Audit logs
HCP Vault Secrets provides audit logs for all events. These logs capture which users and service principals performed which operations, such as reading or deleting a secret.
View audit logs
Log into HCP Portal. It opens the last project you were in. Choose the target project if it is different.
Select Vault Secrets > Apps.
Select the application name you wish to view.
Select Audit Logs.
Using the audit logs, you can learn the following information:
- Event - the type of operation
- Triggered By - the user email or service principal and client IP address from where the request originated
- Scope - the scope an operation was executed on. For example, if a new application was created, the scope of the event is application.
- Interface - the client interface used for the request (such as UI, CLI, API)
- Timestamp - the time of the event
Application deletion events
The audit log viewer within the HCP UI is currently at the application level, therefore if an application is deleted, you can no longer able view its audit logs using the UI. Use log streaming to retain audit log events for deleted applications.
Audit log streaming
Plus tier
This feature is available in HCP Vault Secrets Plus tier.
HCP Vault Secrets audit log events can be streamed to an external provider with the Plus tier. Refer to HCP audit log streaming for more information on supported providers and steps to configure.