1

For audit reasons, I need to produce a list of all deployments in our production org, including both change set deployments and API deployments. The Deployment Status page in Setup shows the necessary information, but only contains a very limited number of deployments so that the list only goes back about one month. I would need it to last for at least one year so that I can pull up the list in an audit session.

Using the Shield feature Event Monitoring I was able to produce a list of deployments. We use an integration with the logging tool Splunk to store Event Log File data there. The event types ChangeSetOperation and MetadataApiOperation contain most of the information I need: timestamp, user, change set name, validation vs. deployment etc. But I cannot figure out if a deployment was successful or not. The list contains failed deployments, and I want to avoid this.

Is there a way to produce a permanent/long-lived list of all successful deployments, using Event Monitoring or in another way?

It should be done in a way that a Salesforce administrator cannot manipulate it so that it holds up under scrutiny in an audit.

Improve this question

2 Answers 2

Reset to default
1

The approach I would use (and we use it in our org) is to adopt a vendor Dev Ops tool like Gearset (tool we use), Copado, Blue Canvas, ...

These tools keep track of every deploy done between source/target where source/target can be an org, scratch org, or VCS

The deployment can be tied to your story (e.g. JIRA), is datetime-stamped, includes who ran the deployment, identifies every piece of metadata changed (old/new values) and can be maintained for the length of your subscription

Improve this answer
2
  • Thanks for the answer. I was also thinking that this might be the way forward (maybe Jenkins?). To make sure the deployment list is complete, you would have to remove admin permissions in production from most users, isn't it? Otherwise someone could still deploy directly in the org.
    – georg w.
    Jun 22, 2020 at 16:50
  • Correct. Remove customize application permission
    – cropredy
    Jun 22, 2020 at 17:34
0

You might have already looked at this but you can get all successful changes made to the Metadata (and then some) using the Setup Audit Trial for the last 6 months.

https://developer.salesforce.com/docs/atlas.en-us.securityImplGuide.meta/securityImplGuide/admin_monitorsetup.htm

I do realize that this is not the entire year that you are asking for but it is a start. There is a fair amount of digging around that you need to do to filter down to just metadata changes but it will be immutable with timestamps.

Improve this answer
1
  • Thanks Sridhar. I looked into the audit trail, but the problem is that it shows you the individual components that were changed, but not the deployments (i. e. a change set or api deployment). So it is very granular, but does not show you what change belongs to a specific deployment.The 6 month limit is not a huge problem because I could download and archive it in a monitored way.
    – georg w.
    Jun 19, 2020 at 7:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .