Auditing to Cloud Object Storage by using the REST API

Db2 as a Service supports auditing to IBM Cloud Object Storage (COS). To configure auditing, create a storage alias for the COS bucket, configure the audit facility by using the Db2 REST API, and create audit policies that define the database activities to audit.

Audit records can be archived to an IBM Cloud Object Storage (COS) bucket for long-term retention and analysis. This configuration uses a storage alias that provides access to the COS bucket and a REST API that associates the audit facility with the storage location.

Before You Begin

Ensure that you have:

  • An IBM Cloud Object Storage bucket.
  • The COS endpoint URL.
  • COS credentials (access key and secret key).
  • Authority to create storage aliases and audit policies.
  • Access to the Db2 REST API.

Creating a storage alias for Cloud Object Storage

Before you configure auditing, create a storage alias that allows the Db2 audit facility to write audit records to your Cloud Object Storage bucket.

Use the SYSIBMADM.STORAGE_ACCESS_ALIAS.CATALOG procedure: 

call SYSIBMADM.STORAGE_ACCESS_ALIAS.CATALOG('TESTAUDITALIAS',
's3',
'<endpoint-url e.g. s3.us-east.cloud-object-storage.appdomain.cloud>',
'<user e.g. access_key_id>',
<password e.g. secret_access_key>',
'<bucket-name>',
<folder-or-tag-name>',
'G',
'BLUADMIN');

The storage alias must grant access to the BLUADMIN group so that the Db2 audit facility can write archived audit records to the Cloud Object Storage bucket.

Configuring the audit facility

After the storage alias is created, use the Db2 REST API to configure the audit facility. The REST API associates auditing with the Cloud Object Storage location that is defined by the storage alias.

For more information about the available REST API operations, see Install and Configure db2audit v3 .

The REST API configuration must reference the storage alias that was created for the Cloud Object Storage bucket.

Creating audit policies

Audit policies define the database activities that are recorded. After the audit facility is configured, create and apply one or more audit policies by using SQL statements.

The following example creates and applies an audit policy for validation and logon events: 


// Define a policy
CREATE AUDIT POLICY AUDIT_VALIDATE_ONLY CATEGORIES VALIDATE STATUS BOTH ERROR TYPE NORMAL

// Apply to database entities
AUDIT ROLE DASHDB_ENTERPRISE_ADMIN USING POLICY AUDIT_VALIDATE_ONLY
AUDIT DATABASE USING POLICY AUDIT_VALIDATE_ONLY

For more information about creating audit policies, see Audit policies for more policy examples.