[v10] Add lock target to lock.create event

api/proto/teleport/legacy/types/events/events.proto

@@ -20,6 +20,7 @@ import "gogoproto/gogo.proto";
 import "google/protobuf/struct.proto";
 import "google/protobuf/timestamp.proto";
 import "google/protobuf/wrappers.proto";
+import "teleport/legacy/types/types.proto";
 import "teleport/legacy/types/wrappers/wrappers.proto";
 
 option go_package = "github.com/gravitational/teleport/api/types/events";
@@ -2678,6 +2679,12 @@ message LockCreate {
     (gogoproto.embed) = true,
     (gogoproto.jsontag) = ""
   ];
+
+  // Target describes the set of interactions that the lock applies to
+  types.LockTarget Target = 4 [
+    (gogoproto.nullable) = false,
+    (gogoproto.jsontag) = "target"
+  ];
 }
 
 // LockDelete is emitted when a lock is deleted

api/types/events/resource_ids.go

@@ -0,0 +1,33 @@
+/*
+Copyright 2022 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package events
+
+import "github.com/gravitational/teleport/api/types"
+
+// EventResourceIDs converts a []ResourceID to a []events.ResourceID
+func ResourceIDs(resourceIDs []types.ResourceID) []ResourceID {
+	if resourceIDs == nil {
+		return nil
+	}
+	out := make([]ResourceID, len(resourceIDs))
+	for i := range resourceIDs {
+		out[i].ClusterName = resourceIDs[i].ClusterName
+		out[i].Kind = resourceIDs[i].Kind
+		out[i].Name = resourceIDs[i].Name
+	}
+	return out
+}

api/types/resource_ids.go

@@ -21,7 +21,6 @@ import (
 	"fmt"
 	"strings"
 
-	"github.com/gravitational/teleport/api/types/events"
 	"github.com/gravitational/teleport/api/utils"
 	"github.com/gravitational/trace"
 )
@@ -109,17 +108,3 @@ func ResourceIDsFromString(raw string) ([]ResourceID, error) {
 	}
 	return resourceIDs, nil
 }
-
-// EventResourceIDs converts a []ResourceID to a []events.ResourceID
-func EventResourceIDs(resourceIDs []ResourceID) []events.ResourceID {
-	if resourceIDs == nil {
-		return nil
-	}
-	out := make([]events.ResourceID, len(resourceIDs))
-	for i := range resourceIDs {
-		out[i].ClusterName = resourceIDs[i].ClusterName
-		out[i].Kind = resourceIDs[i].Kind
-		out[i].Name = resourceIDs[i].Name
-	}
-	return out
-}

lib/auth/access.go

@@ -106,15 +106,18 @@ func (a *Server) UpsertLock(ctx context.Context, lock types.Lock) error {
 		return trace.Wrap(err)
 	}
 
+	um := ClientUserMetadata(ctx)
 	if err := a.emitter.EmitAuditEvent(a.closeCtx, &apievents.LockCreate{
 		Metadata: apievents.Metadata{
 			Type: events.LockCreatedEvent,
 			Code: events.LockCreatedCode,
 		},
-		UserMetadata: ClientUserMetadata(ctx),
+		UserMetadata: um,
 		ResourceMetadata: apievents.ResourceMetadata{
-			Name: lock.GetName(),
+			Name:      lock.GetName(),
+			UpdatedBy: um.User,
 		},
+		Target: lock.Target(),
 	}); err != nil {
 		log.WithError(err).Warning("Failed to emit lock create event.")
 	}

lib/auth/access_test.go

@@ -82,8 +82,9 @@ func TestUpsertDeleteLockEventsEmitted(t *testing.T) {
 	// Creating a lock should emit a LockCreatedEvent.
 	err = p.a.UpsertLock(ctx, lock)
 	require.NoError(t, err)
-	require.Equal(t, p.mockEmitter.LastEvent().GetType(), events.LockCreatedEvent)
-	require.Equal(t, p.mockEmitter.LastEvent().(*apievents.LockCreate).Name, lock.GetName())
+	require.Equal(t, events.LockCreatedEvent, p.mockEmitter.LastEvent().GetType())
+	require.Equal(t, lock.GetName(), p.mockEmitter.LastEvent().(*apievents.LockCreate).Name)
+	require.Equal(t, lock.Target(), p.mockEmitter.LastEvent().(*apievents.LockCreate).Target)
 	p.mockEmitter.Reset()
 
 	// When a lock update results in an error, no event should be emitted.
@@ -96,15 +97,16 @@ func TestUpsertDeleteLockEventsEmitted(t *testing.T) {
 	lock.SetTarget(types.LockTarget{Role: "test-role"})
 	err = p.a.UpsertLock(ctx, lock)
 	require.NoError(t, err)
-	require.Equal(t, p.mockEmitter.LastEvent().GetType(), events.LockCreatedEvent)
-	require.Equal(t, p.mockEmitter.LastEvent().(*apievents.LockCreate).Name, lock.GetName())
+	require.Equal(t, events.LockCreatedEvent, p.mockEmitter.LastEvent().GetType())
+	require.Equal(t, lock.GetName(), p.mockEmitter.LastEvent().(*apievents.LockCreate).Name)
+	require.Equal(t, lock.Target(), p.mockEmitter.LastEvent().(*apievents.LockCreate).Target)
 	p.mockEmitter.Reset()
 
 	// Deleting a lock should emit a LockDeletedEvent.
 	err = p.a.DeleteLock(ctx, lock.GetName())
 	require.NoError(t, err)
-	require.Equal(t, p.mockEmitter.LastEvent().GetType(), events.LockDeletedEvent)
-	require.Equal(t, p.mockEmitter.LastEvent().(*apievents.LockDelete).Name, lock.GetName())
+	require.Equal(t, events.LockDeletedEvent, p.mockEmitter.LastEvent().GetType())
+	require.Equal(t, lock.GetName(), p.mockEmitter.LastEvent().(*apievents.LockDelete).Name)
 	p.mockEmitter.Reset()
 
 	// When deleting a nonexistent lock, no event should be emitted.

lib/auth/auth.go

@@ -2585,7 +2585,7 @@ func (a *Server) CreateAccessRequest(ctx context.Context, req types.AccessReques
 			Expires: req.GetAccessExpiry(),
 		},
 		Roles:                req.GetRoles(),
-		RequestedResourceIDs: types.EventResourceIDs(req.GetRequestedResourceIDs()),
+		RequestedResourceIDs: apievents.ResourceIDs(req.GetRequestedResourceIDs()),
 		RequestID:            req.GetName(),
 		RequestState:         req.GetState().String(),
 		Reason:               req.GetRequestReason(),

lib/tlsca/ca.go

@@ -276,7 +276,7 @@ func (id *Identity) GetEventIdentity() events.Identity {
 		AWSRoleARNs:        id.AWSRoleARNs,
 		AccessRequests:     id.ActiveRequests,
 		DisallowReissue:    id.DisallowReissue,
-		AllowedResourceIDs: types.EventResourceIDs(id.AllowedResourceIDs),
+		AllowedResourceIDs: events.ResourceIDs(id.AllowedResourceIDs),
 	}
 }