cloud: add console audit log integrity and access control section - #23445
cloud: add console audit log integrity and access control section#23445xboxeer wants to merge 5 commits into
Conversation
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
ti-chi-bot
Bot
added
missing-translation-status
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughThe documentation adds requirements for console audit log completeness, availability within 60 minutes, post-enablement recording, evolving event coverage, and role-based management restrictions. ChangesConsole audit logging
Estimated code review effort: 1 (Trivial) | ~2 minutes Suggested labels: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 5c637a1a-918b-4d6c-a93e-5579f323a449
📒 Files selected for processing (1)
tidb-cloud/tidb-cloud-console-auditing.md
| > | ||
| > Console audit logging records operations that occur after it is enabled. Operations performed before enabling are not recorded. TiDB Cloud continuously expands the coverage of audited event types. | ||
|
|
||
| - **Access control**: Only users with the `Organization Owner` or `Organization Console Audit Manager` role can manage console audit logging. Other organization members cannot enable or disable audit logging, modify log settings, or delete logs. |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
State that log deletion is unavailable to all users.
Line 75 says that other organization members cannot delete logs. This can imply that Organization Owner or Organization Console Audit Manager users can delete them. Line 63 states that users cannot manually delete audit logs.
Committable replacement
- - **Access control**: Only users with the `Organization Owner` or `Organization Console Audit Manager` role can manage console audit logging. Other organization members cannot enable or disable audit logging, modify log settings, or delete logs.
+ - **Access control**: Only users with the `Organization Owner` or `Organization Console Audit Manager` role can manage console audit logging. Other organization members cannot enable or disable audit logging or modify log settings. No user can manually delete console audit logs.As per path instructions: provide an exact replacement when the fix is contiguous in the diff.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - **Access control**: Only users with the `Organization Owner` or `Organization Console Audit Manager` role can manage console audit logging. Other organization members cannot enable or disable audit logging, modify log settings, or delete logs. | |
| - **Access control**: Only users with the `Organization Owner` or `Organization Console Audit Manager` role can manage console audit logging. Other organization members cannot enable or disable audit logging or modify log settings. No user can manually delete console audit logs. |
Source: Path instructions
There was a problem hiding this comment.
Actionable comments posted: 1
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 555ee5a4-5f83-4931-b298-defd850800d9
📒 Files selected for processing (1)
tidb-cloud/tidb-cloud-console-auditing.md
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
1 participant
What is changed, added or deleted? (Required)
Add a new "Console audit log integrity and access control" section to the console audit logging documentation, describing:
This section clarifies the integrity and access control guarantees of console audit logs for customers with regulatory compliance requirements.
Which TiDB version(s) do your changes apply to? (Required)
What is the related PR or file link(s)?
AI agent involvement
Do your changes match any of the following descriptions?
Summary by CodeRabbit