PF-03 · Tencent · IaC
Tencent Cloud audit-ready Terraform
Tencent Cloud modules that define CloudAudit tracks per service, so risky changes land in a COS bucket.
- 18
- Terraform modules
- 4
- Audit tracks by service
- 19
- Audit events tracked in code
- Problem
-
Changes on Tencent Cloud needed a per-service record of who did what. The provider also ships on an irregular cycle, so a new version could change a plan without any code change.
- Approach
-
CloudAudit tracks are defined per service in code for CAM, CVM, CBS, and VPC, and each stores to its own COS prefix. Every module pins the provider to = 1.81.163.
- Result
-
Permission, server, disk, and security group changes reach COS through the tracks defined in code, including risky events such as CreateApiKey and AttachUserPolicy.
- What I learned
-
With audit logs, making them readable later mattered more than keeping them at all. Instead of mixing events into one stream, separate tracks and COS prefixes for CAM, CVM, CBS, and VPC let a reviewer read one kind of change at a time, such as permissions or servers, and set retention per kind. I also learned that pinning the provider to an exact version is not just habit but an audit safeguard: it keeps a plan from changing while the code stays the same. And a passing scan means only as much as the rules behind it, so on Tencent Cloud, where scanners have few rules, I had to decide for myself what to record in code.