feat: As a user, I want audit logs for the APISIX Admin API, so that all configuration changes are transparent and traceable
- Dominant language
- Lua
- Stars
- 17.1k
- Forks
- 2.9k
- Avg merge
- 3d 16h
- Merged PRs (30d)
- 63
Description
### Description
As a user, I would like the APISIX Admin API to provide audit logs that record all configuration changes (e.g., route creation, updates, deletions, plugin configurations), along with details such as who made the change, when it was made, and what was changed.
Motivation:
* Transparency and accountability: making sure all changes are visible and traceable to specific users or automation processes.
* Troubleshooting and debugging: quickly identifying when and why a misconfiguration was introduced.
* Compliance and security: many organisations must comply with standards (like ISO 27001, etc.), which require detailed audit trails for system changes.
* Forensics and incident response: having audit logs helps reconstruct the sequence of events that led to a security incident or system outage.
Proposed criteria:
* Admin API operations (create, update, delete) are logged.
* Logs include: timestamp, user/actor identity, request details, and result (success/failure).
* Logs storage:
* Storage format: logs are stored in a structured and queryable format (e.g., JSON).
* Storage backend: configurable backends for audit log storage: e.g., file, database, external logging system, perhaps existing logging plugins can be reused?
* Dashboard integration:
* A dedicated audit logs viewer is available in the APISIX Dashboard where logs can be filtered and searched by actor, resource, action type, or time range.
* UI displays change diffs where applicable (e.g., before/after for route changes).
* export functionality (e.g., download as JSON or CSV) for compliance audits.
Example configuration by the user:
* The user would have to enable this in the APISIX config file. And if the implementation reuses existing logging plugins, then the user would have to choose a logging plugin and configure it for audit logging, for example this way:
```yaml
apisix:
admin_audit_logs:
enabled: true
logging_plugin_name: elasticsearch-logger
logging_plugin_config:
# configure the chosen plugin here
```
Contributor guide
Research direction
Start by reading the APISIX Admin API entry points for create, update, and delete operations, then inspect the existing logging plugins and the APISIX configuration path mentioned in the issue. Done means configuration changes produce structured audit records with actor, timestamp, request, and result details, with the proposed storage and Dashboard requirements addressed.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- lua
- Domain
- api, backend, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100