[RANGER-3257] Update default kafka audit filters to filter out unwanted audits

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.2.0
• Fix Version/s: 3.0.0, 2.2.0
• Component/s: audit
• Assignee: Mateen Mansoori
• Reporter: Abhishek Shukla
• Created: 27/Apr/21 08:37
• Updated: 12/May/21 04:02
• Resolved: 11/May/21 08:58

Description

Can we update the default Kafka audit filters as follows: 

This will filter out Kafka audits related to ATLAS_SPARK_HOOK, topic describe action, etc

[
  {
    "accessResult":"DENIED",
    "isAudited":true
  },
  {
    "resources":{
      "topic":{
        "values":[
          "ATLAS_ENTITIES",
          "ATLAS_HOOK",
          "ATLAS_SPARK_HOOK"
        ]
      }
    },
    "users":[
      "atlas"
    ],
    "actions":[
      "describe",
      "publish",
      "consume"
    ],
    "isAudited":false
  },
  {
    "resources":{
      "topic":{
        "values":[
          "ATLAS_HOOK"
        ]
      }
    },
    "users":[
      "hive",
      "hbase",
      "impala",
      "nifi"
    ],
    "actions":[
      "publish",
      "describe"
    ],
    "isAudited":false
  },
  {
    "resources":{
      "topic":{
        "values":[
          "ATLAS_ENTITIES"
        ]
      }
    },
    "users":[
      "rangertagsync"
    ],
    "actions":[
      "consume",
      "describe"
    ],
    "isAudited":false
  },
  {
    "resources":{
      "consumergroup":{
        "values":[
          "*"
        ]
      }
    },
    "users":[
      "atlas",
      "rangertagsync"
    ],
    "actions":[
      "consume"
    ],
    "isAudited":false
  },
  {
    "users":[
      "kafka"
    ],
    "isAudited":false
  }
]

cc dineshkumar-yadav

Issue Links

• relates to: RANGER-3260 Update default hdfs audit filters to filter out unwanted audits
• relates to: RANGER-3258 Update default hbase audit filters to filter out unwanted audits
• links to: Apache RR