Docs Home Pulumi IaC Pulumi ESC Pulumi Insights Pulumi Cloud Packages Tutorials
  1. Docs
  2. Pulumi ESC
  3. Administration
  4. Audit Logs

Pulumi ESC audit logs

    Audit Logs are available to organizations using the Enterprise and Business Critical editions. To learn more about editions, visit the pricing page.

    Audit logs enable you to track the activity of users within your ESC environments. Logs are immutable and record all user activity, providing critical visibility for security and compliance in your organization.

    ESC audit logs allow you to:

    • Monitor who accessed or modified secrets
    • Track environment creation and configuration changes
    • Ensure compliance with security policies
    • Provide attributable records for security forensics

    All ESC activities are recorded in Pulumi Cloud audit log system, capturing the timestamp, user identity, specific action taken, and source IP address for each event. You can download a CSV format or use Pulumi Cloud REST for exporting audit log events.

    View Audit Logs

    To view audit logs as an organization admin:

    1. Navigate to the organization’s Settings tab.
    2. Navigate to Audit Logs tab.

    This will show the most recent events in descending order. You can also filter logs by a particular user by selecting their profile picture.

    View ESC audit logs in the ESC console

    ESC audit log events

    EventDescription
    Environment Createdrecords the creation of an environment, including the timestamp, name, login, and description
    Environment Updatedrecords the updating of an environment, including the timestamp, name, login, and description
    Environment Deletedrecords the deletion of an environment, including the timestamp, name, login, and description
    Environment Openrecords the opening of an environment, including the timestamp, name, login, and description
    Environment Readrecords the reading of an open environment, including the timestamp, name, login, and description
    Environment Read Openrecords the opening and reading of an environment, including the timestamp, name, login, and description
    Environment Unauthorized Openrecords the attempt to open an environment the user does not have permission to, including the timestamp, name, login, and description
    Environment Tag Createdrecords the creation of an environment tag, including the timestamp, name, login, and description
    Environment Tag Updatedrecords the updating of an environment tag, including the timestamp, name, login, and description
    Environment Tag Deletedrecords the deletion of an environment tag, including the timestamp, name, login, and description
    Environment Version Retractedrecords the retracting of an environment version, including the timestamp, name, login, and description
    Environment Version Tag Openrecords the opening of an environment at a specific version tag, including the timestamp, name, login, and description
    Environment Version Tag Createdrecords the creation of an environment version tag, including the timestamp, name, login, and description
    Environment Version Tag Readrecords the reading of an environment version tag, including the timestamp, name, login, and description
    Environment Version Tag Updaterecords the updating of an environment version tag, including the timestamp, name, login, and description
    Environment Version Tag Deleterecords the deletion of an environment version tag, including the timestamp, name, login, and description
    Environment Decryptedrecords the decryption of an environment, including the timestamp, name, login, and description
    Environment Clonerecords the cloning of an environment, including the timestamp, name, login, and description
    Environment Restoredrecords the restoring of an environment, including the timestamp, name, login, and description
    Environment Schedule Createdrecords the creation of an environment schedule, including the timestamp, name, login, and description
    Environment Schedule Updatedrecords the updating of an environment schedule, including the timestamp, name, login, and description
    Environment Schedule Deletedrecords the deletion of an environment schedule, including the timestamp, name, login, and description
    Environment Rotatedrecords the rotation of secrets in an environment, including the timestamp, name, login, and description

    For a full list of Pulumi Cloud audit log events see the Pulumi Cloud audit logs documentation.

    Automating and manually exporting logs

    Pulumi ESC leverages the same audit log infrastructure as the Pulumi Cloud platform. For detailed information on exporting, and managing audit logs, see the Pulumi Cloud Audit Logs documentation.

      PulumiUP May 6, 2025. Register Now.