KMS Auditability

All KMS operations are logged for compliance and forensics.

Logged events

Key lifecycle

• key.created
• key.rotated
• key.suspended
• key.destroyed
• key.imported

Cryptographic operations

• key.encrypt
• key.decrypt
• key.sign
• key.verify
• key.wrap
• key.unwrap

Access events

• key.accessed
• key.denied
• policy.evaluated

Event structure

{
	"eventId": "uuid",
	"eventType": "key.encrypt",
	"timestamp": "2024-01-15T10:30:00Z",
	"tenantId": "tenant-uuid",
	"actor": {
		"type": "service",
		"id": "service-uuid"
	},
	"resource": {
		"type": "key",
		"id": "key-uuid",
		"version": 3
	},
	"request": {
		"contextKeys": ["purpose:storage"]
	},
	"result": "success"
}

Retention

• Default: 90 days
• Extended retention add-ons available
• Immutable storage

Export

Events exportable to:

• SIEM systems
• S3-compatible storage
• Webhook endpoints

Compliance mapping

Requirement	KMS Audit Support
SOC 2	Full event logging
PCI DSS	Key access tracking
HIPAA	Access audit trails
GDPR	Data access logging