Audit Service
The objective of audit service is listed as below -
- 1.To provide a one-stop framework for signing data i.e. creating an immutable data entry to track activities of an entity. Whenever an entity is created/updated/deleted the operation is captured in the data logs and is digitally signed to protect it from tampering.
- 1.Prior Knowledge of Java/J2EE.
- 2.Prior Knowledge of SpringBoot.
- 3.Prior Knowledge of PostgresSQL.
- 4.Prior Knowledge of REST APIs and related concepts like path parameters, headers, JSON etc.
Audit service will be parsing all the persister configs so that it can process data received by the persister and create audit logs out of it.
Setup:
- 1.Step 1: Add the following metrics to the existing persister configs -
1
isAuditEnabled: true
2
module: PGR
3
objecIdJsonPath: $.id
4
tenantIdJsonPath: $.tenantId
5
transactionCodeJsonPath: $.transactionCode
6
auditAttributeBasePath: $.service
2. Step 2: If a custom implementation of
ConfigurableSignAndVerify interface is present, provide the signing algorithm implementation name as a part of audit.log.signing.algorithm property. For example, if the signing algorithm is HMAC, the property will be set as follows -1
audit.log.signing.algorithm=HMAC
3. Step 3: Set
egov.persist.yml.repo.path this property to the location of persister configs.4. Step 4: Run the audit-service application along with persister service.
Definitions:
- 1.Config file - A YAML (xyz.yml) file which contains persister configuration for running audit service.
- 2.API - A REST endpoint to post audit logs data.
Functionality:
- 1.When audit-service create API is hit, it will validate request size, keyValueMap and operationType.
- 2.Upon successful validation, it will choose the configured signer and sign entity data.
- 3.Once audit logs are signed and ready, it will send it to
audit-createtopic. - 4.Persister will listen on this topic and persist the audit logs.
- 1.Add the required keys for enabling audit service in persister configs.
- 2.Deploy the latest version of Audit service and Persister service.
- 3.Add Role-Action mapping for API’s.
The audit service is used to push signed data for tracking each and every create/modify/delete operation done on database entities.
- Can be used to have tamper proof audit logs for all database transactions.
- Replaying events in chronological order will lead to current state of entity in the database.
- 1.To integrate, host of audit-service module should be overwritten in helm chart.
- 2.
audit-service/log/v1/_createshould be added as the create endpoint for the config added. - 3.
audit-service/log/v1/_searchshould be added as the search endpoint for the config added.
1. URI: The format of the API to be used to create audit logs using audit-service is as follows:
audit-service/log/v1/_createBody: Body consists of 2 parts: RequestInfo and AuditLogs.
Sample Request Body -
1
{
2
"RequestInfo": {
3
"apiId": "asset-services",
4
"ver": null,
5
"ts": null,
6
"action": null,
7
"did": null,
8
"key": null,
9
"msgId": "search with from and to values",
10
"authToken": "83a1cfb3-6fde-4406-9ee1-622b3ecc7dab"
11
},
12
"AuditLogs": [
13
{
14
"userUUID": "11b0e02b-0145-4de2-bc42-c97b96264807",
15
"module": "PGR",
16
"tenantId": "pb.amritsar",
17
"transactionCode": "PGR.CREATE",
18
"changeDate": 1657104693726,
19
"entityName": "eg_pgr_service",
20
"objectId": "c8c901da-61e9-4cd5-89f7-7560997922b7",
21
"keyValueMap": {
22
"id": "89651651-841a-4b8c-a503-f5d4bb10f4d5",
23
"tenantId": "pb.amritsar",
24
"assemblyConstituency": "AMC",
25
"applicationNumber": "c8c901da-61e9-4cd5-89f7-7560997922b7",
26
"applicantId": null,
27
"dateSinceResidence": 1590825279,
28
"createdBy": "11b0e02b-0145-4de2-bc42-c97b96264807",
29
"lastModifiedBy": "11b0e02b-0145-4de2-bc42-c97b96264807",
30
"createdTime": 1657104693312,
31
"lastModifiedTime": 1657104693312
32
},
33
"operationType": "CREATE"
34
},
35
{
36
"userUUID": "11b0e02b-0145-4de2-bc42-c97b96264807",
37
"module": "PGR",
38
"tenantId": "pb.amritsar",
39
"transactionCode": "PGR.CREATE",
40
"changeDate": 1657104693732,
41
"entityName": "eg_pgr_address",
42
"objectId": "c8c901da-61e9-4cd5-89f7-7560997922b7",
43
"keyValueMap": {
44
"id": "84cbe5d1-6ee8-4379-a0c4-0e2a5c94689d",
45
"tenantId": "pb.amritsar",
46
"doorNo": "1010",
47
"latitude": null,
48
"longitude": null,
49
"buildingName": "Avigna Residence",
50
"addressId": null,
51
"addressNumber": "34 GA",
52
"type": "RESIDENTIAL",
53
"addressLine1": "KP Layout",
54
"addressLine2": "",
55
"landmark": "Petrol pump",
56
"street": "12th Main",
57
"city": "Amritsar",
58
"locality": "New Amritsar Locality",
59
"pincode": "143501",
60
"detail": "",
61
"registrationId": "89651651-841a-4b8c-a503-f5d4bb10f4d5"
62
},
63
"operationType": "CREATE"
64
}
65
]
66
}
2. URI: The format of the API to be used to search audit logs using audit-service is as follows:
audit-service/log/v1/_searchBody: Body consists RequestInfo and search criteria is passed as query params.
Sample curl for search -
curl --location --request POST 'https://dev.digit.org/audit-service/log/v1/_search?offset=0&limit=10&tenantId=pb.amritsar&objectId=c8c901da-61e9-4cd5-89f7-7560997922b7' \
--header 'Content-Type: application/json' \
--data-raw '{
"RequestInfo": {
"apiId": "asset-services",
"ver": null,
"ts": null,
"action": null,
"did": null,
"key": null,
"msgId": "search with from and to values",
"authToken": "83a1cfb3-6fde-4406-9ee1-622b3ecc7dab"
}
}'