We've shipped a batch of updates to Cerbos Hub. The big one is that you can now get your audit logs out of Hub and into your own tooling. The rest is the playground being specific about what's broken in your policies instead of leaving you to guess.
Take your audit logs with you
Hub has collected decision and access logs for a while now, and the question we kept getting was some version of "great, how do I get these into my own systems?" Long-term archiving, a compliance ask, a warehouse someone wants to run queries against. All fair.
There's now an Export button on the Audit logs page.
It uses the time range and filters you have already applied, so you get the entries you were just looking at instead of a fresh dump you have to re-filter. The export runs in the background, and a new Exports tab tracks it: status, the filters it used, when it expires, and a download button once it's ready.
Exporting is available to workspace and organization owners.
The encryption bit
Every export is encrypted with age before it leaves Hub.
You can supply your own public key, or let Hub generate a key pair when the export starts. If Hub generates it, save the secret key there and then, because we don't keep a copy. (Losing it means losing the export. That's rather the point.)
Expand a row on the Exports tab and it shows you the exact command to decrypt and read the file. Inside you get your log entries as gzip-compressed JSON Lines, which most tooling will chew through without complaint.
Completed exports stay downloadable for 7 days. If one fails, there's a retry button that reuses the same filters.
The playground stops being coy
Two changes here, both fixing the same annoyance: the playground knew something was wrong and wasn't specific enough about it.
Compiler errors now get marked inline on the line that actually caused them, and the Problems panel gives you line and column alongside a fuller description, so you can click straight through to the source.
A pile of problems that used to be reported vaguely (or not at all) now surface properly: invalid expressions in conditions, undefined or redefined variables and constants, unknown and ambiguous derived roles, and trouble with scopes and imports. Where a diagnostic maps to a documented concept, it links out to the relevant policy docs.
The second change is schema validation. If a principal or resource fixture doesn't satisfy the schema attached to your policy, the Explore tab now says so directly beneath the fixture selector.
A schema violation used to quietly bend the outcome, leaving you to work out why your check didn't behave the way you expected. Now the affected actions sit in an undetermined state until you resolve it, which makes it clear you're looking at a fixture problem and not a policy decision. Validation errors on the request itself get reported the same way, above the action results.
Also shipped recently
A few smaller things from the last couple of months:
- Egress IPs in the GitHub wizard. If your GitHub org restricts access with an IP allow list, the connection flow now tells you which addresses Hub connects from. They're also published in machine-readable form at hub.cerbos.cloud/meta if you'd rather keep your allow list up to date automatically.
- Download the policies in a deployment. A zip of the policy files from the deployed build, grouped into a folder per contributing store, so you get an exact copy of what's running and can tell where each policy came from.
- Workspace issues. The issues bar flags blocked API keys, deployments mapped to a new store that haven't activated a build in 15 minutes, and stores failing to sync with GitHub. Each one links through to the page where you can fix it.
Full details for all of it are in the Cerbos Hub release notes.
Tagged in
