Add the user.cert.create event

api/types/events/events.proto

@@ -1673,6 +1673,27 @@ message WindowsDesktopSessionEnd {
     map<string, string> DesktopLabels = 8 [ (gogoproto.jsontag) = "desktop_labels" ];
 }
 
+// UserCertificateCreate is emitted when a user certificate pair (X.509+SSH) is issued.
+message UserCertificateCreate {
+    // Metadata is a common event metadata.
+    Metadata Metadata = 1
+        [ (gogoproto.nullable) = false, (gogoproto.embed) = true, (gogoproto.jsontag) = "" ];
+
+    // User is a common user event metadata
+    UserMetadata User = 2
+        [ (gogoproto.nullable) = false, (gogoproto.embed) = true, (gogoproto.jsontag) = "" ];
+
+    // Subject is the string form of the Subject of the X.509 certificate
+    string Subject = 3 [ (gogoproto.jsontag) = "subject,omitempty" ];
+
+    // Expires is the expiration time point of the certificates
+    google.protobuf.Timestamp Expires = 4 [
+        (gogoproto.stdtime) = true,
+        (gogoproto.nullable) = false,
+        (gogoproto.jsontag) = "expires,omitempty"
+    ];
+}
+
 // OneOf is a union of one of audit events submitted to the auth service
 message OneOf {
     // Event is one of the audit events
@@ -1744,6 +1765,7 @@ message OneOf {
         events.PostgresFunctionCall PostgresFunctionCall = 65;
         events.AccessRequestDelete AccessRequestDelete = 66;
         events.SessionConnect SessionConnect = 67;
+        events.UserCertificateCreate UserCertificateCreate = 68;
     }
 }
 

api/types/events/oneof.go

@@ -305,6 +305,10 @@ func ToOneOf(in AuditEvent) (*OneOf, error) {
 		out.Event = &OneOf_AccessRequestDelete{
 			AccessRequestDelete: e,
 		}
+	case *UserCertificateCreate:
+		out.Event = &OneOf_UserCertificateCreate{
+			UserCertificateCreate: e,
+		}
 	default:
 		return nil, trace.BadParameter("event type %T is not supported", in)
 	}

lib/auth/auth.go

@@ -1012,6 +1012,22 @@ func (a *Server) generateUserCert(req certRequest) (*proto.Certs, error) {
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
+
+	if a.emitter.EmitAuditEvent(a.closeCtx, &apievents.UserCertificateCreate{
+		Metadata: apievents.Metadata{
+			Type: events.UserCertificateCreateEvent,
+			Code: events.UserCertificateCreateCode,
+		},
+		UserMetadata: apievents.UserMetadata{
+			User:         identity.Username,
+			Impersonator: identity.Impersonator,
+		},
+		Subject: subject.String(),
+		Expires: certRequest.NotAfter,
+	}); err != nil {
+		log.WithError(err).Warn("Failed to emit user certificate create event.")
+	}
+
 	return &proto.Certs{
 		SSH:        sshCert,
 		TLS:        tlsCert,

lib/events/api.go

@@ -180,6 +180,9 @@ const (
 	// UserPasswordChangeEvent is when the user changes their own password.
 	UserPasswordChangeEvent = "user.password_change"
 
+	// UserCertificateCreateEvent is emitted when a user certificate pair (X.509+SSH) is issued.
+	UserCertificateCreateEvent = "user.cert.create"
+
 	// UserExpires is when the user will expire.
 	UserExpires = "expires"
 

lib/events/codes.go

@@ -302,6 +302,8 @@ const (
 	// RecoveryCodeUseFailureCode is an event code for when a
 	// recovery code was not used successfully.
 	RecoveryCodeUseFailureCode = "T1009W"
+	// UserCertificateCreateCode is the user certificate pair issuance code.
+	UserCertificateCreateCode = "T1010I"
 
 	// BillingCardCreateCode is an event code for when a user creates a new credit card.
 	BillingCardCreateCode = "TBL00I"

lib/events/dynamic.go

@@ -482,6 +482,12 @@ func FromEventFields(fields EventFields) (apievents.AuditEvent, error) {
 			return nil, trace.Wrap(err)
 		}
 		return &e, nil
+	case UserCertificateCreateEvent:
+		var e events.UserCertificateCreate
+		if err := utils.FastUnmarshal(data, &e); err != nil {
+			return nil, trace.Wrap(err)
+		}
+		return &e, nil
 	default:
 		return nil, trace.BadParameter("unknown event type: %q", eventType)
 	}