Skip to navigation
Build appsAdd or edit dataSigma tablesSigma table audit logging

Configure audit logging for Sigma tables (Beta)

View as Markdown

This documentation describes one or more public beta features that are in development. Beta features are subject to quick, iterative changes; therefore the current user experience in the Sigma service can differ from the information provided in this page.

This page should not be considered official published documentation until Sigma removes this notice and the beta flag on the corresponding feature(s) in the Sigma service. For the full beta feature disclaimer, see Beta features.

Configure Sigma table audit logging on a connection to keep a history of Sigma table edits in your data platform. Each audit log entry records the user who made a specific data or schema edit, when the edit occurred, and what it changed.

To use Sigma table audit logs on a connection, you must complete the following:

To manage user access required to view audit logs, see Configure access for organization-wide Sigma tables. For information about creating new audit logs and viewing existing ones, see Audit changes to Sigma tables.

Requirements

To configure audit logging for Sigma tables:

  • You must be assigned the Admin account type.
  • Write access must be enabled on the connection.
  • You must have permission in your data platform to grant access on the audit log schema.

By enabling Sigma table audit logs, Customers understand and agree that (a) Sigma table audit logs are maintained in the Customer’s Data Warehouse, and Sigma will access and make entries to these audit logs to reflect the edits made to the corresponding Sigma tables by Customer (or its User); (b) Customers are solely responsible for properly configuring Sigma tables and Sigma table audit logs, including access, impersonation, and write permissions for Sigma tables and Sigma table audit logs; and (c) Customers should regularly review and audit their Sigma table audit logs to ensure their accuracy and integrity.

Configure a shared identity for audit logging

To enable Sigma table audit logs, a shared identity (e.g., service account, service principal, or user) must be configured on the connection. Sigma uses the shared identity to create and write to the audit logs, and to delete materialized tables used for bulk edit actions.1

  • For a non-OAuth connection, Sigma already authenticates using a shared identity, so no additional configuration is needed.
  • For an OAuth connection, Sigma uses each user’s own identity to authenticate, so a shared identity might not be configured. To configure a shared identity, see the following guidance based on your connection type:

1

Bulk edit actions (single actions that insert, update, or delete multiple rows in a Sigma table) write edits to materialized tables in your data platform before applying them to the Sigma table. For bulk edits, the audit log records the name of the materialized table in the EDIT column (see Audit log entry columns). For more information about materialized tables for bulk edit actions, see Create actions that modify Sigma table data.

Enable audit logging on the connection in Sigma

Enable audit logging for Sigma tables on the connection, then define the audit log destination schema.

  1. In the Sigma header, click your user avatar to open the user menu.

  2. Select Administration to open the Administration portal.

  3. In the side panel, select Connections to view a list of available connections, then select the connection you want to configure.

  4. In the connection overview, click Edit.

  5. In the Write access section, configure the Sigma table audit log settings as needed:

    1. Turn on the Enable audit logs toggle to make audit logs available to all Sigma tables on the connection.
    2. Turn on the Auto-create audit logs toggle to automatically create an audit log for every new Sigma table. Keep the toggle off to separately control audit log creation for each Sigma table.

  6. Specify the audit log destination schema. Use one other than your connection’s configured write schema to ensure you can browse Sigma tables in the data catalog.

    The fields labels depend on your connection type:

    ConnectionFields
    SnowflakeAudit log database and Audit log schema
    DatabricksAudit log catalog and Audit log schema
    PostgreSQLAudit log schema only

  7. Click Save.

Grant access to the audit log schema

Grant the shared identity the ability to create and write to audit logs as database tables in the audit log schema.

Select the tab for your connection type to view the relevant data platform guidance. Code comments reference DDL and DML operations; see Key terms for definitions.

Grant service account permissions in Snowflake

In Snowflake, grant the connection’s service account USAGE and CREATE TABLE on the audit log schema, and USAGE on its parent database. For detailed instructions, see the GRANT command reference in the Snowflake documentation.

The following example grants USAGE to the SIGMA_SERVICE role on the ANALYTICS_DB database and AUDIT_LOGS schema, then also grants CREATE TABLE on the schema.

-- Allow the service account's role to create and write audit logs in a schema (DDL: CREATE). Creating a table grants ownership, which includes write access.
GRANT USAGE ON DATABASE ANALYTICS_DB TO ROLE SIGMA_SERVICE;
GRANT USAGE ON SCHEMA ANALYTICS_DB.AUDIT_LOGS TO ROLE SIGMA_SERVICE;
GRANT CREATE TABLE ON SCHEMA ANALYTICS_DB.AUDIT_LOGS TO ROLE SIGMA_SERVICE;