[brentshulman-silkline]

Summary

Adds a kernel_audit_log_export_destination resource for the org-level S3 destination that Kernel continuously exports audit logs to.

• Attributes: bucket, region, prefix, role_arn (required); optional kms_key_id and status (active/paused); type (s3) and format (jsonl.gz) default and force replacement; computed id, external_id, and kernel_role_arn. Import by canonical ID.
• external_id and kernel_role_arn are exposed so the customer role's trust policy can be built in the same configuration. The example outputs that trust policy.
• Kernel creates destinations paused. The intended flow is: apply with status = "paused", attach the trust policy, verify access, then set status = "active" and apply again. A destination configured as active at create time is created and then activated; if activation fails, the created destination stays in state with an error explaining how to finish without replacement.
• Kernel strips trailing slashes from prefix; the configured spelling is kept in state when equivalent.
• Omitting status leaves it unmanaged, so a new destination stays paused. Removing kms_key_id sends "", which the API treats as clearing the key.
• Delivery-health fields (consecutive_failures, last_error*, last_exported_cursor, last_success_at, next_attempt_at) stay out of state to avoid drift. Audit-log search, chunk download, and the destination test endpoint stay out of the client, and a test guards that.
• A 403 is reported with a hint about the organization-scoped key and plan requirement.
• No SDK bump: AuditLogExportDestinationService is already in v0.99.0.
• docs/architecture.md narrows the audit-log non-goal: search and download remain out of scope; durable export configuration is in.
• Acceptance adds an eighth matrix job, which needs new repository secrets KERNEL_AUDIT_EXPORT_BUCKET, KERNEL_AUDIT_EXPORT_REGION, and KERNEL_AUDIT_EXPORT_ROLE_ARN. Locally the test skips when they are unset.

Testing

• go test -short ./..., go vet ./..., gofmt, terraform fmt -check -recursive examples, scripts/check-examples.sh, scripts/check-docs.sh, and scripts/check-markdown-links.sh pass locally.
• Unit tests cover schema flags and validators, create/update request bodies (including clearing the KMS key and activating after create), flattening without runtime fields, missing-field rejection, 404 removal, ID-mismatch guards, and create error classification.
• TestAccAuditLogExportDestinationLifecycle has not been run against a live API yet. It needs an S3 bucket and a role that trusts Kernel. Two behaviours it should confirm:
  • whether Kernel normalizes kms_key_id (alias to ARN, for example), which would show as a perpetual diff;
  • whether Kernel ever changes status on its own (for example auto-pausing after repeated failures), which would show as drift when status is set in configuration.

---

Note

Medium Risk
Introduces org-level configuration for audit log export and AWS cross-account role assumptions; incorrect trust or activation timing could block delivery, though scope is limited to durable destination CRUD with extensive tests.

Overview
Adds kernel_audit_log_export_destination, a fourth managed resource for org-scoped continuous audit-log export to S3 via a customer IAM role. Terraform exposes computed external_id and kernel_role_arn (the example outputs a trust policy), supports optional status (active/paused) with a create-then-activate flow when Kernel returns destinations paused, and import by canonical ID. type/format default and force replacement; delivery-health API fields stay out of state; runtime audit APIs remain excluded from the client.

Wires AuditLogExportDestinationService through kernelclient, registers the resource on the provider, and extends docs, README, architecture boundaries, an example, and acceptance/release checklists. CI gains an eighth acceptance matrix job with required secrets KERNEL_AUDIT_EXPORT_*; local acceptance skips when those are unset.

^{Reviewed by Cursor Bugbot for commit 24fd75d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 32752b9. Configure here.}

[sjmiller609]

Looks good, just asking to apply this patch, then we can get it in. Thank you!

24fd75d