Improve Audit logs for specific operations related to throttle policies and scopes in API Manager - Githubissues

wso2 / api-manager

All issues, tasks, improvements and new features of WSO2 API Manager

Apache License 2.0

34 stars 8 forks source link

Improve Audit logs for specific operations related to throttle policies and scopes in API Manager #1057

Open dushaniw opened 1 year ago

dushaniw commented 1 year ago

Currently API Manager generate audit logs for following.

Login in to Publisher, Developer Portal, Admin Portal and Management Console
Sign up in Developer Portal
Create, Update and Delete of API/API Product
Create, Update and Delete of Application
Subscribe to API from Application with rate limiting policy details
Unsubscribe to API from Application
Create, update, delete user
Create, update, delete role
Modify user to role assignments.
Create, Update and Delete of Key Manager
Lifecycle Change - UI is available

Audit log contain following information.

Performed By/Initiator - User who perform the operation
Action - Action type.
- Created
- Updated
- Deleted
- Login
Type of management operation/Target - Eg: API/Application etc.
Info/Data - Additional Information of the operation
Outcome/Result - Success or Failure

We are missing audit logs for following and need to implement these.

[x] Admin portal related rate limiting policy operations - Fixed with https://github.com/wso2/carbon-apimgt/pull/11763
[ ] Scope management operations
[ ] Mediation Policy Management operations
[ ] Lifecycle management
[ ] Revision deployment

chamikasudusinghe commented 1 year ago

Date: 20th Jan 2022

Update: The audit logs for admin portal related items were added previously due to a request from a customer.

API Categories

creation
update
delete

Application

owner change

Gateway Environments

delete
update
creation

System Scopes Mapping

Update roles for scope
Update system scope role aliases

Throttling Policies

Advanced (creation, update, delete)
Application (creation, update, delete)
Subscription (creation, update, delete)
Global policy (creation, update, delete)
Deny policy (creation, update, delete)

Workflow status update

Tenant-configuration - update/modification

Public PR: https://github.com/wso2/carbon-apimgt/pull/11763

The rest of the audit logs should be added on a different release since they require significant changes.