Service account audit events

You can track service account activity for compliance reporting and security monitoring by using audit events that automation orchestrator emits for lifecycle and credential operations.

Overview
Copy link

Service account audit events map to two categories in the audit event taxonomy. Lifecycle events (create, delete, disable) and credential events (token creation and revocation) are classified as the User action category and stored in the platform database. These events are visible in the Audit UI and available for compliance review.

For common event fields shared across all audit event types, see Audit event reference. The resource_urn for service account events uses the format urn:syntara:service-account:identifier.

Lifecycle events
Copy link

The following events are emitted when administrators create, modify, or remove service accounts.

Event action Trigger Category Severity
service_account_create Service account created in a project User action Info
service_account_delete Service account deleted User action Warning
service_account_disable Service account status set to disabled User action Info
Note

When a service account is deleted, the event record retains the resource_urn field with the service account identifier. The platform uses a hard-delete model; the service account itself is permanently removed and cannot be recovered through the platform API or UI. Audit events are the only remaining record of the deleted service account's history.

Credential events
Copy link

The following two service account credential events produce audit events in the User action category.

Event action Trigger Category Severity
service_account_token_created A new authentication token is issued for a service account User action Warning
service_account_token_revoked A service account authentication token is revoked User action Warning

Compliance use cases
Copy link

Use service account audit events to support the following compliance monitoring scenarios:

  • Unauthorized service account creation — monitor service_account_create events at Info severity to identify service accounts created outside of approved provisioning workflows.
  • Credential rotation compliance — use service_account_token_created and service_account_token_revoked events to verify that token rotation policies are followed.
  • Decommissioning verification — audit service_account_delete and service_account_disable events to confirm service accounts are properly decommissioned when no longer required.

Filter examples
Copy link

To isolate all service account events in pod logs:

$ oc logs deployment/orchestrator-deployment-name -n namespace | \
    jq 'select(.resource_urn | startswith("urn:syntara:service-account:"))'

To isolate credential rotation events:

$ oc logs deployment/orchestrator-deployment-name -n namespace | \
    jq 'select(.event_action | test("service_account_token"))'