Day 67: Create Audit Trails for Log Access
What We’re Building Today
An immutable audit event pipeline that captures every log access operation in real time
An append-only PostgreSQL schema that cryptographically prevents record tampering
A Kafka-backed audit stream that decouples access tracking from request handling
A compliance query API exposing audit history with RBAC-protected endpoints
Why This Matters
Every log record in a production system is potential evidence — for compliance audits, incident post-mortems, and security investigations. But most teams only discover they need audit trails after a breach or an SOC 2 audit request lands on their desk.
The problem isn’t storing the logs themselves. It’s answering: who accessed those logs, when, from where, and what did they see? GDPR Article 32, HIPAA §164.312(b), and PCI DSS 10.2 all mandate exactly this. Netflix runs dedicated audit infrastructure that processes hundreds of millions of access events daily across its data platform. At Uber, every sensitive data query is tagged, tracked, and linked to an on-call incident or an engineer’s identity before it reaches the data layer.
The architectural insight here is critical: audit trails must be causally decoupled from the system they audit. An audit system that can be bypassed by the very service it monitors is useless. Your audit pipeline needs to be as resilient — if not more — than the services feeding it.
System Design Deep Dive
Preparing for a distributed systems interview?
→Download the free Interview Pack
→ Subscribe now to access source code repository - 200 + coding lessons
