Auditing
We have successfully created Secrets and made sure we received them securely by utilizing AWS IAM. Since secure access has been tackled and we have fine-grained permissions, we are interested in also logging the usage of and access to our Secrets management instance.
There are two ways to evaluate the secret access that occurs in Kubernetes:
- Kubernetes Secrets access logs
- AWS Secrets Manager logs
When auditing occurs, a log message is printed in the output of a program. This is integrated with CloudWatch, the logging solution provided by AWS, and CloudTrail, the auditing solution that AWS provides.
Kubernetes logs on CloudWatch
By using CloudWatch, we can browse the Kubernetes logs. Suppose we created a secret called audit-test. We can search for any operations on Logs Insights (https://console.aws.amazon.com/cloudwatch/home?logsV2%3Alogs-insights=#logsV2:logs-insights). We can use the following log:
fields @timestamp, @message, @logStream, ...
