Expand audit error message to reference config-based devices (#1740)

cipherboy · web-flow · commit 120da5889bd8 · 2025-08-28T11:37:11.000-04:00
Signed-off-by: Alexander Scheel &lt;ascheel@gitlab.com&gt;
diff --git a/vault/logical_system.go b/vault/logical_system.go
@@ -3141,7 +3141,7 @@ func (b *SystemBackend) handleEnableAudit(ctx context.Context, req *logical.Requ
 	conf := b.Core.rawConfig.Load().(*server.Config)
 
 	if !conf.UnsafeAllowAPIAuditCreation {
-		return handleError(fmt.Errorf("cannot enable audit device via API"))
+		return handleError(fmt.Errorf("cannot enable audit device via API; use declarative, config-based audit device management instead"))
 	}
 
 	if _, hasPrefix := options["prefix"]; hasPrefix && !conf.AllowAuditLogPrefixing {

Original file line number	Diff line number	Diff line change
`@@ -3141,7 +3141,7 @@ func (b SystemBackend) handleEnableAudit(ctx context.Context, req logical.Requ`
`3141`	`3141`	`conf := b.Core.rawConfig.Load().(*server.Config)`
`3142`	`3142`
`3143`	`3143`	`if !conf.UnsafeAllowAPIAuditCreation {`
`3144`		`- return handleError(fmt.Errorf("cannot enable audit device via API"))`
	`3144`	`+ return handleError(fmt.Errorf("cannot enable audit device via API; use declarative, config-based audit device management instead"))`
`3145`	`3145`	`}`
`3146`	`3146`
`3147`	`3147`	`if _, hasPrefix := options["prefix"]; hasPrefix && !conf.AllowAuditLogPrefixing {`