Audit logging + Run log correlation should be consumable as one stream of data

For our client, we’re needing to do a good deal of work to create a reliable audit trail of what happened in the client’s IaC workflow for compliance purposes. We need to do the following:

1. Collect the audit logs (who did what when inside Spacelift) and retain them outside of Spacelift because of Log retention period greater than 60 days

2. We need then to also collect all of the Run logs (init, plan, and apply information)

3. We then need to correlate these two streams to ensure we can trace that the Audit logs match up to a given Run so we can easily trace the full picture.

We would expect that to be one stream of data because those things are tightly coupled together and particularly when you’re talking about auditing a concerning set of actions… these need to be correlated.