unbridled-41 opened a new issue, #5978:
URL: https://github.com/apache/rocketmq-dashboard/issues/5978
### Studio Version
branch: `rocketmq-studio` @ `7e7aa344`
### Runtime Environment
Backend tests: `cd server && mvn -o -B -ntp test
-Dtest='InstanceServiceTest'`.
### Describe the Bug
The cloud import records its audit row as `("IMPORT_CLOUD_INSTANCES",
"INSTANCE", String.valueOf(credentialId), ...)`, but the number is a
cloud-credential primary key. The audit timeline is a strict (resource_type,
resource_name) lookup, so the import appears on whatever instance carries that
id (labelled "Instance") and is missing from the credential's own history - the
place an auditor looks for what was done with it. Every other audit of this
service uses a real entity id under its own type.
### Steps to Reproduce
Import cloud instances with credential id 12, then open instance id 12's
audit timeline and credential 12's timeline.
### What Did You Expect to See?
The import recorded against the credential.
### What Did You See Instead?
False attribution to an instance, and a blind spot on the credential.
### Impact
Audit forensics are misattributed for a privileged operation.
### Acceptance Criteria
The import audit is recorded as (`IMPORT_CLOUD_INSTANCES`,
`CLOUD_CREDENTIAL`, credential id) and the existing assertions pin it.
**Corresponding PR:** #ISSUEPR#
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
