|
| 1 | +# render-auditlogs |
| 2 | + |
| 3 | +Export [Render](https://render.com) audit logs to an AWS S3 bucket. |
| 4 | + |
| 5 | +## Overview |
| 6 | + |
| 7 | +This project provides: |
| 8 | +- A Go application that fetches audit logs from the Render API and uploads them to S3 |
| 9 | +- Terraform modules to deploy the infrastructure on both AWS and Render |
| 10 | +- Automatic scheduling via a Render Cron Job that runs every 15 minutes by default |
| 11 | + |
| 12 | +Supports both workspace-level and organization-level (Enterprise) audit logs. |
| 13 | + |
| 14 | +## Prerequisites |
| 15 | + |
| 16 | +- Render workspace on Organization or Enterprise plan |
| 17 | +- [Render API Key](https://dashboard.render.com/u/settings) (create from Account Settings) |
| 18 | +- Render Owner ID (`tea-xxx`) — workspace where the Cron Job will be deployed |
| 19 | +- [Terraform](https://www.terraform.io/downloads) >= 1.0 |
| 20 | +- AWS account with permissions to create S3 buckets and IAM users |
| 21 | + |
| 22 | +## Quick Start |
| 23 | + |
| 24 | +### 1. Clone the repository |
| 25 | + |
| 26 | +```bash |
| 27 | +git clone https://github.com/renderinc/render-auditlogs.git |
| 28 | +cd render-auditlogs/terraform |
| 29 | +``` |
| 30 | + |
| 31 | +### 2. Configure authentication |
| 32 | + |
| 33 | +Set up authentication for both providers: |
| 34 | + |
| 35 | +```bash |
| 36 | +# AWS - use one of these methods: |
| 37 | +export AWS_PROFILE=your-profile |
| 38 | +# or |
| 39 | +export AWS_ACCESS_KEY_ID=... |
| 40 | +export AWS_SECRET_ACCESS_KEY=... |
| 41 | + |
| 42 | +# Render - both are required for the Terraform provider |
| 43 | +export RENDER_API_KEY=your-render-api-key |
| 44 | +export RENDER_OWNER_ID=tea-xxxxx |
| 45 | +``` |
| 46 | + |
| 47 | +### 3. Deploy with Terraform |
| 48 | + |
| 49 | +```bash |
| 50 | +terraform init |
| 51 | +terraform apply \ |
| 52 | + -var="aws_s3_bucket_name=your-audit-logs-bucket" \ |
| 53 | + -var="render_api_key=${RENDER_API_KEY}" \ |
| 54 | + -var='render_workspace_ids=["tea-xxxxx", "tea-yyyyy"]' |
| 55 | +``` |
| 56 | + |
| 57 | +For Enterprise customers with organization-level audit logs: |
| 58 | + |
| 59 | +```bash |
| 60 | +terraform apply \ |
| 61 | + -var="aws_s3_bucket_name=your-audit-logs-bucket" \ |
| 62 | + -var="render_api_key=${RENDER_API_KEY}" \ |
| 63 | + -var="render_organization_id=org-xxxxx" \ |
| 64 | + -var='render_workspace_ids=["tea-xxxxx", "tea-yyyyy"]' |
| 65 | +``` |
| 66 | + |
| 67 | +## Terraform Variables |
| 68 | + |
| 69 | +| Variable | Required | Default | Description | |
| 70 | +|----------|----------|---------|-------------| |
| 71 | +| `aws_s3_bucket_name` | Yes | - | Name of the S3 bucket to create for storing audit logs | |
| 72 | +| `render_api_key` | Yes | - | Render API key for accessing audit logs | |
| 73 | +| `render_workspace_ids` | No | `[]` | List of workspace IDs to fetch audit logs from | |
| 74 | +| `render_organization_id` | No | `""` | Organization ID for Enterprise audit logs | |
| 75 | +| `aws_iam_user_name` | No | `render-audit-log-processor` | Name of the IAM user created for S3 access | |
| 76 | +| `render_cronjob_name` | No | `render-auditlogs` | Name of the Render Cron Job | |
| 77 | +| `render_cronjob_schedule` | No | `1/15 * * * *` | Cron schedule (default: every 15 minutes) | |
| 78 | +| `render_cronjob_plan` | No | `starter` | Render plan for the Cron Job | |
| 79 | +| `render_cronjob_region` | No | `oregon` | Region to deploy the Cron Job | |
| 80 | +| `render_project_name` | No | `audit-logs` | Name of the Render project | |
| 81 | + |
| 82 | +## Architecture |
| 83 | + |
| 84 | +The Terraform configuration creates: |
| 85 | + |
| 86 | +**AWS Resources:** |
| 87 | +- S3 bucket (versioned, encrypted, public access blocked) |
| 88 | +- IAM user with S3 write permissions |
| 89 | + |
| 90 | +**Render Resources:** |
| 91 | +- Project |
| 92 | +- Cron Job (builds from this repo) |
| 93 | + |
| 94 | +## Local Development |
| 95 | + |
| 96 | +To run the application locally: |
| 97 | + |
| 98 | +1. Create a `.env` file: |
| 99 | + |
| 100 | +```bash |
| 101 | +WORKSPACE_IDS=tea-xxxxx,tea-yyyyy |
| 102 | +ORGANIZATION_ID=org-xxxxx # Optional, for Enterprise |
| 103 | +S3_BUCKET=your-bucket-name |
| 104 | +RENDER_API_KEY=your-api-key |
| 105 | +AWS_ACCESS_KEY_ID=your-aws-key |
| 106 | +AWS_SECRET_ACCESS_KEY=your-aws-secret |
| 107 | +AWS_REGION=us-west-2 |
| 108 | +``` |
| 109 | + |
| 110 | +2. Run the application: |
| 111 | + |
| 112 | +```bash |
| 113 | +go run main.go |
| 114 | +``` |
| 115 | + |
| 116 | +## S3 Object Structure |
| 117 | + |
| 118 | +Path format (Hive-style partitioning, gzip compressed): |
| 119 | + |
| 120 | +``` |
| 121 | +s3://your-bucket/ |
| 122 | + ├── workspace=tea-xxxxx/ |
| 123 | + │ └── year=2024/ |
| 124 | + │ └── month=1/ |
| 125 | + │ └── day=15/ |
| 126 | + │ └── audit-logs-2024-01-15_10-30-00.json.gz |
| 127 | + └── organization=org-xxxxx/ |
| 128 | + └── year=2024/ |
| 129 | + └── month=1/ |
| 130 | + └── day=15/ |
| 131 | + └── audit-logs-2024-01-15_10-30-00.json.gz |
| 132 | +``` |
| 133 | + |
| 134 | +## Integration with Panther SIEM |
| 135 | + |
| 136 | +1. Create a custom log type in Panther with the schema below |
| 137 | +2. Add an S3 log source pointing to your audit-logs bucket |
| 138 | +3. Configure S3 event notifications to send object-create events to Panther |
| 139 | + |
| 140 | +Panther schema: |
| 141 | + |
| 142 | +```yaml |
| 143 | +fields: |
| 144 | + - name: auditLog |
| 145 | + required: true |
| 146 | + type: object |
| 147 | + fields: |
| 148 | + - name: actor |
| 149 | + type: object |
| 150 | + fields: |
| 151 | + - name: email |
| 152 | + type: string |
| 153 | + indicators: |
| 154 | + - email |
| 155 | + - name: id |
| 156 | + type: string |
| 157 | + - name: type |
| 158 | + type: string |
| 159 | + - name: event |
| 160 | + type: string |
| 161 | + - name: id |
| 162 | + type: string |
| 163 | + - name: metadata |
| 164 | + type: json |
| 165 | + - name: status |
| 166 | + type: string |
| 167 | + - name: timestamp |
| 168 | + type: timestamp |
| 169 | + isEventTime: true |
| 170 | + timeFormats: |
| 171 | + - rfc3339 |
| 172 | + - name: cursor |
| 173 | + required: true |
| 174 | + type: string |
| 175 | +``` |
| 176 | +
|
| 177 | +## Contributing |
| 178 | +
|
| 179 | +1. Fork the repository |
| 180 | +2. Create a feature branch (`git checkout -b feature/my-feature`) |
| 181 | +3. Commit your changes (`git commit -am 'Add my feature'`) |
| 182 | +4. Push to the branch (`git push origin feature/my-feature`) |
| 183 | +5. Open a Pull Request |
| 184 | + |
| 185 | +Tests run automatically on PRs via GitHub Actions. |
| 186 | + |
| 187 | +## Security |
| 188 | + |
| 189 | +To report a security vulnerability, email [email protected]. Do not open a public issue. |
| 190 | + |
| 191 | +## License |
| 192 | + |
| 193 | +See [LICENSE](LICENSE) for details. |
0 commit comments