Audit devices and on-call signals

Who read what, and what pages you.

In short. If Vault has no audit device, a secrets platform becomes a black box: you can neither prove who read a path nor detect an attacker enumerating mounts.

If Vault has no audit device, a secrets platform becomes a black box: you can neither prove who read a path nor detect an attacker enumerating mounts. Audit devices receive every request and response (with sensitive field HMAC) and write to a file, socket, or syslog. Enable at least one before you onboard the company.

Audit is also an availability dependency. If Vault cannot write to a configured audit device, it may block requests depending on configuration — which is painful and correct for high-assurance setups. Run redundant devices, monitor disk, and treat audit outages as Vault outages.

Enable and verify audit

vault audit enable file file_path=/var/log/vault/audit.log
vault audit list
# generate an event
vault kv get secret/lab/demo
sudo tail -n 2 /var/log/vault/audit.log | jq '{type,path:.request.path,user:.auth.display_name}'

Path     Type    Description
file/    file    n/a
 
{"type":"response","path":"secret/data/lab/demo","user":"oidc-alice"}

Ship logs to immutable storage (separate account, WORM/object lock). Alert on auth/ failures spikes, policy writes, generate-root, and unusual sys/ access. Do not log raw secrets — Vault HMACs many sensitive fields; still avoid copying audit lines into chat.

Metrics that page humans

Export telemetry: seal status, leadership changes, autopilot failure tolerance, audit write errors, token create rates, lease revocation failures. A sealed cluster is an availability incident with security implications; a spike in permission denied on sensitive paths may be reconnaissance.

Going deeper

Choose JSON audit format for SIEM parsing. Include request.path, auth.display_name, auth.policies, and error fields in dashboards. Build a saved query for sys/step-down, operator/generate-root, sys/rekey, and policy writes — those are break-glass adjacent.

HMAC salts mean you can verify the same secret value produced the same HMAC without storing the secret in the SIEM. Still treat audit storage as sensitive: paths alone reveal architecture, and identity fields reveal who has access.

If you forward to syslog, use mutual TLS and reliable buffering. Dropped audit under load is a compliance and IR failure. Test by inducing a full disk in lab and documenting whether Vault fails closed — then size disks and alerts accordingly.

Try this

Enable file audit in a lab, perform a denied read, and find the corresponding audit entry.

vault audit enable file file_path=/tmp/vault-audit.log
VAULT_TOKEN=invalid vault kv get secret/lab/demo || true
grep permission /tmp/vault-audit.log | tail -1

... "error":"permission denied" ...
# SUCCESS — denial is visible in audit

Takeaway

Audit devices turn Vault into an accountable system. Enable early, ship off-box, alert on break-glass and enumeration patterns, and monitor audit health like disk full on a database.

Next: rotation and break-glass — the sealed axe behind the glass.

Related