Authorizaion Policy Logs

Security
1

Hi ,
Here I’m using the wrong serviceaccount name in the authorization policy. When i check the istio logs.It doesnt show the name of the authorizationpolicy have wrong configuration it just mention the enforced denied in the logs.
Is there any way to find out the logs which we had the wrong configurations of authorization policy.
Here im adding the configuration and logs below.
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
name: test-policy
namespace: testing
spec:
selector:
matchLabels:
app: fronted
action: ALLOW
rules:

  • from:

    • source:
      principals: [“cluster.local/ns/istio-system/sa/WRONG-SERVICEACCOUNT-NAME”]

    to:

    • operation:
      methods: [“*”]

Logs: ‘x-forwarded-client-cert’, ‘By=spiffe://gto-anthos-poc.svc.id.goog/ns/scrtui/sa/default;Hash=4932672d68f40123f5589cb6cc1218e11fe002d411d98284b2be13809c47d770;Subject=“OU=istio_v1_cloud_workload,O=Google LLC,L=Mountain View,ST=California,C=US”;URI=spiffe://gto-anthos-poc.svc.id.goog/ns/istio-system/sa/istio-ingressgateway-service-account’
, dynamicMetadata:
2023-04-27T15:18:42.243354Z debug envoy rbac enforced denied, matched policy none