Audit log management
This page covers recurring audit-log management. Initial log and event sink setup should be completed during installation or service onboarding.
Audit
In HCP Terraform only, the Audit Trails API(opens in new tab) provides access to audit events. We recommend Terraform Enterprise customers forward logs(opens in new tab) for monitoring and auditing purposes. See the section on observability for more details. Include audit, logging, and monitoring in the target architecture for the delivery of your project. Do not wait until after go-live to implement observability.
HCP Terraform audit trail logs
HCP Terraform audit trail logs
HCP Terraform features an Audit Log API endpoint that you must use to collect the audit events and store them in the appropriate system. To implement this solution, you need the following.
- A method to schedule and automate the audit events collection,
- A secure storage solution to store the audit events, and
- A data lifecycle solution to correctly dispose of the audit events once they are no longer required.
If you use a Security Information and Event Management system (SIEM), this must be the destination for those audit events. Suppose you are not using a SIEM but instead are using a centralized log management solution (Datadog, New Relic, Elastic, and so on). In that case, you must send those audit events to your centralized log management system. If neither of these solutions is available, still collect those audit events and store them securely using an object storage solution, such as AWS S3.