Amazon EKS: Full Request/Response Logging for Compliance

This post demonstrates using Envoy's External Processing (ext_proc) filter on Amazon EKS to capture complete request and response data. This solution provides centralized compliance logic, requires zero application code changes, allows selective capture, and supports data redaction capabilities.

Enterprises running microservices on Amazon EKS often face a compliance gap where metadata like status codes and latency are logged, but the actual request and response bodies—critical for auditors and regulators—are not captured. This can lead to failed audits and regulatory fines.

Full request and response logging is crucial for various scenarios, including financial services verifying cardholder data handling and healthcare organizations demonstrating audit trails for protected health information (PHI). Metadata alone is insufficient to answer detailed audit questions.

Existing methods like application-level logging, custom C++ Envoy filters, Lua scripting, and some API gateways present significant trade-offs. These include code duplication, maintenance burdens, complex build pipelines, scalability issues, and increased operational complexity.

The architecture involves an EKS cluster with Istio, where Envoy sidecar proxies establish a bidirectional gRPC stream to an external processing service. This service captures request headers, body, response headers, and body before Envoy forwards the request to the application, consolidating the data for audit trails.

To minimize latency impact, the external processing service uses an asynchronous logging pattern. The gRPC handler quickly sends data to a buffered channel, and a background worker asynchronously writes the consolidated audit logs, ensuring data integrity without blocking request processing.