auditlog: add DML log configuration

KIKIMR-18697

2 files changed, 21 insertions, 1 deletions

diff --git a/ydb/core/grpc_services/grpc_request_check_actor.h b/ydb/core/grpc_services/grpc_request_check_actor.h
index 2d44277a2b4..9ede1a768de 100644
--- a/ydb/core/grpc_services/grpc_request_check_actor.h
+++ b/ydb/core/grpc_services/grpc_request_check_actor.h
@@ -99,6 +99,7 @@ public:
             TBase::SetPeerName(peerName);
             InitializeAttributes(schemeData);
             TBase::SetDatabase(CheckedDatabaseName_);
+            InitializeAuditSettings(schemeData);
         }
     }
 
@@ -346,8 +347,18 @@ private:
     }
 
 private:
+    void InitializeAuditSettings(const TSchemeBoardEvents::TDescribeSchemeResult& schemeData) {
+        const auto& auditSettings = schemeData.GetPathDescription().GetDomainDescription().GetAuditSettings();
+        DmlAuditEnabled_ = auditSettings.GetEnableDmlAudit();
+        DmlAuditExpectedSubjects_.insert(auditSettings.GetExpectedSubjects().begin(), auditSettings.GetExpectedSubjects().end());
+    }
+
+    bool IsAuditEnabledFor(const TString& userSID) const {
+        return DmlAuditEnabled_ && !DmlAuditExpectedSubjects_.contains(userSID);
+    };
+
     void AuditRequest(IRequestProxyCtx* requestBaseCtx, const TString& databaseName, const TString& userSID) const {
-        const bool dmlAuditEnabled = requestBaseCtx->IsAuditable();
+        const bool dmlAuditEnabled = requestBaseCtx->IsAuditable() && IsAuditEnabledFor(userSID);
 
         if (dmlAuditEnabled) {
             AuditContextStart(requestBaseCtx, databaseName, userSID);
@@ -495,6 +506,8 @@ private:
     bool SkipCheckConnectRigths_ = false;
     std::vector<std::pair<TString, TString>> Attributes_;
     const IFacilityProvider* FacilityProvider_;
+    bool DmlAuditEnabled_;
+    std::unordered_set<TString> DmlAuditExpectedSubjects_;
 };
 
 // default behavior - attributes in schema
diff --git a/ydb/core/protos/subdomains.proto b/ydb/core/protos/subdomains.proto
index cfc5e1f89ee..cd51c78e2af 100644
--- a/ydb/core/protos/subdomains.proto
+++ b/ydb/core/protos/subdomains.proto
@@ -65,6 +65,11 @@ message TDomainState {
     optional bool DiskQuotaExceeded = 1;
 }
 
+message TAuditSettings {
+    optional bool EnableDmlAudit = 1;
+    repeated string ExpectedSubjects = 2;
+}
+
 message TDomainDescription {
     optional fixed64 SchemeShardId_Depricated = 1;
     optional fixed64 PathId_Depricated = 2;
@@ -91,6 +96,8 @@ message TDomainDescription {
     optional TDomainState DomainState = 16;
 
     optional NLoginProto.TSecurityState SecurityState = 20;
+
+    optional TAuditSettings AuditSettings = 21;
 }
 
 message TSchemeQuotas {