Audit Log Service  ·  View 01 of 40  ·  1 · Context and scope

System Context

Who writes to the audit log, who reads it, who checks it — and which custody is deliberately held by somebody else.

Editable source SVG draw.io All views
Producers — write only Business Applications 410 services Admin Consoles privileged actions Platform Services IAM, payments, HR Azure Activity Log cloud control plane People it serves Platform Operator runs it, reads nothing Investigator read within scope Compliance Officer read, export, hold Legal Hold Officer segregated role External assurance External Auditor trusts nothing Regulator evidence on demand Independent Witnesses RFC 3161 TSA · Rekor Audit Log Service capture · custody · disposal Custody held elsewhere — deliberately Confidential Ledger separate subscription Managed HSM non-exportable keys Microsoft Entra ID workload identity operates queries exports places holds POST events POST events stream diagnostics verifies offline signed bundles anchors heads chain heads signs heads authenticates Audit Log Service — System Context External / third party Person or role Data store Security / platform synchronous event / async Out of scope: application and operational logging, SIEM detection and correlation, and the business records themselves. Regulators receive evidence through the auditor's bundle, not through an interface of their own. v 1.0 · owner Data & AI Global Practice · date 2026-09

Decisions

  • This is not application logging. Operational logs may be sampled, rewritten and dropped; nothing here may be, and conflating the two is the failure this service exists to prevent.
  • The checkpoint ledger and the signing key sit outside the service's own subscription and under different administrators. That is not defence in depth, it is the mechanism: no single compromised administrator can rewrite both the records and the evidence about the records.
  • Producers are write-only at the interface level. There is no read scope a producer credential can be granted.

Stack — retargeted

  • The requirement names Amazon Web Services; this architecture is built on Microsoft Azure and open source at the sponsor's direction.
  • Substitutions: S3 Object Lock → Blob immutable containers with a locked time-based retention policy; Kinesis → Apache Kafka (Strimzi on AKS); KMS/CloudHSM → Key Vault Managed HSM; Athena → Trino; OpenSearch → ClickHouse; QLDB → Azure Confidential Ledger.
  • The requirement was written to survive a change of cloud, and it did: only technology names moved, no property did.

Assumptions

  • 500 tenants, 410 producing services, ~2.2 billion events/day, 25 k/s steady and 100 k/s burst — all as stated in the requirement.
  • The timestamp authority is an external commercial TSA, not one this organisation runs; a TSA we operate would defeat the point of having one.
  • Regulators receive evidence through the auditor's bundle rather than through an interface of their own.
All views High-Level Architecture  ▶
Solution Architecture v1.0 · Data & AI Global Practice · 2026-09 · 40 views · Microsoft Azure and open source01-system-context