Service account audit events

You can track service account activity for compliance reporting and security monitoring by using audit events that automation orchestrator emits for lifecycle, credential, and authentication operations.

Lifecycle events

These events are written to pod standard output and, when configured, forwarded to an external OpenTelemetry Protocol (OTLP)-compatible observability backend.

The following events are emitted when administrators create, modify, or remove service accounts:

Event action Trigger Category Severity
service_account_create Service account created in a project User action Info
service_account_update Service account name or description modified User action Info
service_account_delete Service account deleted User action Info
service_account_disable Service account status set todisabled User action Info
service_account_enable Service account status set toactive User action Info

Lifecycle events record the following auditable fields from the ServiceAccount model: name, description, status, project_id, token_version, last_authenticated_at, created_by, and updated_by.

Credential events

The following events are emitted when administrators create, rotate, or remove service account credentials:

Event action Trigger Category Severity
sa_credential_create Credential created for a service account User action Info
sa_credential_delete Credential deleted User action Info
sa_credential_rotate Credential secret rotated User action Info
sa_credential_disable Credential status set todisabled User action Info
sa_credential_enable Credential status set toactive User action Info

Credential events record the following auditable fields from the ServiceAccountCredential model: service_account_id, credential_type, identifier, status, grace_period_seconds, expires_at, last_used_at, created_by, and updated_by.

Client secrets are never included in audit events. Automation orchestrator applies sensitive field redaction before events are emitted.

Authentication events

The following events are emitted when service accounts authenticate or are rejected:

Event action Trigger Category Severity
login (success) Successful authentication with valid client credentials User action Info
login (failed) Authentication failure: unknown client ID, incorrect secret, disabled account, deleted account, disabled credential, or expired credential Security event Warning
disabled_sa_rejected Request rejected from a disabled or deleted service account Security event Warning
disabled_sa_credential_rejected Request rejected because the credential used to obtain the token is disabled or deleted Security event Warning
missing_sa_credential_claim_rejected SA token rejected because it lacks thecred_id claim Security event Warning
stale_sa_token_detected Outdated token version detected for a service account Security event Info

Service account authentication events use the same login event action as human user login events, with method set to client_credentials in the structured data and actor_type set to service_account on the event. Multiple failure conditions can map to the same error reason without exposing which condition failed to the caller.

Disabled service account rejection: data_type: disabled-sa-rejection

Emitted when a request carries a valid JWT issued to a service account that has since been disabled or deleted.

Field Type Description
sa_status String Status of the service account at the time of rejection.
is_alive Boolean Whether the service account database record exists. Alwaysfalse whensa_status isdeleted.

Disabled credential rejection: data_type: disabled-sa-credential-rejection

Emitted when a request carries a valid JWT, but the credential that issued the token has since been disabled or deleted.

Field Type Description
credential_status String Status of the credential at the time of rejection (disabled) ordeleted if the credential no longer exists.
credential_id String UUID of the credential that issued the rejected token.

Missing credential claim rejection: data_type: missing-sa-credential-claim

Emitted when a service account token is rejected because it does not contain the cred_id claim. Tokens without this claim cannot be validated for per-credential revocation.

Stale service account token detected: data_type: stale-sa-token-detection

Emitted when a service account presents a token with a token_ver claim that is lower than the current token version. This indicates the token was issued before a revocation event.

Field Type Description
token_version Integer Version number in the rejected token.
current_version Integer Current required token version for the service account.

Resource Uniform Resource Name (URN) format

Service account audit events use the following URN format in the resource_urn field:

urn:syntara:service-account:{service_account_id}

Use this URN prefix to filter audit events by service account in your observability backend.