Skip to content

New audit event: SSH key actions for namespace-specific users

Additional context in parent epic.

Audit need

Understanding when SSH keys are created, changed, or deleted helps to ensure users are complying with company policy and also can be used to identify unusual activity.

Proposal

Create a new audit event when:

  • A new SSH key is created for a user
  • An existing SSH key is changed for a user
  • An existing SSH key is deleted for a user

This should only be surfaced for users that have been provisioned as enterprise users in the relevant top-level group.

  • For users that are not part of that enterprise, do not surface the events.

Streaming audit event considerations

Only send as a streaming audit event, due to data volume potentially.

Edited by Sam Kerr