session.command
event hits a ConditionalCheckFailedException
on dynamoevents
#40126
Labels
audit-log
Issues related to Teleports Audit Log
bug
c-ib
Internal Customer Reference
internal-bounty-ineligible
sec-sev-medium
Security Vulnerability - Medium Severity
sec-type-audit
Security Vulnerability - Audit Log Bypass
security
Security Issues
Expected behavior:
session.command
events are stored in the audit log even when using the DynamoDB events backend.Current behavior:
sesssion.command
events fail to get stored, reporting aConditionalCheckFailedException
error from DynamoDB.Bug details:
All
session.command
events are emitted with the session ID of the session they belong to, and an event index of 0. DynamoDB uses (session ID, event index) as a primary key for the event, so prior to #38495 eachsession.command
event overwrote the initialsession.start
event at first, and then all the othersession.command
s that took its place; now we refuse to overwrite events, rejecting the event and storing an error.A similar issue exists for a different event (#39833), suggesting that perhaps we should fix the problem in a more general way rather than chase individual instances of event indexes not being set correctly for a session event.
The text was updated successfully, but these errors were encountered: