Skip to content

Revert audit log args redaction to restore CloudWatch visibility #21039

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged

roboquat merged 1 commit into main from revert-audit-args-redaction

Sep 4, 2025

Merged

Revert audit log args redaction to restore CloudWatch visibility #21039

Changes from all commits

Commits

Show all changes

Select commit

Revert "Redact args in the logs of audit log service (#20853)"

corneliusludmann Sep 4, 2025

File filter

Filter by extension

Conversations

Jump to

Jump to file

Failed to load files.

Loading

Diff view

Diff view

11 changes: 1 addition & 10 deletions components/server/src/audit/AuditLogService.ts

Show comments View file Open in desktop

Original file line number	Diff line number	Diff line change
Expand Up		@@ -53,16 +53,7 @@ export class AuditLogService {
		action: method,
		args: argsScrubbed,
		};
	// The args param contains workspace IDs and other sensitive data. Since
	// it's quite hard to detect them, best way is to simply not log it at
	// all. It's still part of the audit database but does not appear in the
	// component logs.
	const logEntryForLogging = {
	...logEntry,
	args: ["[redacted]"],
	};

	log.info("audit", new TrustedValue(logEntryForLogging));
	log.info("audit", new TrustedValue(logEntry));
		await this.dbAuditLog.recordAuditLog(logEntry);
		}

Expand Down

Loading