Summary
Two surfaces, one narrative: "every action by every identity, visible in one console — including the ones outside Periscope's user base."
Surface 1 — CloudTrail pod-correlation table: joins the AWS-side audit feed (CloudTrail) with K8s-side identity (pod / SA / role assumption chain) so operators can answer "what did this pod do to AWS?" without bouncing between two logs.
Surface 2 — Cluster-wide kube-apiserver audit ingestion: visibility into every identity acting inside K8s (ServiceAccounts, controllers, automation) — not just users acting through Periscope. Same audit-feed view; new pivot.
Why this is one epic
Both surfaces share the same data-plane work: ingest an audit log from outside Periscope, parse it, join it with the existing impersonation-driven audit, dedupe, surface in the unified /audit view with new filter pivots.
Sub-tasks (filed when work begins)
compliance — backend: CloudTrail EventBridge subscriber (per-cluster, per-region) with batched delivery to the server.compliance — backend: pod-session-ARN join engine (CloudTrail userIdentity.sessionContext.sessionIssuer.arn → IAM role → SA bound to that role → pods).compliance — backend: kube-apiserver audit log ingestion (read the cluster's audit policy + webhook output OR the static log file via the agent).compliance — backend: dedupe (Periscope's own audit emits pod.exec.attempted + the apiserver audit emits the same event under a different identity — merge correctly).compliance — frontend: /audit page filter pivots — by AWS service, by AWS API action, by K8s identity-kind (User / SA / Group), by source (Periscope / CloudTrail / apiserver-audit).compliance — frontend: pod detail pane "AWS API calls" tab — every CloudTrail event traceable to this pod's session in its lifetime.compliance — docs: usage/compliance-lens.md + setup/audit-ingestion.md + the IAM permissions needed for CloudTrail subscribe.
Out of scope (v1.4)
- Custom audit retention policies per-source (single retention window for v1.3)
- SIEM-side replay tools (Periscope serves the in-app view; export to CloudWatch / Loki / Datadog via existing stdout JSON sink)
References
Summary
Two surfaces, one narrative: "every action by every identity, visible in one console — including the ones outside Periscope's user base."
Surface 1 — CloudTrail pod-correlation table: joins the AWS-side audit feed (CloudTrail) with K8s-side identity (pod / SA / role assumption chain) so operators can answer "what did this pod do to AWS?" without bouncing between two logs.
Surface 2 — Cluster-wide kube-apiserver audit ingestion: visibility into every identity acting inside K8s (ServiceAccounts, controllers, automation) — not just users acting through Periscope. Same audit-feed view; new pivot.
Why this is one epic
Both surfaces share the same data-plane work: ingest an audit log from outside Periscope, parse it, join it with the existing impersonation-driven audit, dedupe, surface in the unified
/auditview with new filter pivots.Sub-tasks (filed when work begins)
compliance — backend: CloudTrail EventBridge subscriber (per-cluster, per-region) with batched delivery to the server.compliance — backend: pod-session-ARN join engine (CloudTrailuserIdentity.sessionContext.sessionIssuer.arn→ IAM role → SA bound to that role → pods).compliance — backend: kube-apiserver audit log ingestion (read the cluster's audit policy + webhook output OR the static log file via the agent).compliance — backend: dedupe (Periscope's own audit emitspod.exec.attempted+ the apiserver audit emits the same event under a different identity — merge correctly).compliance — frontend: /audit page filter pivots — by AWS service, by AWS API action, by K8s identity-kind (User / SA / Group), by source (Periscope / CloudTrail / apiserver-audit).compliance — frontend: pod detail pane "AWS API calls" tab — every CloudTrail event traceable to this pod's session in its lifetime.compliance — docs: usage/compliance-lens.md + setup/audit-ingestion.md + the IAM permissions needed for CloudTrail subscribe.Out of scope (v1.4)
References
internal/audit/— read first