What's New in gRPC Security for 2023: Audit Logging and CRL - Andrey Ermolov & Gregory Cooke, Google
summary
gRPC now ships an audit logging extension as the accounting part of AAA that runs after authorization and emits metadata fields like full method name, principal, policy file, matched rule and decision; a built‑in standard out logger prints JSON lines but custom loggers can store elsewhere (beware remote DB latency). CRL support replaces the OpenSSL directory hack with a CRL provider interface that returns in‑memory CRLs (static or periodic reload) during TLS handshakes so certificates are revoked without server restarts.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 2:15Security team principles
- 5:10Zero Trust and AAA
- 7:44Audit logging importance
- 10:36Audit logging design
- 14:53Certificate revocation lists
- 17:03CRL limitations
- 18:53New CRL interface
- 21:00Q&A
related talks
30mSecuring Your Services with Authentication, Authorization, and RBAC in gRPC
22mgRPC and Post-Quantum Cryptography
32mGRC Engineering - Bringing GRC to a repository near you
31mAuthentication and Security in gRPC Microservices
34mgRPC Proxyless Service Mesh with Security
31m📗 Rehearsal is Over: Moving GRC Engineering from Theory into Practice ⚖️
29mThe Security Evolution of GRPC Services in the Mesh
26mFortifying gRPC Microservices: Beyond JWT with mTLS and SPIFFE