sap-btp-audit-loglisted

# SAP BTP Audit Log Service Tamper-proof audit trails for SAP BTP applications — compliance, security, forensics. ## Prerequisites - SAP BTP subaccount with Cloud Foundry enabled - CF CLI installed and logged in (`cf login`) - Audit Log Viewer entitlement on subaccount (free or standard plan) - CAP project with `@sap/cds` ≥ 7.x (for code-level audit logging) - Subaccount Auditor role for viewing logs ## 1. Create and Bind the Audit Log Service ```bash # Create service instance cf create-service auditlog standard my-auditlog # Bind to your application cf bind-service my-app my-auditlog # Restage to pick up VCAP_SERVICES cf restage my-app ``` ## 2. Log Audit Events in CAP ```javascript const cds = require('@sap/cds') module.exports = class OrderService extends cds.ApplicationService { async init() { this.after(['CREATE','UPDATE','DELETE'], 'Orders', (data, req) => { req.audit({ category: 'data-modification', object: { type: 'Order', id: data.ID }, user: req.user.id, tenant: req.tenant, attributes: [{ name: 'event', value: req.event }] }) }) await super.init() } } ``` **Audited event categories:** - **Authentication** — login, token refresh, MFA - **Authorization** — role assignment, scope grant - **Data access** — read sensitive entity, export - **Data modification** — CREATE, UPDATE, DELETE on audited entities - **Configuration changes** — service bindings, destination changes - **Admin operations**