Audit Events: Log feature flag enable/disable if actor is present
Problem to solve
Feature flag changes can affect the security of users and organizations. However, they are not logged as audit events. This was reported by a Premium customer and also noted by GitLab internally.
Proposal
Feature flag enable and disable should be logged as individual Audit Events.
Proposed Solution
- Make
Gitlab::Audit::RailsConsoleAuthor
class, Use this for author data inaudit_event
. - For Target use
Feature::FlipperGate
. - Store actor as scope for audit event.
- Use Auditor Framework to generate audit events. refer: https://docs.gitlab.com/ee/development/audit_event_guide/#how-to-instrument-new-audit-events
Edited by Harsimar Sandhu