GitLab Compliance Group - Product, 19 Sep 2023

Previous Meeting

Next Meeting

⏯

youtube image

►

From YouTube: Teaser: Audit event streaming to AWS S3

Description

No description was provided for this meeting.
If this is YOUR meeting, an easy way to fix this is to add a description to your video, wherever mtngs.io found it (probably YouTube).

A

Hello: everyone, my name, is and I work as a senior backend engineer in the compliance team of the Govern stage uh today, I'll be demonstrating how to use Amazon S3 to stream klabs audit events.

A

uh First I'll go to AWS, console and navigate to storage, and then the S3 service.

A

First, we need to create a bucket, so let's just name this bucket as audit logs from gitlab uh we'll keep the region as it is and create this.

A

Bucket uh we'll go inside this bucket and we can see that we don't have any objects or directories in this bucket. uh Now we'll use this bucket on kit laab.

A

uh So, let's just go to rails console right now we don't have a user interface so for this uh demonstration, I'll be using uh the rails, console and directly creating the active records. uh So I'll just past this. uh So if you can see that we we simply creating, uh we have the audit events, Amazon SC configuration model and we're creating a new object on it. uh The name space ID is 31 the access, the ID is this and the secret access to uh being this. uh Let's just name this as Amazon.

A

S3 test audit logs and the bucket name is audit logs from gitlab, which uh we had said earlier. The AWS region is AP, Southeast too, so we'll save this and it saved successfully uh now to see. If this works, we will go back to gitlab uh notice that this is the name space ID for which we added the audit events. uh Amazon S3 configuration so let's navigate to the group settings and make some changes to one of the settings so that an audit event is created so I'll disable the prevent approval by author request.

A

Approval check, save the changes you can see that it has been updated uh and audit event should have been streamed. So I'll read this page and yeah, so we have a directory here. uh If I click on this, we have a group directory and inside the groups directory. We have allow author approval, updated and 906 is the audit event ID, and this is the time stamp in EO when this particular event occurred.

A

So, let's see what the contents are: I'll go ahead and download the file okay, so it got downloaded uh again navigate to my terminal and go to the downloads directory and see what we have here. So you can see that we have all the details for this particular event. We have the entity ID as 30 31, The Entity type as uh group, and the details prevent merest approvals from authors uh and was changed from false from True to false. The author was administrator and change.

A

Prevent mer, request approval from authors from true to FS, so yeah it works. Now we can try creating another event which could be inside the at the project level, for example, if I navigate to the to project and go to settings and let's say I, apply a framework to this project. uh Let's just apply the fips compliance framework, saes changes. This should create a new audit event, we'll go back to our bucket and we can see that we have a project directory now and if I click on it I have the compliance framework.

A

Id, updated 907 is the audit event ID, and this is theform St I'll download. This event as well and let's see what other details that we have so we have this right, so 907 was the ID, uh which is also in the file name.

A

uh This says the changed compliance framework from none to fips. This is correct. Let's now navigate back to settings and, let's simply remove the framework, save the changes go back and now I can see that we have another event, which is compliance framework deleted.

A

uh We can download this event as.

A

Well- and we can see un assigned project compliance stre here, so this is how we can stream gitlabs audit events to which are generated at the name Space level uh to the to Amazon S3. Thanks for watching bye.