athena audit logs - always pass utc to query

[tobiaszheller]

Part of https://github.com/gravitational/teleport.e/issues/894
RFD: https://github.com/gravitational/teleport/blob/master/rfd/0118-scalable-audit-logs.md

Query now enforces UTC time because parquet writer stores files in folders per date and date is UTC there. I believe UTC is not enforced in auth and it's up to client. This way we are sure that athena querier operates on UTC.

[rosstimothy]

How do other backends handle this? Should we consistently use UTC everywhere?

[tobiaszheller]

How do other backends handle this? Should we consistently use UTC everywhere?

TLDR: no need to change in other backends, each backend handles it by themself.

dynamo is using unix helpers, so UTC:

teleport/lib/events/dynamoevents/dynamoevents.go

Lines 1087 to 1088 in be00c95

	":start": l.fromUTC.Unix(),
	":end": l.toUTC.Unix(),

teleport/lib/events/dynamoevents/dynamoevents.go

Lines 455 to 457 in be00c95

	func daysSinceEpoch(timestamp time.Time) int64 {
	return timestamp.Unix() / (60 * 60 * 24)
	}

Firestore also using unix helpers:

teleport/lib/events/firestoreevents/firestoreevents.go

Lines 387 to 388 in be00c95

	Where(createdAtDocProperty, ">=", fromUTC.Unix()).
	Where(createdAtDocProperty, "<=", toUTC.Unix())

And filework works on time.Time struct so it's safe:

teleport/lib/events/filelog.go

Lines 489 to 506 in be00c95

	fd, err := ParseFileTime(fi.Name())
	if err != nil {
	l.Warningf("Failed to parse audit log file %q format: %v", fi.Name(), err)
	continue
	}
	// File rounding in current logs is non-deterministic,
	// as Round function used in rotateLog can round up to the lowest
	// or the highest period. That's why this has to check both
	// periods.
	// Previous logic used modification time what was flaky
	// as it could be changed by migrations or simply moving files
	if fd.After(fromUTC.Add(-1*l.RotationPeriod)) && fd.Before(toUTC.Add(l.RotationPeriod)) {
	eventFile := eventFile{
	FileInfo: fi,
	path: filepath.Join(dir, fi.Name()),
	}
	filtered = append(filtered, eventFile)
	}

[public-teleport-github-review-bot]

@tobiaszheller See the table below for backport results.

Branch	Result
branch/v13	Create PR