Auditing and logging

In the previous section, we created the Key Vault on Azure. Azure provides us with the option to enable auditing for the resources we provision.

In our case, we add a block that enables us to store the audit logs of Key Vault access to a storage account.

Let us perform the Terraform code:

resource "azurerm_monitor_diagnostic_setting" "ksm_key_vault_logs" {
  name               = "ksm-key-vault-logs"
  target_resource_id = azurerm_key_vault.ksm_key_vault.id
  storage_account_id = azurerm_storage_account.ksm_storage_account.id
  log {
    category = "AuditEvent"
    enabled  = true
    retention_policy {
      enabled = false
    }
  }
...
}

We’ve enabled Azure to capture...