HIPAA audit logging

For workspaces that use the compliance security profile with the HIPAA standard, Lakebase captures audit events and delivers them to the audit log system table at system.access.audit in Unity Catalog. This page explains what is logged, how to query it, and the fields that identify Lakebase events.

Audit log types

Lakebase captures three categories of audit events:

Log type What it captures
Console audit logs Actions that users take in the Lakebase UI, such as creating a project or a branch.
API audit logs Requests to the Lakebase control plane, such as API calls that create or modify projects, branches, and endpoints.
Postgres audit logs SQL-level activity inside the database, captured by pgaudit, the open source Postgres audit logging extension. This includes DDL, role changes, and data access.

Where audit logs are delivered

Audit events are delivered to the audit log system table at system.access.audit in Unity Catalog. Records are associated with the workspace where the activity occurred. Because the audit log for a compliance security profile workspace flows into a Unity Catalog system table, you read and query Lakebase audit events the same way you read other Azure Databricks audit events.

Postgres SQL audit logging

For HIPAA-enabled workspaces, Lakebase applies a fixed pgaudit configuration that you cannot change:

Setting Value Effect
pgaudit.log all, -misc Logs all statement classes except miscellaneous statements. This covers data definition (DDL), role and privilege changes, reads, writes, and function calls.
pgaudit.log_parameter off Statement parameters are not logged.
pgaudit.log_catalog off Queries against the system catalogs are not logged.

Query audit logs

To query Lakebase audit logs, you need:

  • A workspace with the compliance security profile and HIPAA enabled. See Enable HIPAA compliance.
  • Access to the system.access schema in Unity Catalog. Access to system tables is managed by an account admin. See System tables reference.

Lakebase Postgres audit events are in the system.access.audit table under the service name lakebase. To find these events, filter on service_name = 'lakebase'.

SELECT
  event_time,
  user_identity.email AS user_email,
  action_name,
  request_params
FROM system.access.audit
WHERE service_name = 'lakebase'
  AND event_date >= current_date() - INTERVAL 7 DAYS
ORDER BY event_time DESC;

Note

Filter on event_date rather than event_time to improve query performance. event_date is a partition column.

Audit record fields

Lakebase events use the shared audit log system table schema. The columns most useful for finding and interpreting Lakebase events are service_name and action_name (which identify the event), request_params (the event details), user_identity (who ran the statement), and event_date (a partition column to filter on for query performance). For the complete column schema, including struct field details, see Audit log system table reference.

Lakebase Postgres (pgaudit) events use the service_name value lakebase. The action_name field uses the format <class>.<command>, where <class> is the pgaudit statement class and <command> is the SQL command. Both are lowercased, and spaces are replaced with underscores. For example, a CREATE TABLE statement is recorded as ddl.create_table. The <class> portion is the pgaudit statement class of the operation, such as ddl for data definition, role for role and privilege changes, or function for function calls. Which classes appear depends on the audit level.

For Postgres events, Lakebase populates the following keys in request_params:

Key Description
class The pgaudit statement class, such as DDL.
command The SQL command, such as CREATE TABLE.
objectType The type of object affected, such as TABLE or ROLE.
objectName The name of the affected object.
statement The SQL statement that was run.
statementId The statement sequence number.
subStatementId The sub-statement sequence number within the statement.
endpointId The Lakebase endpoint where the statement ran.

Important

The statement and objectName values can contain the text of your SQL and the names of your database objects. Keep PHI out of query text and object names so that it does not appear in audit logs. See Shared responsibility for PHI.

Audit log retention

The audit log system table retains records for 365 days. To keep Lakebase audit logs longer, export or copy them to your own storage before they age out. See Audit log system table reference.

Next steps

  • Last updated on