Tableflow Data Plane Auditable Event Methods on Confluent Cloud

Confluent Cloud audit logs contain records of auditable events for Tableflow operations. When an auditable event occurs, a message is sent to the audit log and is stored as an audit log record.

Tableflow catalog

The following operations generate auditable event messages for the io.confluent.cloud/request event type.

Method name	Action triggering an auditable event message
ListNamespaces	A request to list namespaces.
ListTables	A request to list tables.
LoadNamespace	A request to load a namespace.
LoadTable	A request to load a table.

ListNamespaces

The ListNamespaces event is generated by a request to list Tableflow namespaces.

To view an example event message, expand the following dropdown:

ListTables

The ListTables event is generated by a request to list Tableflow tables.

To view an example event message, expand the following dropdown:

LoadNamespace

The LoadNamespace event is generated by a request to load a Tableflow namespace.

To view an example event message, expand the following dropdown:

LoadTable

The LoadTable event is generated by a request to load a Tableflow table.

To view an example event message, expand the following dropdown:

Tableflow OAuth

The following operations authenticate for the io.confluent.cloud/request event type.

Method name	Action triggering an auditable event message
OAuthTokens (client credentials request)	A request for OAuth tokens, which includes OAuth client credentials.
OAuthTokens (JWT token refresh)	A request to refresh a JWT token.
OAuthTokens (table token refresh)	A request to refresh a table OAuth token.

OAuthTokens (client credentials request)

The OAuthTokens (client credentials request) event is generated by a request for OAuth tokens, which includes OAuth client credentials.

To view an example event message, expand the following dropdown:

OAuthTokens (JWT token refresh)

The OAuthTokens (JWT token refresh) event is generated by a request to refresh a JWT token.

To view an example event message, expand the following dropdown:

OAuthTokens (table token refresh)

The OAuthTokens (table token refresh) event is generated by a request for a table token refresh.

To view an example event message, expand the following dropdown:

Tableflow signer

The following operations generate auditable event messages for the io.confluent.cloud/request event type.

Method name	Action triggering an auditable event message
SignRequest	A request to sign a table.

SignRequest

The SignRequest event is generated by a request to sign a table.

To view an example event message, expand the following dropdown:

Success

{
  "specversion": "1.0",
  "id": "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
  "source": "crn://confluent.cloud/",
  "type": "io.confluent.cloud/request",
  "subject": "crn://confluent.cloud/organization=1250271b-2d3e-4061-9514-dbaf91cffbbd/environment=env-123/flink-region=aws.us-east-2/iceberg-table=healthcheck-topic/iceberg-signer=s3%3A%2F%2Fcc-flink-cts-soak%2Fv1%2F207e617c-6edf-4ec5-b79e-fcb7f9495c32%2Fmetadata%2F00001-8e81867c-bfee-4ea7-be32-b6f29114b0b8.metadata.json",
  "datacontenttype": "application/json",
  "dataschema": "https://confluent.io/internal/events/AuditLog.v2",
  "data": {
    "serviceName": "crn://confluent.cloud/service=cc-flink-gateway-service-v2",
    "methodName": "TableflowSignRequest",
    "cloudResources": [
      {
        "scope": {
          "resources": [
            {
              "type": "ORGANIZATION",
              "resourceId": "1250271b-2d3e-4061-9514-dbaf91cffbbd"
            },
            {
              "type": "ENVIRONMENT",
              "resourceId": "env-123"
            },
            {
              "type": "ICEBERG_TABLE",
              "resourceId": "healthcheck-topic"
            }
          ]
        },
        "resource": {
          "type": "ICEBERG_SIGNER",
          "resourceId": "s3://cc-flink-cts-soak/v1/207e617c-6edf-4ec5-b79e-fcb7f9495c32/metadata/00001-8e81867c-bfee-4ea7-be32-b6f29114b0b8.metadata.json"
        }
      }
    ],
    "authenticationInfo": {
      "principal": {
        "confluent_service_account": {
          "resourceId": "sa-111"
        }
      },
      "result": "SUCCESS",
      "identity": "crn://confluent.cloud/organization=1250271b-2d3e-4061-9514-dbaf91cffbbd/identity-provider=Confluent/identity=sa-111"
    },
    "requestMetadata": {
      "requestId": [
        "74726163656964303132333435363738"
      ],
      "clientAddress": [
        {
          "ip": "127.0.0.1"
        }
      ]
    },
    "request": {
      "accessType": "READ_ONLY",
      "data": {
        "metadata": {
          "environment_id": "env-123",
          "org_resource_id": "1250271b-2d3e-4061-9514-dbaf91cffbbd"
        },
        "s_3_sign_request": {
          "method": "GET",
          "region": "us-west-2",
          "uri": "s3://cc-flink-cts-soak/v1/207e617c-6edf-4ec5-b79e-fcb7f9495c32/metadata/00001-8e81867c-bfee-4ea7-be32-b6f29114b0b8.metadata.json"
        }
      }
    },
    "result": {
      "status": "SUCCESS",
      "data": {
        "uri": "s3://cc-flink-cts-soak/v1/207e617c-6edf-4ec5-b79e-fcb7f9495c32/metadata/00001-8e81867c-bfee-4ea7-be32-b6f29114b0b8.metadata.json"
      }
    }
  }
}