personio / rds-audit-logs-s3 Goto Github PK

Hello Personio-team,

Thank you for providing this lambda as opensource.
During the implementation for our own Application, I stumbled on some questions:

1. Is there a reason why this lambda is based on single db-instances instead of clusters?
   I can probably think of that a single lambda may not be able to catch up with the amount of audit logs a cluster with up to 16 instances may produce, or are there other issues/obstacles I am missing with e.g. auto-scaling instances?

2. Is there a reason why aurora-mysql isn't supported?
   I'm currently rewriting this lambda in order to make it work with our aurora-cluster. Issues i faced were different logging than the mariadb_audit_plugin (https://aws.amazon.com/blogs/database/auditing-an-amazon-aurora-cluster/)

• different naming of audit-files that doesn't change when rotated (e.g. audit/audit.log.3.2023-04-19-10-58.10986 instead of audit/server_audit.log)
• rotation will happen if files reach a size of 100MB.
• timestamps inside the file are Unix instead of a date (e.g. "1594722602000000" instead of "20200714 10:30:02")

3. are there pull-requests accepted from outside your organization?
   Then I would create an pull-request to merge some of my changes back in order to support aurora-mysql.

Best Regards.

It seems like this project is no longer maintained but I'm looking to receive the past hour of logs after this function gets triggered by an SNS topic. I can fork this repo, and make the changes for it to accept either dynamo or a timestamp as a parameter. I would then make a PR back to this repo.

I can also just fork it and strip out the dynamo stuff and leave it as a fork