HIPAA audit logging

For workspaces that use the compliance security profile with the HIPAA standard, Lakebase captures audit events and delivers them to the audit log system table at system.access.audit in Unity Catalog. This page explains what is logged, how to query it, and the fields that identify Lakebase events.

Audit log types

Lakebase captures three categories of audit events:

Log type	What it captures
Console audit logs	Actions that users take in the Lakebase UI, such as creating a project or a branch.
API audit logs	Requests to the Lakebase control plane, such as API calls that create or modify projects, branches, and endpoints.
Postgres audit logs	SQL-level activity inside the database, captured by pgaudit, the open source Postgres audit logging extension. This includes DDL, role changes, and data access.

Log type	What it captures
Console audit logs	Actions that users take in the Lakebase UI, such as creating a project or a branch.
API audit logs	Requests to the Lakebase control plane, such as API calls that create or modify projects, branches, and endpoints.
Postgres audit logs	SQL-level activity inside the database, captured by pgaudit, the open source Postgres audit logging extension. This includes DDL, role changes, and data access.

Where audit logs are delivered

Audit events are delivered to the audit log system table at system.access.audit in Unity Catalog. Records are associated with the workspace where the activity occurred. Because the audit log for a compliance security profile workspace flows into a Unity Catalog system table, you read and query Lakebase audit events the same way you read other Databricks audit events.

Postgres SQL audit logging

For HIPAA-enabled workspaces, Lakebase applies a fixed pgaudit configuration that you cannot change:

Setting	Value	Effect
pgaudit.log	all, -misc	Logs all statement classes except miscellaneous statements. This covers data definition (DDL), role and privilege changes, reads, writes, and function calls.
pgaudit.log_parameter	off	Statement parameters are not logged.
pgaudit.log_catalog	off	Queries against the system catalogs are not logged.

Setting	Value	Effect
pgaudit.log	all, -misc	Logs all statement classes except miscellaneous statements. This covers data definition (DDL), role and privilege changes, reads, writes, and function calls.
pgaudit.log_parameter	off	Statement parameters are not logged.
pgaudit.log_catalog	off	Queries against the system catalogs are not logged.

Query audit logs

To query Lakebase audit logs, you need:

• A workspace with the compliance security profile and HIPAA enabled. See Enable HIPAA compliance.
• Access to the system.access schema in Unity Catalog. Access to system tables is managed by an account admin. See System tables reference.

Lakebase Postgres audit events are in the system.access.audit table under the service name lakebase. To find these events, filter on service_name = 'lakebase'.

SQL

SELECT
  event_time,
  user_identity.email AS user_email,
  action_name,
  request_params
FROM system.access.audit
WHERE service_name = 'lakebase'
  AND event_date >= current_date() - INTERVAL 7 DAYS
ORDER BY event_time DESC;

note

Filter on event_date rather than event_time to improve query performance. event_date is a partition column.

Audit record fields

Lakebase events use the shared audit log system table schema. The columns most useful for finding and interpreting Lakebase events are service_name and action_name (which identify the event), request_params (the event details), user_identity (who ran the statement), and event_date (a partition column to filter on for query performance). For the complete column schema, including struct field details, see Audit log system table reference.

Lakebase Postgres (pgaudit) events use the service_name value lakebase. The action_name field uses the format <class>.<command>, where <class> is the pgaudit statement class and <command> is the SQL command. Both are lowercased, and spaces are replaced with underscores. For example, a CREATE TABLE statement is recorded as ddl.create_table. The <class> portion is the pgaudit statement class of the operation, such as ddl for data definition, role for role and privilege changes, or function for function calls. Which classes appear depends on the audit level.

For Postgres events, Lakebase populates the following keys in request_params:

Key	Description
class	The pgaudit statement class, such as DDL.
command	The SQL command, such as CREATE TABLE.
objectType	The type of object affected, such as TABLE or ROLE.
objectName	The name of the affected object.
statement	The SQL statement that was run.
statementId	The statement sequence number.
subStatementId	The sub-statement sequence number within the statement.
endpointId	The Lakebase endpoint where the statement ran.

Key	Description
class	The pgaudit statement class, such as DDL.
command	The SQL command, such as CREATE TABLE.
objectType	The type of object affected, such as TABLE or ROLE.
objectName	The name of the affected object.
statement	The SQL statement that was run.
statementId	The statement sequence number.
subStatementId	The sub-statement sequence number within the statement.
endpointId	The Lakebase endpoint where the statement ran.

important

The statement and objectName values can contain the text of your SQL and the names of your database objects. Keep PHI out of query text and object names so that it does not appear in audit logs. See Shared responsibility for PHI.

Audit log retention

The audit log system table retains records for 365 days. To keep Lakebase audit logs longer, export or copy them to your own storage before they age out. See Audit log system table reference.

Next steps

• Enable HIPAA compliance: Turn on compliance support for your projects. See Enable HIPAA compliance.
• HIPAA compliance for Lakebase: Supported standards and shared responsibility. See HIPAA compliance for Lakebase.
• Audit log system table: Learn about the shared audit log system table schema. See Audit log system table reference.