1

For audit reasons, I need to produce a list of all deployments in our production org, including both change set deployments and API deployments. The Deployment Status page in Setup shows the necessary information, but only contains a very limited number of deployments so that the list only goes back about one month. I would need it to last for at least one year so that I can pull up the list in an audit session.

Using the Shield feature Event Monitoring I was able to produce a list of deployments. We use an integration with the logging tool Splunk to store Event Log File data there. The event types ChangeSetOperation and MetadataApiOperation contain most of the information I need: timestamp, user, change set name, validation vs. deployment etc. But I cannot figure out if a deployment was successful or not. The list contains failed deployments, and I want to avoid this.

Is there a way to produce a permanent/long-lived list of all successful deployments, using Event Monitoring or in another way?

It should be done in a way that a Salesforce administrator cannot manipulate it so that it holds up under scrutiny in an audit.

1

The approach I would use (and we use it in our org) is to adopt a vendor Dev Ops tool like Gearset (tool we use), Copado, Blue Canvas, ...

These tools keep track of every deploy done between source/target where source/target can be an org, scratch org, or VCS

The deployment can be tied to your story (e.g. JIRA), is datetime-stamped, includes who ran the deployment, identifies every piece of metadata changed (old/new values) and can be maintained for the length of your subscription

2
  • Thanks for the answer. I was also thinking that this might be the way forward (maybe Jenkins?). To make sure the deployment list is complete, you would have to remove admin permissions in production from most users, isn't it? Otherwise someone could still deploy directly in the org. – georg w. Jun 22 '20 at 16:50
  • Correct. Remove customize application permission – cropredy Jun 22 '20 at 17:34
0

You might have already looked at this but you can get all successful changes made to the Metadata (and then some) using the Setup Audit Trial for the last 6 months.

https://developer.salesforce.com/docs/atlas.en-us.securityImplGuide.meta/securityImplGuide/admin_monitorsetup.htm

I do realize that this is not the entire year that you are asking for but it is a start. There is a fair amount of digging around that you need to do to filter down to just metadata changes but it will be immutable with timestamps.

1
  • Thanks Sridhar. I looked into the audit trail, but the problem is that it shows you the individual components that were changed, but not the deployments (i. e. a change set or api deployment). So it is very granular, but does not show you what change belongs to a specific deployment.The 6 month limit is not a huge problem because I could download and archive it in a monitored way. – georg w. Jun 19 '20 at 7:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.