Vault file audit log availability behaviour

Vault
1

Hello! Tested with version 1.18.4, 1.19.5, 1.21.2

As mentioned in documentation, it’s very important to have properly working audit device and if device is unavailable Vault stop process the request.

Topic: Availability of audit devices

So, with single node i created audit device.

vault audit device enable file file_path=/vault/audit.log

Then I have tried to:

chown root:root /vault/audit.log

chmod 000 /vault/audit.log

and finally

rm -rf /vault/audit.log

And Vault still was working.

vault secrets enable …

vault kv list …

vault kv get …

vault kv put …

After reboot service and unseal process empty file automatically recreated.

Changes that i made with deleted audit file in Vault was applied.

So, as i understand in case of audit type file, there is no protection for audit?

As like as checks - file exists, RW available etc.

2

To confirm my understanding of your question - you are concerned that you can delete the file that audit logs are being written too? And once deleted Vault continues to operate against the information from the docs saying if an audit device is not available, it should halt operations?