Starburst (Trino) Query Audit Logs
Starburst (Trino) query audit logs is a feature that audits queries that users run natively in Starburst (Trino) and presents them in a universal format as Immuta audit logs. Users can view audit records for queries made in Starburst (Trino) against Immuta data sources on the audit page. Immuta audits the activity of Immuta users on Immuta data sources.
Requirements
Starburst (Trino) integration with the Starburst or Trino plugin version 443 or newer, or Trino 435 with the Immuta Trino 435.1 plugin
Starburst (Trino) users registered as Immuta users: Note that the users' Starburst (Trino) usernames must be mapped to Immuta. Without this, Immuta will not know the users are Immuta users and will not collect audit events for their data access activity.
Store audit logs
By default Starburst (Trino) audit logs expire after 90 days. Export the universal audit model (UAM) logs to S3 or ADLS Gen 2, and store audit logs outside of Immuta in order to retain the audit logs long-term.
Audit schema
Each audit message from the Immuta platform will be a one-line JSON object containing the properties listed below.
Example audit record
Limitations
objectsAccessed
is not available with Hive or Iceberg views.columnsAccessed
will include columns related to the query that were not actually accessed in some cases:For row access policies that rely on a column in the queried table, even if that column was not a part of the query, it will be included in the
columnsAccessed
.For conditional masking, if the policy protects a column accessed, then the conditional column will be included in the
columnsAccessed
.
Last updated