mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-10-11 01:29:26 +00:00
feat: added doc for audit log stream via fluentbit
This commit is contained in:
@@ -2,6 +2,7 @@ import { ForbiddenError } from "@casl/ability";
|
|||||||
import { RawAxiosRequestHeaders } from "axios";
|
import { RawAxiosRequestHeaders } from "axios";
|
||||||
|
|
||||||
import { SecretKeyEncoding } from "@app/db/schemas";
|
import { SecretKeyEncoding } from "@app/db/schemas";
|
||||||
|
import { getConfig } from "@app/lib/config/env";
|
||||||
import { request } from "@app/lib/config/request";
|
import { request } from "@app/lib/config/request";
|
||||||
import { infisicalSymmetricDecrypt, infisicalSymmetricEncypt } from "@app/lib/crypto/encryption";
|
import { infisicalSymmetricDecrypt, infisicalSymmetricEncypt } from "@app/lib/crypto/encryption";
|
||||||
import { BadRequestError } from "@app/lib/errors";
|
import { BadRequestError } from "@app/lib/errors";
|
||||||
@@ -44,6 +45,7 @@ export const auditLogStreamServiceFactory = ({
|
|||||||
}: TCreateAuditLogStreamDTO) => {
|
}: TCreateAuditLogStreamDTO) => {
|
||||||
if (!actorOrgId) throw new BadRequestError({ message: "Missing org id from token" });
|
if (!actorOrgId) throw new BadRequestError({ message: "Missing org id from token" });
|
||||||
|
|
||||||
|
const appCfg = getConfig();
|
||||||
const plan = await licenseService.getPlan(actorOrgId);
|
const plan = await licenseService.getPlan(actorOrgId);
|
||||||
if (!plan.auditLogStreams)
|
if (!plan.auditLogStreams)
|
||||||
throw new BadRequestError({
|
throw new BadRequestError({
|
||||||
@@ -59,7 +61,9 @@ export const auditLogStreamServiceFactory = ({
|
|||||||
);
|
);
|
||||||
ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Create, OrgPermissionSubjects.Settings);
|
ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Create, OrgPermissionSubjects.Settings);
|
||||||
|
|
||||||
validateLocalIps(url);
|
if (appCfg.isCloud) {
|
||||||
|
validateLocalIps(url);
|
||||||
|
}
|
||||||
|
|
||||||
const totalStreams = await auditLogStreamDAL.find({ orgId: actorOrgId });
|
const totalStreams = await auditLogStreamDAL.find({ orgId: actorOrgId });
|
||||||
if (totalStreams.length >= plan.auditLogStreamLimit) {
|
if (totalStreams.length >= plan.auditLogStreamLimit) {
|
||||||
@@ -131,7 +135,8 @@ export const auditLogStreamServiceFactory = ({
|
|||||||
const { permission } = await permissionService.getOrgPermission(actor, actorId, orgId, actorAuthMethod, actorOrgId);
|
const { permission } = await permissionService.getOrgPermission(actor, actorId, orgId, actorAuthMethod, actorOrgId);
|
||||||
ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Edit, OrgPermissionSubjects.Settings);
|
ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Edit, OrgPermissionSubjects.Settings);
|
||||||
|
|
||||||
if (url) validateLocalIps(url);
|
const appCfg = getConfig();
|
||||||
|
if (url && appCfg.isCloud) validateLocalIps(url);
|
||||||
|
|
||||||
// testing connection first
|
// testing connection first
|
||||||
const streamHeaders: RawAxiosRequestHeaders = { "Content-Type": "application/json" };
|
const streamHeaders: RawAxiosRequestHeaders = { "Content-Type": "application/json" };
|
||||||
|
|||||||
@@ -0,0 +1,61 @@
|
|||||||
|
---
|
||||||
|
title: "Stream to Non-HTTP providers"
|
||||||
|
description: "Learn how to stream Infisical Audit Logs to other Non-HTTP providers"
|
||||||
|
---
|
||||||
|
|
||||||
|
<Info>
|
||||||
|
Audit log streams is a paid feature.
|
||||||
|
|
||||||
|
If you're using Infisical Cloud, then it is available under the **Enterprise Tier**. If you're self-hosting Infisical,
|
||||||
|
then you should contact [email protected] to purchase an enterprise license to use it.
|
||||||
|
</Info>
|
||||||
|
|
||||||
|
This guide explains how to store Infisical Audit log streams using a provider that doesn't support HTTP-based streaming, such as AWS S3. We'll use a log collector service to achieve this.
|
||||||
|
|
||||||
|
## Overview
|
||||||
|
|
||||||
|
Log collectors are tools used to collect, analyze, transform, and send logs to storage. In this guide, we'll focus on [Fluent Bit](https://fluentbit.io), a popular and efficient log collector.
|
||||||
|
|
||||||
|
You can deploy Fluent Bit in two ways:
|
||||||
|
1. As a sidecar to your self-hosted Infisical instance
|
||||||
|
2. As a standalone service in any deployment service (e.g., AWS EC2, ECS, or GCP Compute Engine)
|
||||||
|
|
||||||
|
For various deployment options, refer to the [Fluent Bit Getting Started guide](https://docs.fluentbit.io/manual/installation/getting-started-with-fluent-bit).
|
||||||
|
|
||||||
|
## Configuration
|
||||||
|
|
||||||
|
To set up Fluent Bit, you'll need to provide a configuration file that establishes an HTTP listener and configures an output to send JSON data to your chosen storage solution (e.g., S3, Elasticsearch).
|
||||||
|
|
||||||
|
### Example Configuration: HTTP to AWS S3
|
||||||
|
|
||||||
|
The following Fluent Bit configuration sets up an HTTP listener on port `8888` and sends logs to AWS S3:
|
||||||
|
|
||||||
|
```ini
|
||||||
|
[SERVICE]
|
||||||
|
Flush 1
|
||||||
|
Log_Level info
|
||||||
|
Daemon off
|
||||||
|
|
||||||
|
[INPUT]
|
||||||
|
Name http
|
||||||
|
Listen 0.0.0.0
|
||||||
|
Port 8888
|
||||||
|
|
||||||
|
[OUTPUT]
|
||||||
|
Name s3
|
||||||
|
Match *
|
||||||
|
bucket my-bucket
|
||||||
|
region us-west-2
|
||||||
|
total_file_size 50M
|
||||||
|
use_put_object Off
|
||||||
|
compression gzip
|
||||||
|
s3_key_format /$TAG/%Y/%m/%d/%H_%M_%S.gz
|
||||||
|
```
|
||||||
|
### Connecting Infisical Audit Log Stream
|
||||||
|
|
||||||
|
Once you have set up and configured Fluent Bit, you can direct the Infisical Audit log stream to the Fluent Bit HTTP listener address.
|
||||||
|
|
||||||
|
|
||||||
|
By following this guide, you can effectively store Infisical Audit log streams in AWS S3 or other storage solutions that don't natively support HTTP-based streaming.
|
||||||
|
|
||||||
|
This approach provides flexibility and allows you to leverage the power of log collectors like Fluent Bit to manage and store your audit logs efficiently.
|
||||||
@@ -1,5 +1,5 @@
|
|||||||
---
|
---
|
||||||
title: "Audit Logs"
|
title: "Overview"
|
||||||
description: "Track evert event action performed within Infisical projects."
|
description: "Track evert event action performed within Infisical projects."
|
||||||
---
|
---
|
||||||
|
|
||||||
|
|||||||
+8
-1
@@ -130,11 +130,18 @@
|
|||||||
"documentation/platform/access-controls/temporary-access",
|
"documentation/platform/access-controls/temporary-access",
|
||||||
"documentation/platform/access-controls/access-requests",
|
"documentation/platform/access-controls/access-requests",
|
||||||
"documentation/platform/pr-workflows",
|
"documentation/platform/pr-workflows",
|
||||||
"documentation/platform/audit-logs",
|
|
||||||
"documentation/platform/audit-log-streams",
|
"documentation/platform/audit-log-streams",
|
||||||
"documentation/platform/groups"
|
"documentation/platform/groups"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
|
{
|
||||||
|
"group": "Audit Logs",
|
||||||
|
"pages": [
|
||||||
|
"documentation/platform/audit-logs",
|
||||||
|
"documentation/platform/audit-log-streams/audit-log-streams",
|
||||||
|
"documentation/platform/audit-log-streams/audit-log-streams-with-fluentbit"
|
||||||
|
]
|
||||||
|
},
|
||||||
{
|
{
|
||||||
"group": "Secret Rotation",
|
"group": "Secret Rotation",
|
||||||
"pages": [
|
"pages": [
|
||||||
|
|||||||
Reference in New Issue
Block a user