Actuator Endpoints & Exposure

The endpoint doesn't touch Logback directly. It calls Spring Boot's LoggingSystem abstraction, which has implementations for Logback, Log4j2, and JUL. Boot picks the right one from the classpath, so the endpoint mutates whatever backend is present through one uniform API.

Even for authorized users, /env and /configprops mask sensitive values. By default keys like password, secret, key, token and credentials are shown as '******', and since Boot 3 all values are hidden unless you set show-values to ALWAYS or WHEN_AUTHORIZED. You can add custom SanitizingFunction beans.

Setting management.server.port to a different port than the app moves /actuator off the public port. Bind it to an internal address (management.server.address=127.0.0.1 or a private interface) so only ops/monitoring on the internal network can reach it, adding network-level isolation on top of Spring Security.

Treat the endpoint as sensitive: expose it only behind admin auth (ideally a separate management port), don't rely on the volatile per-node in-memory store for compliance, forward audit events to a durable central store/SIEM, scrub secrets from the data map, and set retention policies.

The health endpoint composes many HealthIndicator/HealthContributor beans into a tree. A StatusAggregator reduces their statuses to one overall status (by default the worst wins, e.g. any DOWN → overall DOWN). Health groups (like readiness, liveness) expose subsets at /actuator/health/{group} for Kubernetes probes.

Actuator scans @Endpoint-annotated beans via EndpointDiscoverers and registers them per technology (web/JMX). A @WriteOperation is a POST that mutates state, so you must both restrict web exposure (not *) and secure it — require an ADMIN role for /actuator/**, and treat it like any mutating API.

Don't expose them publicly. Keep only health public, put diagnostic endpoints behind authentication/authorization, ideally on a separate internal management port, and restrict access to operators. Treat any heap dump as a secret.

The info endpoint can leak build/git details, environment metadata, and (in git full mode) remote URLs and committer emails. Control exposure with management.endpoints.web.exposure.include, protect Actuator with authentication, keep git.mode=simple, and never place secrets in info.* or custom contributors.

It is a state-changing endpoint: anyone who can POST can flip logging to TRACE, causing log floods, performance hits, disk exhaustion, and possible leakage of sensitive data in verbose logs. Protect it behind authentication/authorization, don't expose it publicly, and audit changes.

Combine independent layers: expose only needed endpoints, guard them with a SecurityFilterChain requiring an admin role via EndpointRequest.toAnyEndpoint(), keep /env and /configprops values masked (show-values NEVER or WHEN_AUTHORIZED), disable dangerous ones like /shutdown, and isolate the management port to an internal network.

A logger group is a named alias for several loggers, defined with logging.group.<name>=pkg1,pkg2. You can then POST a level to that group name via the loggers endpoint and it changes all members at once. Spring predefines web and sql groups.

Web and JMX each have their own include/exclude sets so you can surface an endpoint on one transport but not the other. In prod, keep web to a minimal allow-list (or a separate internal port), avoid *, and layer Spring Security on top.