Tencent Cloud audit-ready Terraform.
Tencent Cloud modules that define CloudAudit tracks per service, so risky changes land in a COS bucket.
Problem
Changes on Tencent Cloud needed a per-service record of who did what. The provider also ships on an irregular cycle, so a new version could change a plan without any code change.
Approach
CloudAudit tracks are defined per service in code for CAM, CVM, CBS, and VPC, and each stores to its own COS prefix. Every module pins the provider to = 1.81.163.
Implementation
- Terraform
- Tencent Cloud
- CloudAudit
- COS
- CAM
- CLB
Scale · 18 modules · 3 examples
CloudAudit tracks are defined per service in code. Each stores to its own COS prefix.
The CAM track records risky events such as CreateApiKey and AttachUserPolicy.
The CVM track records server changes such as RunInstances and TerminateInstances.
CBS and VPC tracks record disk changes and security group policy changes.
Who changed what piles up in COS by service, ready to be read one kind at a time.
Read every step
- CloudAudit tracks are defined per service in code. Each stores to its own COS prefix.
- The CAM track records risky events such as CreateApiKey and AttachUserPolicy.
- The CVM track records server changes such as RunInstances and TerminateInstances.
- CBS and VPC tracks record disk changes and security group policy changes.
- Who changed what piles up in COS by service, ready to be read one kind at a time.
Result
Permission, server, disk, and security group changes reach COS through the tracks defined in code, including risky events such as CreateApiKey and AttachUserPolicy.
- 18
- Terraform modules
- 4
- Audit tracks by service
- 19
- Audit events tracked in code
What I learned
With audit logs, making them readable later mattered more than keeping them at all. Instead of mixing events into one stream, separate tracks and COS prefixes for CAM, CVM, CBS, and VPC let a reviewer read one kind of change at a time, such as permissions or servers, and set retention per kind. I also learned that pinning the provider to an exact version is not just habit but an audit safeguard: it keeps a plan from changing while the code stays the same. And a passing scan means only as much as the rules behind it, so on Tencent Cloud, where scanners have few rules, I had to decide for myself what to record in code.
4 audit tracks — CAM · CVM · CBS · VPC