policy category

This category of logs contains the configuration concerning the OPA policy enabled in a tenant and a module.

setup action

The setup action means that a policy is correctly configured for a given tenant and module. It generates an "info" severity log if it is successful, or an "err" severity log in the event of an error.

The log fields for this action are as follows:

Field

Description

 Type

Mandatory/Optional

tenant_id

Tenant identifier.

Example: 025f02fe-bee2-444b-bf76-b5ead30327c0

 String in uuid v4 format Mandatory
enable Specify if the policy is enabled. Boolean Mandatory
engine

Prescribed value:

  • opa

  Mandatory
type

Type of policy.

Prescribed values:

  • local

  • remote

String Mandatory
module

Module concerned by the policy.

Prescribed values:

  • kacls

  • crypto_api

  • kas

  • admin

  • dke

String Mandatory
policy_uri URL of the remote policy or file path of the local policy. String Mandatory
local_data_path Path to the policy configuration file. String Mandatory if type is set to local and engine set to opa
authentication Authentication type in case of a remote policy. Object Mandatory if type is set to remote and engine set to opa
error

If the policy cannot be enabled due to an incorrect configuration, this JSON object contains an error with an error code and a message.

Example: [

{

code: 2017004,

message: ''Unable to load policy'

}

]

 Object

Optional

Verify action

The verify action means that the OPA policy has been verified on the called API route. It generates an "info" severity log if the request was verified, even if the policy is not allowed. It generates an "err" severity log if it was not possible to verify the request.

The log fields for this action are as follows:

Field

Description

 Type

Mandatory/Optional

tenant_id

Tenant identifier.

Example: 025f02fe-bee2-444b-bf76-b5ead30327c0

 String in uuid v4 format Mandatory
module

Module concerned by the policy.

Prescribed values:

  • kacls

  • crypto_api

  • kas

  • dke

String Mandatory

operation

API route concerned by the policy.

Example:

  • wrap

  • kas/encrypt

...

 String Mandatory

allow

Specify if the policy is allowed.

Prescribed values:

  • true

  • false

Boolean Mandatory