auth_display_name = "kubernetes-vault-vault-cloud-ha"`#

Example of request for `auth_display_name = "token-terraform"`#

Example of request for `auth_metadata_role=caascad`#