Audit log export

Organization admins can continuously export audit events to a customer-owned S3-compatible or Google Cloud Storage bucket. Open Settings → Audit log export, choose a destination, and save it. Avrea validates the configuration with a real marker write before storing it.

Exports are gzip-compressed NDJSON. The first successful run backfills the organization's existing audit history; later runs normally arrive within ten minutes. Buckets may be append-only: Avrea requires object-create permission, but not delete or overwrite permission.

Amazon S3

The recommended authentication mode uses short-lived credentials rather than an access key:

1. Select S3 → Assume AWS role and enter the bucket, prefix, and AWS region.
2. In AWS, create an IAM role using the trust policy shown in the Avrea console. Its Google subject and OIDC audience are specific to the Avrea environment and organization; copy them exactly.
3. Attach the permission policy shown in the console. It grants only s3:PutObject for the configured bucket and prefix.
4. If the bucket uses a customer-managed KMS key, grant that role the matching encryption permissions in the KMS key policy.
5. Paste the role ARN into Avrea and save.

Avrea mints a Google OIDC token, exchanges it with AWS STS using AssumeRoleWithWebIdentity, and uses the temporary credentials for the probe and exports. No long-lived AWS key is stored.

Access-key authentication is also available for AWS and public S3-compatible endpoints. The credential needs PutObject permission. Custom endpoints must use HTTPS and resolve only to public IP addresses.

Google Cloud Storage

The recommended authentication mode uses Avrea's service account:

1. Select Google Cloud Storage → Avrea service account.
2. Add the bucket label shown in the console: avrea-audit-export-org=<ORGANIZATION_ID>.
3. Grant the displayed Avrea service account storage.buckets.get and storage.objects.create on that bucket. A custom role containing only those permissions is sufficient.
4. Save the destination. Avrea verifies the organization label before every probe and export, preventing the shared principal from writing to a bucket configured for another organization.

Alternatively, provide a Google service-account JSON key with storage.objects.create. Avrea encrypts the key at rest and accepts only Google's canonical OAuth token endpoint in the credential.

Delivery and recovery

Each NDJSON line contains one audit event, including its stable event_id. Delivery is at least once. Uploads never overwrite an existing object, but a crash or destination revision change can replay an overlapping event range under a different object name. Downstream ingestion should deduplicate by event_id.

Avrea advances the export watermark only after a successful upload. Failed probes and uploads appear in organization settings. After 50 consecutive failures the destination is disabled and organization admins are notified; fix the bucket, permissions, role trust, or credentials and re-enable it to continue from the stored watermark.

Removing a destination also removes its credentials and watermark. Recreating it starts a new full-history backfill.