From 082bad80ae9bc56b83b787a7dad1ecc089dd7f4f Mon Sep 17 00:00:00 2001 From: awstools Date: Wed, 25 Sep 2024 18:24:32 +0000 Subject: [PATCH] docs(client-cloudtrail): Doc-only update for CloudTrail network activity events release (in preview) --- .../src/commands/GetEventSelectorsCommand.ts | 13 +- .../src/commands/PutEventSelectorsCommand.ts | 50 +- .../StartEventDataStoreIngestionCommand.ts | 2 +- .../StopEventDataStoreIngestionCommand.ts | 2 +- .../commands/UpdateEventDataStoreCommand.ts | 2 +- .../client-cloudtrail/src/models/models_0.ts | 878 +++++------------- .../sdk-codegen/aws-models/cloudtrail.json | 24 +- 7 files changed, 281 insertions(+), 690 deletions(-) diff --git a/clients/client-cloudtrail/src/commands/GetEventSelectorsCommand.ts b/clients/client-cloudtrail/src/commands/GetEventSelectorsCommand.ts index a032423a53913..480cf63229c41 100644 --- a/clients/client-cloudtrail/src/commands/GetEventSelectorsCommand.ts +++ b/clients/client-cloudtrail/src/commands/GetEventSelectorsCommand.ts @@ -33,17 +33,21 @@ export interface GetEventSelectorsCommandOutput extends GetEventSelectorsRespons * - *

For more information about logging management and data events, see the following topics + *

For more information about logging management, data, and network activity events, see the following topics * in the CloudTrail User Guide:

* * @example * Use a bare-bones client and the command you need to make an API call. diff --git a/clients/client-cloudtrail/src/commands/PutEventSelectorsCommand.ts b/clients/client-cloudtrail/src/commands/PutEventSelectorsCommand.ts index 330fbd822d4b1..f7bf46ea8d7ef 100644 --- a/clients/client-cloudtrail/src/commands/PutEventSelectorsCommand.ts +++ b/clients/client-cloudtrail/src/commands/PutEventSelectorsCommand.ts @@ -28,12 +28,35 @@ export interface PutEventSelectorsCommandInput extends PutEventSelectorsRequest export interface PutEventSelectorsCommandOutput extends PutEventSelectorsResponse, __MetadataBearer {} /** - *

Configures an event selector or advanced event selectors for your trail. Use event - * selectors or advanced event selectors to specify management and data event settings for - * your trail. If you want your trail to log Insights events, be sure the event selector - * enables logging of the Insights event types you want configured for your trail. For more information about logging Insights events, see Logging Insights events in the CloudTrail User Guide. + *

Configures event selectors (also referred to as basic event selectors) or advanced event selectors for your trail. You can use + * either AdvancedEventSelectors or EventSelectors, but not both. If + * you apply AdvancedEventSelectors to a trail, any existing + * EventSelectors are overwritten.

+ *

You can use AdvancedEventSelectors to + * log management events, data events for all resource types, and network activity events.

+ *

You can use EventSelectors to log management events and data events for the following resource types:

+ * + *

You can't use EventSelectors to log network activity events.

+ *

If you want your trail to log Insights events, be sure the event selector or advanced event selector enables + * logging of the Insights event types you want configured for your trail. For more information about logging Insights events, see Logging Insights events in the CloudTrail User Guide. * By default, trails created without specific event selectors are configured to - * log all read and write management events, and no data events.

+ * log all read and write management events, and no data events or network activity events.

*

When an event occurs in your account, CloudTrail evaluates the event selectors or * advanced event selectors in all trails. For each trail, if the event matches any event * selector, the trail processes and logs the event. If the event doesn't match any event @@ -41,7 +64,7 @@ export interface PutEventSelectorsCommandOutput extends PutEventSelectorsRespons *

Example

*
    *
  1. - *

    You create an event selector for a trail and specify that you want write-only + *

    You create an event selector for a trail and specify that you want to log write-only * events.

    *
    2. *
  2. @@ -63,16 +86,13 @@ export interface PutEventSelectorsCommandOutput extends PutEventSelectorsRespons *

    The PutEventSelectors operation must be called from the Region in which the * trail was created; otherwise, an InvalidHomeRegionException exception is * thrown.

    - *

    You can configure up to five event selectors for each trail. For more information, see - * Logging management events, Logging - * data events, and Quotas in CloudTrail in the CloudTrail User - * Guide.

    + *

    You can configure up to five event selectors for each trail.

    *

    You can add advanced event selectors, and conditions for your advanced event selectors, - * up to a maximum of 500 values for all conditions and selectors on a trail. You can use - * either AdvancedEventSelectors or EventSelectors, but not both. If - * you apply AdvancedEventSelectors to a trail, any existing - * EventSelectors are overwritten. For more information about advanced event - * selectors, see Logging data events in the CloudTrail User Guide.

    + * up to a maximum of 500 values for all conditions and selectors on a trail. For more information, see + * Logging management events, Logging + * data events, Logging + * network activity events, and Quotas in CloudTrail in the CloudTrail User + * Guide.

    * @example * Use a bare-bones client and the command you need to make an API call. * ```javascript diff --git a/clients/client-cloudtrail/src/commands/StartEventDataStoreIngestionCommand.ts b/clients/client-cloudtrail/src/commands/StartEventDataStoreIngestionCommand.ts index 3c07997623ea7..d2379a84c96e8 100644 --- a/clients/client-cloudtrail/src/commands/StartEventDataStoreIngestionCommand.ts +++ b/clients/client-cloudtrail/src/commands/StartEventDataStoreIngestionCommand.ts @@ -34,7 +34,7 @@ export interface StartEventDataStoreIngestionCommandOutput /** *

    Starts the ingestion of live events on an event data store specified as either an ARN or the ID portion of the ARN. To start ingestion, the event data store Status must be STOPPED_INGESTION - * and the eventCategory must be Management, Data, or ConfigurationItem.

    + * and the eventCategory must be Management, Data, NetworkActivity, or ConfigurationItem.

    * @example * Use a bare-bones client and the command you need to make an API call. * ```javascript diff --git a/clients/client-cloudtrail/src/commands/StopEventDataStoreIngestionCommand.ts b/clients/client-cloudtrail/src/commands/StopEventDataStoreIngestionCommand.ts index bed5d7347606d..c16b8730d80fc 100644 --- a/clients/client-cloudtrail/src/commands/StopEventDataStoreIngestionCommand.ts +++ b/clients/client-cloudtrail/src/commands/StopEventDataStoreIngestionCommand.ts @@ -31,7 +31,7 @@ export interface StopEventDataStoreIngestionCommandOutput /** *

    Stops the ingestion of live events on an event data store specified as either an ARN or the ID portion of the ARN. To stop ingestion, the event data store Status must be ENABLED - * and the eventCategory must be Management, Data, or ConfigurationItem.

    + * and the eventCategory must be Management, Data, NetworkActivity, or ConfigurationItem.

    * @example * Use a bare-bones client and the command you need to make an API call. * ```javascript diff --git a/clients/client-cloudtrail/src/commands/UpdateEventDataStoreCommand.ts b/clients/client-cloudtrail/src/commands/UpdateEventDataStoreCommand.ts index cf148d0bda0fd..85cb9da90b910 100644 --- a/clients/client-cloudtrail/src/commands/UpdateEventDataStoreCommand.ts +++ b/clients/client-cloudtrail/src/commands/UpdateEventDataStoreCommand.ts @@ -34,7 +34,7 @@ export interface UpdateEventDataStoreCommandOutput extends UpdateEventDataStoreR * RetentionPeriod is in days, and valid values are integers between 7 and * 3653 if the BillingMode is set to EXTENDABLE_RETENTION_PRICING, or between 7 and 2557 if BillingMode is set to FIXED_RETENTION_PRICING. By default, TerminationProtection is enabled.

    *

    For event data stores for CloudTrail events, AdvancedEventSelectors - * includes or excludes management or data events in your event data store. For more + * includes or excludes management, data, or network activity events in your event data store. For more * information about AdvancedEventSelectors, see AdvancedEventSelectors.

    *

    For event data stores for CloudTrail Insights events, Config configuration items, Audit Manager evidence, or non-Amazon Web Services events, * AdvancedEventSelectors includes events of that type in your event data store.

    diff --git a/clients/client-cloudtrail/src/models/models_0.ts b/clients/client-cloudtrail/src/models/models_0.ts index a73083726cc26..9c82a62a13fed 100644 --- a/clients/client-cloudtrail/src/models/models_0.ts +++ b/clients/client-cloudtrail/src/models/models_0.ts @@ -656,10 +656,11 @@ export interface AdvancedFieldSelector { *

    A field in a CloudTrail event record on which to filter events to be logged. For * event data stores for CloudTrail Insights events, Config configuration items, Audit Manager evidence, or events outside of Amazon Web Services, the field is used only for * selecting events as filtering is not supported.

    - *

    For CloudTrail management events, supported fields include readOnly, - * eventCategory, and eventSource.

    - *

    For CloudTrail data events, supported fields include readOnly, - * eventCategory, eventName, resources.type, and resources.ARN.

    + *

    For CloudTrail management events, supported fields include eventCategory (required), eventSource, and readOnly.

    + *

    For CloudTrail data events, supported fields include eventCategory (required), resources.type (required), eventName, readOnly, + * and resources.ARN.

    + *

    For CloudTrail network activity events, supported fields include eventCategory (required), eventSource (required), eventName, + * errorCode, and vpcEndpointId.

    *

    For event data stores for CloudTrail Insights events, Config configuration items, Audit Manager evidence, or events outside of Amazon Web Services, the only supported field is * eventCategory.

    *
      @@ -667,8 +668,8 @@ export interface AdvancedFieldSelector { *

      * * readOnly - * - Optional. Can be set to - * Equals a value of true or false. If you do + * - This is an optional field that is only used for management events and data events. This field can be set to + * Equals with a value of true or false. If you do * not add this field, CloudTrail logs both read and * write events. A value of true logs only * read events. A value of false logs only @@ -678,25 +679,52 @@ export interface AdvancedFieldSelector { *

      * * eventSource - * - For filtering - * management events only. This can be set to NotEquals - * kms.amazonaws.com or NotEquals - * rdsdata.amazonaws.com.

      + * - This field is only used for management events and network activity events.

      + *

      For management events, this is an optional field that can be set to NotEquals + * kms.amazonaws.com to exclude KMS management events, or NotEquals + * rdsdata.amazonaws.com to exclude RDS management events.

      + *

      For network activity events, this is a required field that only uses the + * Equals operator. Set this field to the event source for which you want to + * log network activity events. If you want to log network activity events for multiple + * event sources, you must create a separate field selector for each event + * source.

      + *

      The following are valid values for network activity events:

      + *
        + *
      • + *

        + * cloudtrail.amazonaws.com + *

        + *
        • + *
      • + *

        + * ec2.amazonaws.com + *

        + *
        • + *
      • + *

        + * kms.amazonaws.com + *

        + *
        • + *
      • + *

        + * secretsmanager.amazonaws.com + *

        + *
        • + *
      * *
    • *

      * * eventName - * - Can use any operator. - * You can use it to filter in or filter out any data event logged to CloudTrail, - * such as PutBucket or GetSnapshotBlock. You can have + * - This is an optional field that is only used for data events and network activity events. You can use any operator with + * eventName. You can use it to filter in or filter out specific events. You can have * multiple values for this field, separated by commas.

      *
      • *
    • *

      * * eventCategory - * - This is required and + * - This field is required and * must be set to Equals. *

      *
        @@ -712,6 +740,12 @@ export interface AdvancedFieldSelector { * must be Data. *

        * + *
      • + *

        + * For CloudTrail network activity events, the value + * must be NetworkActivity. + *

        + *
        • *
      *

      The following are used only for event data stores:

      *
        @@ -742,40 +776,43 @@ export interface AdvancedFieldSelector { *
      • *

        * + * errorCode + * - This field is only used to filter CloudTrail network activity events + * and is optional. This is the error code to filter on. Currently, the only valid errorCode is VpceAccessDenied. + * errorCode can only use the Equals operator.

        + *
        • + *
      • + *

        + * * resources.type * - This field is - * required for CloudTrail data events. resources.type can only - * use the Equals operator, and the value can be one of the - * following:

        + * required for CloudTrail data events. resources.type can only + * use the Equals operator.

        + *

        The value can be one of the following:

        *
          *
        • *

          - * AWS::DynamoDB::Table - *

          - *
          • - *
        • - *

          - * AWS::Lambda::Function + * AWS::AppConfig::Configuration *

          *
          • *
        • *

          - * AWS::S3::Object + * AWS::B2BI::Transformer *

          *
          • *
        • *

          - * AWS::AppConfig::Configuration + * AWS::Bedrock::AgentAlias *

          *
          • *
        • *

          - * AWS::B2BI::Transformer + * AWS::Bedrock::FlowAlias *

          *
          • *
        • *

          - * AWS::Bedrock::AgentAlias + * AWS::Bedrock::Guardrail *

          *
          • *
        • @@ -800,6 +837,11 @@ export interface AdvancedFieldSelector { *
          • *
        • *

          + * AWS::CloudWatch::Metric + *

          + *
          • + *
        • + *

          * AWS::CodeWhisperer::Customization *

          *
          • @@ -820,6 +862,11 @@ export interface AdvancedFieldSelector { * *
        • *

          + * AWS::DynamoDB::Table + *

          + *
          • + *
        • + *

          * AWS::EC2::Snapshot *

          *
          • @@ -890,800 +937,260 @@ export interface AdvancedFieldSelector { * *
        • *

          - * AWS::KinesisVideo::Stream - *

          - *
          • - *
        • - *

          - * AWS::ManagedBlockchain::Network - *

          - *
          • - *
        • - *

          - * AWS::ManagedBlockchain::Node - *

          - *
          • - *
        • - *

          - * AWS::MedicalImaging::Datastore - *

          - *
          • - *
        • - *

          - * AWS::NeptuneGraph::Graph - *

          - *
          • - *
        • - *

          - * AWS::PCAConnectorAD::Connector - *

          - *
          • - *
        • - *

          - * AWS::QApps:QApp - *

          - *
          • - *
        • - *

          - * AWS::QBusiness::Application - *

          - *
          • - *
        • - *

          - * AWS::QBusiness::DataSource - *

          - *
          • - *
        • - *

          - * AWS::QBusiness::Index - *

          - *
          • - *
        • - *

          - * AWS::QBusiness::WebExperience - *

          - *
          • - *
        • - *

          - * AWS::RDS::DBCluster - *

          - *
          • - *
        • - *

          - * AWS::S3::AccessPoint - *

          - *
          • - *
        • - *

          - * AWS::S3ObjectLambda::AccessPoint - *

          - *
          • - *
        • - *

          - * AWS::S3Outposts::Object - *

          - *
          • - *
        • - *

          - * AWS::SageMaker::Endpoint - *

          - *
          • - *
        • - *

          - * AWS::SageMaker::ExperimentTrialComponent - *

          - *
          • - *
        • - *

          - * AWS::SageMaker::FeatureGroup - *

          - *
          • - *
        • - *

          - * AWS::ServiceDiscovery::Namespace - *

          - *
          • - *
        • - *

          - * AWS::ServiceDiscovery::Service - *

          - *
          • - *
        • - *

          - * AWS::SCN::Instance - *

          - *
          • - *
        • - *

          - * AWS::SNS::PlatformEndpoint - *

          - *
          • - *
        • - *

          - * AWS::SNS::Topic - *

          - *
          • - *
        • - *

          - * AWS::SQS::Queue - *

          - *
          • - *
        • - *

          - * AWS::SSM::ManagedNode - *

          - *
          • - *
        • - *

          - * AWS::SSMMessages::ControlChannel - *

          - *
          • - *
        • - *

          - * AWS::SWF::Domain - *

          - *
          • - *
        • - *

          - * AWS::ThinClient::Device - *

          - *
          • - *
        • - *

          - * AWS::ThinClient::Environment - *

          - *
          • - *
        • - *

          - * AWS::Timestream::Database - *

          - *
          • - *
        • - *

          - * AWS::Timestream::Table - *

          - *
          • - *
        • - *

          - * AWS::VerifiedPermissions::PolicyStore - *

          - *
          • - *
        • - *

          - * AWS::XRay::Trace - *

          - *
          • - *
        - *

        You can have only one resources.type field per selector. To log data - * events on more than one resource type, add another selector.

        - *
        • - *
      • - *

        - * - * resources.ARN - * - You can use any - * operator with resources.ARN, but if you use Equals or - * NotEquals, the value must exactly match the ARN of a valid resource - * of the type you've specified in the template as the value of resources.type.

        - * - *

        You can't use the resources.ARN field to filter resource types that do not have ARNs.

        - *         - *

        The resources.ARN field can be set one of the following.

        - *

        If resources.type equals AWS::S3::Object, the ARN must be in - * one of the following formats. To log all data events for all objects in a specific S3 - * bucket, use the StartsWith operator, and include only the bucket ARN as - * the matching value.

        - *

        The trailing slash is intentional; do not exclude it. Replace the text between - * less than and greater than symbols (<>) with resource-specific information.

        - *
          - *
        • - *

          - * arn::s3:::/ - *

          - *
          • - *
        • - *

          - * arn::s3:::// - *

          - *
          • - *
        - *

        When resources.type equals AWS::DynamoDB::Table, and the operator is - * set to Equals or NotEquals, the ARN must be in the - * following format:

        - *
          - *
        • - *

          - * arn::dynamodb:::table/ - *

          - *
          • - *
        - *

        When resources.type equals AWS::Lambda::Function, and the operator is - * set to Equals or NotEquals, the ARN must be in the - * following format:

        - *
          - *
        • - *

          - * arn::lambda:::function: - *

          - *
          • - *
        - *

        When resources.type equals AWS::AppConfig::Configuration, and the operator is - * set to Equals or NotEquals, the ARN must be in the - * following format:

        - *
          - *
        • - *

          - * arn::appconfig:::application//environment//configuration/ - *

          - *
          • - *
        - *

        When resources.type equals AWS::B2BI::Transformer, and the operator is - * set to Equals or NotEquals, the ARN must be in the - * following format:

        - *
          - *
        • - *

          - * arn::b2bi:::transformer/ - *

          - *
          • - *
        - *

        When resources.type equals AWS::Bedrock::AgentAlias, and the operator is - * set to Equals or NotEquals, the ARN must be in the - * following format:

        - *
          - *
        • - *

          - * arn::bedrock:::agent-alias// - *

          - *
          • - *
        - *

        When resources.type equals AWS::Bedrock::KnowledgeBase, and the operator is - * set to Equals or NotEquals, the ARN must be in the - * following format:

        - *
          - *
        • - *

          - * arn::bedrock:::knowledge-base/ - *

          - *
          • - *
        - *

        When resources.type equals AWS::Cassandra::Table, and the operator is - * set to Equals or NotEquals, the ARN must be in the - * following format:

        - *
          - *
        • - *

          - * arn::cassandra:::/keyspace//table/ - *

          - *
          • - *
        - *

        When resources.type equals AWS::CloudFront::KeyValueStore, and the operator is - * set to Equals or NotEquals, the ARN must be in the - * following format:

        - *
          - *
        • - *

          - * arn::cloudfront:::key-value-store/ - *

          - *
          • - *
        - *

        When resources.type equals AWS::CloudTrail::Channel, and the operator is - * set to Equals or NotEquals, the ARN must be in the - * following format:

        - *
          - *
        • - *

          - * arn::cloudtrail:::channel/ - *

          - *
          • - *
        - *

        When resources.type equals AWS::CodeWhisperer::Customization, and the operator is - * set to Equals or NotEquals, the ARN must be in the - * following format:

        - *
          - *
        • - *

          - * arn::codewhisperer:::customization/ - *

          - *
          • - *
        - *

        When resources.type equals AWS::CodeWhisperer::Profile, and the operator is - * set to Equals or NotEquals, the ARN must be in the - * following format:

        - *
          - *
        • - *

          - * arn::codewhisperer:::profile/ - *

          - *
          • - *
        - *

        When resources.type equals AWS::Cognito::IdentityPool, and the operator is - * set to Equals or NotEquals, the ARN must be in the - * following format:

        - *
          - *
        • - *

          - * arn::cognito-identity:::identitypool/ - *

          - *
          • - *
        - *

        When resources.type equals AWS::DynamoDB::Stream, and - * the operator is set to Equals or NotEquals, the ARN must be - * in the following format:

        - *
          - *
        • - *

          - * arn::dynamodb:::table//stream/ - *

          - *
          • - *
        - *

        When resources.type equals AWS::EC2::Snapshot, and the - * operator is set to Equals or NotEquals, the ARN must be in - * the following format:

        - *
          - *
        • - *

          - * arn::ec2:::snapshot/ + * AWS::Kinesis::Stream *

          *
          • - *
        - *

        When resources.type equals AWS::EMRWAL::Workspace, and the - * operator is set to Equals or NotEquals, the ARN must be in - * the following format:

        - *
          *
        • *

          - * arn::emrwal:::workspace/ + * AWS::Kinesis::StreamConsumer *

          *
          • - *
        - *

        When resources.type equals AWS::FinSpace::Environment, - * and the operator is set to Equals or NotEquals, the ARN - * must be in the following format:

        - *
          *
        • *

          - * arn::finspace:::environment/ + * AWS::KinesisVideo::Stream *

          *
          • - *
        - *

        When resources.type equals AWS::Glue::Table, and the - * operator is set to Equals or NotEquals, the ARN must be in - * the following format:

        - *
          *
        • *

          - * arn::glue:::table// + * AWS::Lambda::Function *

          *
          • - *
        - *

        When resources.type equals AWS::GreengrassV2::ComponentVersion, and the - * operator is set to Equals or NotEquals, the ARN must be in - * the following format:

        - *
          *
        • *

          - * arn::greengrass:::components/ + * AWS::MachineLearning::MlModel *

          *
          • - *
        - *

        When resources.type equals AWS::GreengrassV2::Deployment, and the - * operator is set to Equals or NotEquals, the ARN must be in - * the following format:

        - *
          *
        • *

          - * arn::greengrass:::deployments/ + * AWS::ManagedBlockchain::Network *

          *
          • - *
        - *

        When resources.type equals AWS::GuardDuty::Detector, and the - * operator is set to Equals or NotEquals, the ARN must be in - * the following format:

        - *
          *
        • *

          - * arn::guardduty:::detector/ + * AWS::ManagedBlockchain::Node *

          *
          • - *
        - *

        When resources.type equals AWS::IoT::Certificate, - * and the operator is set to Equals or NotEquals, the ARN - * must be in the following format:

        - *
          *
        • *

          - * arn::iot:::cert/ + * AWS::MedicalImaging::Datastore *

          *
          • - *
        - *

        When resources.type equals AWS::IoT::Thing, - * and the operator is set to Equals or NotEquals, the ARN - * must be in the following format:

        - *
          *
        • *

          - * arn::iot:::thing/ + * AWS::NeptuneGraph::Graph *

          *
          • - *
        - *

        When resources.type equals AWS::IoTSiteWise::Asset, - * and the operator is set to Equals or NotEquals, the ARN - * must be in the following format:

        - *
          *
        • *

          - * arn::iotsitewise:::asset/ + * AWS::One::UKey *

          *
          • - *
        - *

        When resources.type equals AWS::IoTSiteWise::TimeSeries, - * and the operator is set to Equals or NotEquals, the ARN - * must be in the following format:

        - *
          *
        • *

          - * arn::iotsitewise:::timeseries/ + * AWS::One::User *

          *
          • - *
        - *

        When resources.type equals AWS::IoTTwinMaker::Entity, - * and the operator is set to Equals or NotEquals, the ARN - * must be in the following format:

        - *
          *
        • *

          - * arn::iottwinmaker:::workspace//entity/ + * AWS::PaymentCryptography::Alias *

          *
          • - *
        - *

        When resources.type equals AWS::IoTTwinMaker::Workspace, - * and the operator is set to Equals or NotEquals, the ARN - * must be in the following format:

        - *
          *
        • *

          - * arn::iottwinmaker:::workspace/ + * AWS::PaymentCryptography::Key *

          *
          • - *
        - *

        When resources.type equals AWS::KendraRanking::ExecutionPlan, and the - * operator is set to Equals or NotEquals, the ARN must be in - * the following format:

        - *
          *
        • *

          - * arn::kendra-ranking:::rescore-execution-plan/ - *

          - *
          • - *
        - *

        When resources.type equals AWS::KinesisVideo::Stream, and the - * operator is set to Equals or NotEquals, the ARN must be in - * the following format:

        - *
          - *
        • - *

          - * arn::kinesisvideo:::stream// + * AWS::PCAConnectorAD::Connector *

          *
          • - *
        - *

        When resources.type equals AWS::ManagedBlockchain::Network, - * and the operator is set to Equals or NotEquals, the ARN - * must be in the following format:

        - *
          *
        • *

          - * arn::managedblockchain:::networks/ + * AWS::PCAConnectorSCEP::Connector *

          *
          • - *
        - *

        When resources.type equals AWS::ManagedBlockchain::Node, - * and the operator is set to Equals or NotEquals, the ARN - * must be in the following format:

        - *
          *
        • *

          - * arn::managedblockchain:::nodes/ + * AWS::QApps:QApp *

          *
          • - *
        - *

        When resources.type equals AWS::MedicalImaging::Datastore, - * and the operator is set to Equals or NotEquals, the ARN - * must be in the following format:

        - *
          *
        • *

          - * arn::medical-imaging:::datastore/ + * AWS::QBusiness::Application *

          *
          • - *
        - *

        When resources.type equals AWS::NeptuneGraph::Graph, - * and the operator is set to Equals or NotEquals, the ARN - * must be in the following format:

        - *
          *
        • *

          - * arn::neptune-graph:::graph/ + * AWS::QBusiness::DataSource *

          *
          • - *
        - *

        When resources.type equals AWS::PCAConnectorAD::Connector, - * and the operator is set to Equals or NotEquals, the ARN - * must be in the following format:

        - *
          *
        • *

          - * arn::pca-connector-ad:::connector/ + * AWS::QBusiness::Index *

          *
          • - *
        - *

        When resources.type equals AWS::QApps:QApp, - * and the operator is set to Equals or NotEquals, the ARN - * must be in the following format:

        - *
          *
        • *

          - * arn::qapps:::application//qapp/ + * AWS::QBusiness::WebExperience *

          *
          • - *
        - *

        When resources.type equals AWS::QBusiness::Application, - * and the operator is set to Equals or NotEquals, the ARN - * must be in the following format:

        - *
          *
        • *

          - * arn::qbusiness:::application/ + * AWS::RDS::DBCluster *

          *
          • - *
        - *

        When resources.type equals AWS::QBusiness::DataSource, - * and the operator is set to Equals or NotEquals, the ARN - * must be in the following format:

        - *
          *
        • *

          - * arn::qbusiness:::application//index//data-source/ + * AWS::RUM::AppMonitor *

          *
          • - *
        - *

        When resources.type equals AWS::QBusiness::Index, - * and the operator is set to Equals or NotEquals, the ARN - * must be in the following format:

        - *
          *
        • *

          - * arn::qbusiness:::application//index/ - *

          - *
          • - *
        - *

        When resources.type equals AWS::QBusiness::WebExperience, - * and the operator is set to Equals or NotEquals, the ARN - * must be in the following format:

        - *
          - *
        • - *

          - * arn::qbusiness:::application//web-experience/ + * AWS::S3::AccessPoint *

          *
          • - *
        - *

        When resources.type equals AWS::RDS::DBCluster, - * and the operator is set to Equals or NotEquals, the ARN - * must be in the following format:

        - *
          *
        • *

          - * arn::rds:::cluster/ + * AWS::S3::Object *

          *
          • - *
        - *

        When resources.type equals AWS::S3::AccessPoint, and the - * operator is set to Equals or NotEquals, the ARN must be in - * one of the following formats. To log events on all objects in an S3 access point, we - * recommend that you use only the access point ARN, don’t include the object path, and - * use the StartsWith or NotStartsWith operators.

        - *
          *
        • *

          - * arn::s3:::accesspoint/ + * AWS::S3Express::Object *

          *
          • *
        • *

          - * arn::s3:::accesspoint//object/ + * AWS::S3ObjectLambda::AccessPoint *

          *
          • - *
        - *

        When resources.type equals - * AWS::S3ObjectLambda::AccessPoint, and the operator is set to - * Equals or NotEquals, the ARN must be in the following - * format:

        - *
          *
        • *

          - * arn::s3-object-lambda:::accesspoint/ + * AWS::S3Outposts::Object *

          *
          • - *
        - *

        When resources.type equals AWS::S3Outposts::Object, and - * the operator is set to Equals or NotEquals, the ARN must be - * in the following format:

        - *
          *
        • *

          - * arn::s3-outposts::: + * AWS::SageMaker::Endpoint *

          *
          • - *
        - *

        When resources.type equals AWS::SageMaker::Endpoint, and the operator is set to - * Equals or NotEquals, the ARN must be in the following format:

        - *
          *
        • *

          - * arn::sagemaker:::endpoint/ + * AWS::SageMaker::ExperimentTrialComponent *

          *
          • - *
        - *

        When resources.type equals AWS::SageMaker::ExperimentTrialComponent, and the operator is set to - * Equals or NotEquals, the ARN must be in the following format:

        - *
          *
        • *

          - * arn::sagemaker:::experiment-trial-component/ + * AWS::SageMaker::FeatureGroup *

          *
          • - *
        - *

        When resources.type equals AWS::SageMaker::FeatureGroup, and the operator is set to - * Equals or NotEquals, the ARN must be in the following format:

        - *
          *
        • *

          - * arn::sagemaker:::feature-group/ + * AWS::ServiceDiscovery::Namespace *

          *
          • - *
        - *

        When resources.type equals AWS::SCN::Instance, and the operator is set to - * Equals or NotEquals, the ARN must be in the following format:

        - *
          *
        • *

          - * arn::scn:::instance/ + * AWS::ServiceDiscovery::Service *

          *
          • - *
        - *

        When resources.type equals AWS::ServiceDiscovery::Namespace, and the operator is set to - * Equals or NotEquals, the ARN must be in the following format:

        - *
          *
        • *

          - * arn::servicediscovery:::namespace/ + * AWS::SCN::Instance *

          *
          • - *
        - *

        When resources.type equals AWS::ServiceDiscovery::Service, and the operator is set to - * Equals or NotEquals, the ARN must be in the following format:

        - *
          *
        • *

          - * arn::servicediscovery:::service/ + * AWS::SNS::PlatformEndpoint *

          *
          • - *
        - *

        When resources.type equals AWS::SNS::PlatformEndpoint, - * and the operator is set to Equals or NotEquals, the ARN - * must be in the following format:

        - *
          *
        • *

          - * arn::sns:::endpoint/// + * AWS::SNS::Topic *

          *
          • - *
        - *

        When resources.type equals AWS::SNS::Topic, - * and the operator is set to Equals or NotEquals, the ARN - * must be in the following format:

        - *
          *
        • *

          - * arn::sns::: + * AWS::SQS::Queue *

          *
          • - *
        - *

        When resources.type equals AWS::SQS::Queue, - * and the operator is set to Equals or NotEquals, the ARN - * must be in the following format:

        - *
          *
        • *

          - * arn::sqs::: + * AWS::SSM::ManagedNode *

          *
          • - *
        - *

        When resources.type equals AWS::SSM::ManagedNode, and - * the operator is set to Equals or NotEquals, the ARN must be - * in one of the following formats:

        - *
          *
        • *

          - * arn::ssm:::managed-instance/ + * AWS::SSMMessages::ControlChannel *

          *
          • *
        • *

          - * arn::ec2:::instance/ + * AWS::StepFunctions::StateMachine *

          *
          • - *
        - *

        When resources.type equals AWS::SSMMessages::ControlChannel, and - * the operator is set to Equals or NotEquals, the ARN must be - * in the following format:

        - *
          *
        • *

          - * arn::ssmmessages:::control-channel/ + * AWS::SWF::Domain *

          *
          • - *
        - *

        When resources.type equals AWS::SWF::Domain, - * and the operator is set to Equals or NotEquals, the ARN - * must be in the following format:

        - *
          *
        • *

          - * arn::swf:::domain/ + * AWS::ThinClient::Device *

          *
          • - *
        - *

        When resources.type equals AWS::ThinClient::Device, and - * the operator is set to Equals or NotEquals, the ARN must be - * in the following format:

        - *
          *
        • *

          - * arn::thinclient:::device/ + * AWS::ThinClient::Environment *

          *
          • - *
        - *

        When resources.type equals AWS::ThinClient::Environment, and - * the operator is set to Equals or NotEquals, the ARN must be - * in the following format:

        - *
          *
        • *

          - * arn::thinclient:::environment/ + * AWS::Timestream::Database *

          *
          • - *
        - *

        When resources.type equals AWS::Timestream::Database, - * and the operator is set to Equals or NotEquals, the ARN - * must be in the following format:

        - *
          *
        • *

          - * arn::timestream:::database/ + * AWS::Timestream::Table *

          *
          • - *
        - *

        When resources.type equals AWS::Timestream::Table, - * and the operator is set to Equals or NotEquals, the ARN - * must be in the following format:

        - *
          *
        • *

          - * arn::timestream:::database//table/ + * AWS::VerifiedPermissions::PolicyStore *

          *
          • - *
        - *

        When resources.type equals AWS::VerifiedPermissions::PolicyStore, and the operator is - * set to Equals or NotEquals, the ARN must be in the - * following format:

        - *
          *
        • *

          - * arn::verifiedpermissions:::policy-store/ + * AWS::XRay::Trace *

          *
          • *
        + *

        You can have only one resources.type field per selector. To log events on more than one resource type, add another selector.

        + *
        • + *
      • + *

        + * + * resources.ARN + * - The resources.ARN is an optional field for + * data events. You can use any + * operator with resources.ARN, but if you use Equals or + * NotEquals, the value must exactly match the ARN of a valid resource + * of the type you've specified in the template as the value of resources.type. To log all data events for all objects in a specific S3 bucket, + * use the StartsWith operator, and include only the bucket ARN as the matching value.

        + *

        For information about filtering data events on the resources.ARN field, see + * Filtering data + * events by resources.ARN in the CloudTrail User Guide.

        + * + *

        You can't use the resources.ARN field to filter resource types that do not have ARNs.

        + *         + *
        • + *
      • + *

        + * + * vpcEndpointId + * - This field is only used to filter CloudTrail network activity events + * and is optional. This field identifies the VPC endpoint that the request passed through. You can use any operator with vpcEndpointId.

        *
        • *
      * @public @@ -1736,10 +1243,9 @@ export interface AdvancedFieldSelector { } /** - *

      Advanced event selectors let you create fine-grained selectors for CloudTrail management and data events. They help you control costs by logging only those - * events that are important to you. For more information about advanced event selectors, see - * Logging management events and - * Logging data events in the CloudTrail User Guide.

      + *

      Advanced event selectors let you create fine-grained selectors for CloudTrail management, data, and network activity events. They help you control costs by logging only those + * events that are important to you. For more information about configuring advanced event selectors, see + * the Logging data events, Logging network activity events, and Logging management events topics in the CloudTrail User Guide.

      *

      You cannot apply both event selectors and advanced event selectors to a trail.

      *

      * Supported CloudTrail event record fields for management events @@ -1788,6 +1294,36 @@ export interface AdvancedFieldSelector { *

      *
      • *
    + *

    + * Supported CloudTrail event record fields for network activity events + *

    + * + *

    Network activity events is in preview release for CloudTrail and is subject to change.

    + *     + *
      + *
    • + *

      + * eventCategory (required)

      + *
      • + *
    • + *

      + * eventSource (required)

      + *
      • + *
    • + *

      + * eventName + *

      + *
      • + *
    • + *

      + * errorCode - The only valid value for errorCode is VpceAccessDenied.

      + *
      • + *
    • + *

      + * vpcEndpointId + *

      + *
      • + *
    * *

    For event data stores for CloudTrail Insights events, Config configuration items, Audit Manager evidence, or events outside of Amazon Web Services, the only supported field is * eventCategory.

    @@ -4562,11 +4098,7 @@ export interface GetEventSelectorsRequest { } /** - *

    Data events provide information about the resource operations performed on or within a resource - * itself. These are also known as data plane operations. You can specify up to 250 data - * resources for a trail.

    - *

    Configure the DataResource to specify the resource type and resource ARNs for which you want to log data events.

    - *

    You can specify the following resource types in your event selectors for your trail:

    + *

    You can configure the DataResource in an EventSelector to log data events for the following three resource types:

    *
      *
    • *

      @@ -4584,19 +4116,21 @@ export interface GetEventSelectorsRequest { *

      *
      • *
    + *

    To log data events for all other resource types including objects stored in + * directory buckets, you must use AdvancedEventSelectors. You must also + * use AdvancedEventSelectors if you want to filter on the eventName field.

    + *

    Configure the DataResource to specify the resource type and resource ARNs for which you want to log data events.

    * *

    The total number of allowed data resources is 250. This number can be distributed * between 1 and 5 event selectors, but the total cannot exceed 250 across all * selectors for the trail.

    - *

    If you are using advanced event selectors, the maximum total number of values for - * all conditions, across all advanced event selectors for the trail, is 500.

    *     *

    The following example demonstrates how logging works when you configure logging of all - * data events for an S3 bucket named bucket-1. In this example, the CloudTrail user specified an empty prefix, and the option to log both Read + * data events for a general purpose bucket named amzn-s3-demo-bucket1. In this example, the CloudTrail user specified an empty prefix, and the option to log both Read * and Write data events.

    *
      *
    1. - *

      A user uploads an image file to bucket-1.

      + *

      A user uploads an image file to amzn-s3-demo-bucket1.

      *
      2. *
    2. *

      The PutObject API operation is an Amazon S3 object-level API. @@ -4606,7 +4140,7 @@ export interface GetEventSelectorsRequest { *

      3. *
    3. *

      A user uploads an object to an Amazon S3 bucket named - * arn:aws:s3:::bucket-2.

      + * arn:aws:s3:::amzn-s3-demo-bucket1.

      *
      4. *
    4. *

      The PutObject API operation occurred for an object in an S3 bucket @@ -4683,12 +4217,12 @@ export interface DataResource { *

      5. *
    5. *

      To log data events for all objects in an S3 bucket, specify the bucket and an - * empty object prefix such as arn:aws:s3:::bucket-1/. The trail logs data + * empty object prefix such as arn:aws:s3:::amzn-s3-demo-bucket1/. The trail logs data * events for all objects in this S3 bucket.

      *
      6. *
    6. *

      To log data events for specific objects, specify the S3 bucket and object prefix - * such as arn:aws:s3:::bucket-1/example-images. The trail logs data events + * such as arn:aws:s3:::amzn-s3-demo-bucket1/example-images. The trail logs data events * for objects in this S3 bucket that match the prefix.

      *
      7. *
    7. @@ -4771,13 +4305,18 @@ export interface EventSelector { IncludeManagementEvents?: boolean; /** - *

      CloudTrail supports data event logging for Amazon S3 objects, Lambda functions, and Amazon DynamoDB tables with basic event selectors. + *

      CloudTrail supports data event logging for Amazon S3 objects in standard S3 buckets, Lambda functions, and Amazon DynamoDB tables with basic event selectors. * You can specify up to 250 resources for an individual event selector, but the total number * of data resources cannot exceed 250 across all event selectors in a trail. This limit does * not apply if you configure resource logging for all data events.

      *

      For more information, see Data * Events and Limits in CloudTrail in the CloudTrail User * Guide.

      + * + *

      To log data events for all other resource types including objects stored in + * directory buckets, you must use AdvancedEventSelectors. You must also + * use AdvancedEventSelectors if you want to filter on the eventName field.

      + *       * @public */ DataResources?: DataResource[]; @@ -6696,7 +6235,26 @@ export interface PutEventSelectorsRequest { TrailName: string | undefined; /** - *

      Specifies the settings for your event selectors. You can configure up to five event + *

      Specifies the settings for your event selectors. You can use event selectors to log management events and data events for the following resource types:

      + *
        + *
      • + *

        + * AWS::DynamoDB::Table + *

        + *
        • + *
      • + *

        + * AWS::Lambda::Function + *

        + *
        • + *
      • + *

        + * AWS::S3::Object + *

        + *
        • + *
      + *

      You can't use event selectors to log network activity events.

      + *

      You can configure up to five event * selectors for a trail. You can use either EventSelectors or * AdvancedEventSelectors in a PutEventSelectors request, but not * both. If you apply EventSelectors to a trail, any existing @@ -6706,13 +6264,17 @@ export interface PutEventSelectorsRequest { EventSelectors?: EventSelector[]; /** - *

      Specifies the settings for advanced event selectors. You can add advanced event + *

      Specifies the settings for advanced event selectors. You can use advanced event selectors to + * log management events, data events for all resource types, and network activity events.

      + *

      You can add advanced event * selectors, and conditions for your advanced event selectors, up to a maximum of 500 values * for all conditions and selectors on a trail. You can use either * AdvancedEventSelectors or EventSelectors, but not both. If you * apply AdvancedEventSelectors to a trail, any existing * EventSelectors are overwritten. For more information about advanced event - * selectors, see Logging data events in the CloudTrail User Guide.

      + * selectors, see Logging data events and + * Logging network activity events + * in the CloudTrail User Guide.

      * @public */ AdvancedEventSelectors?: AdvancedEventSelector[]; diff --git a/codegen/sdk-codegen/aws-models/cloudtrail.json b/codegen/sdk-codegen/aws-models/cloudtrail.json index 8599016cf0910..cca59e1397cf4 100644 --- a/codegen/sdk-codegen/aws-models/cloudtrail.json +++ b/codegen/sdk-codegen/aws-models/cloudtrail.json @@ -251,7 +251,7 @@ } }, "traits": { - "smithy.api#documentation": "

      Advanced event selectors let you create fine-grained selectors for CloudTrail management and data events. They help you control costs by logging only those\n events that are important to you. For more information about advanced event selectors, see\n Logging management events and \n Logging data events in the CloudTrail User Guide.

      \n

      You cannot apply both event selectors and advanced event selectors to a trail.

      \n

      \n Supported CloudTrail event record fields for management events\n

      \n
        \n
      • \n

        \n eventCategory (required)

        \n
        • \n
      • \n

        \n eventSource\n

        \n
        • \n
      • \n

        \n readOnly\n

        \n
        • \n
      \n

      \n Supported CloudTrail event record fields for data events\n

      \n
        \n
      • \n

        \n eventCategory (required)

        \n
        • \n
      • \n

        \n resources.type (required)

        \n
        • \n
      • \n

        \n readOnly\n

        \n
        • \n
      • \n

        \n eventName\n

        \n
        • \n
      • \n

        \n resources.ARN\n

        \n
        • \n
      \n \n

      For event data stores for CloudTrail Insights events, Config configuration items, Audit Manager evidence, or events outside of Amazon Web Services, the only supported field is\n eventCategory.

      \n       " + "smithy.api#documentation": "

      Advanced event selectors let you create fine-grained selectors for CloudTrail management, data, and network activity events. They help you control costs by logging only those\n events that are important to you. For more information about configuring advanced event selectors, see\n the Logging data events, Logging network activity events, and Logging management events topics in the CloudTrail User Guide.

      \n

      You cannot apply both event selectors and advanced event selectors to a trail.

      \n

      \n Supported CloudTrail event record fields for management events\n

      \n
        \n
      • \n

        \n eventCategory (required)

        \n
        • \n
      • \n

        \n eventSource\n

        \n
        • \n
      • \n

        \n readOnly\n

        \n
        • \n
      \n

      \n Supported CloudTrail event record fields for data events\n

      \n
        \n
      • \n

        \n eventCategory (required)

        \n
        • \n
      • \n

        \n resources.type (required)

        \n
        • \n
      • \n

        \n readOnly\n

        \n
        • \n
      • \n

        \n eventName\n

        \n
        • \n
      • \n

        \n resources.ARN\n

        \n
        • \n
      \n

      \n Supported CloudTrail event record fields for network activity events\n

      \n \n

      Network activity events is in preview release for CloudTrail and is subject to change.

      \n       \n
        \n
      • \n

        \n eventCategory (required)

        \n
        • \n
      • \n

        \n eventSource (required)

        \n
        • \n
      • \n

        \n eventName\n

        \n
        • \n
      • \n

        \n errorCode - The only valid value for errorCode is VpceAccessDenied.

        \n
        • \n
      • \n

        \n vpcEndpointId\n

        \n
        • \n
      \n \n

      For event data stores for CloudTrail Insights events, Config configuration items, Audit Manager evidence, or events outside of Amazon Web Services, the only supported field is\n eventCategory.

      \n       " } }, "com.amazonaws.cloudtrail#AdvancedEventSelectors": { @@ -266,7 +266,7 @@ "Field": { "target": "com.amazonaws.cloudtrail#SelectorField", "traits": { - "smithy.api#documentation": "

      A field in a CloudTrail event record on which to filter events to be logged. For\n event data stores for CloudTrail Insights events, Config configuration items, Audit Manager evidence, or events outside of Amazon Web Services, the field is used only for\n selecting events as filtering is not supported.

      \n

      For CloudTrail management events, supported fields include readOnly,\n eventCategory, and eventSource.

      \n

      For CloudTrail data events, supported fields include readOnly,\n eventCategory, eventName, resources.type, and resources.ARN.

      \n

      For event data stores for CloudTrail Insights events, Config configuration items, Audit Manager evidence, or events outside of Amazon Web Services, the only supported field is\n eventCategory.

      \n
        \n
      • \n

        \n \n readOnly\n - Optional. Can be set to\n Equals a value of true or false. If you do\n not add this field, CloudTrail logs both read and\n write events. A value of true logs only\n read events. A value of false logs only\n write events.

        \n
        • \n
      • \n

        \n \n eventSource\n - For filtering\n management events only. This can be set to NotEquals\n kms.amazonaws.com or NotEquals\n rdsdata.amazonaws.com.

        \n
        • \n
      • \n

        \n \n eventName\n - Can use any operator.\n You can use it to filter in or filter out any data event logged to CloudTrail,\n such as PutBucket or GetSnapshotBlock. You can have\n multiple values for this field, separated by commas.

        \n
        • \n
      • \n

        \n \n eventCategory\n - This is required and\n must be set to Equals. \n

        \n
          \n
        • \n

          \n For CloudTrail management events, the value\n must be Management. \n

          \n
          • \n
        • \n

          \n For CloudTrail data events, the value\n must be Data. \n

          \n
          • \n
        \n

        The following are used only for event data stores:

        \n
          \n
        • \n

          \n For CloudTrail Insights events, the value\n must be Insight. \n

          \n
          • \n
        • \n

          \n For Config\n configuration items, the value must be ConfigurationItem.\n

          \n
          • \n
        • \n

          \n For Audit Manager evidence, the value must be Evidence.\n

          \n
          • \n
        • \n

          \n For non-Amazon Web Services events, the value must be ActivityAuditLog.\n

          \n
          • \n
        \n
        • \n
      • \n

        \n \n resources.type\n - This field is\n required for CloudTrail data events. resources.type can only\n use the Equals operator, and the value can be one of the\n following:

        \n
          \n
        • \n

          \n AWS::DynamoDB::Table\n

          \n
          • \n
        • \n

          \n AWS::Lambda::Function\n

          \n
          • \n
        • \n

          \n AWS::S3::Object\n

          \n
          • \n
        • \n

          \n AWS::AppConfig::Configuration\n

          \n
          • \n
        • \n

          \n AWS::B2BI::Transformer\n

          \n
          • \n
        • \n

          \n AWS::Bedrock::AgentAlias\n

          \n
          • \n
        • \n

          \n AWS::Bedrock::KnowledgeBase\n

          \n
          • \n
        • \n

          \n AWS::Cassandra::Table\n

          \n
          • \n
        • \n

          \n AWS::CloudFront::KeyValueStore\n

          \n
          • \n
        • \n

          \n AWS::CloudTrail::Channel\n

          \n
          • \n
        • \n

          \n AWS::CodeWhisperer::Customization\n

          \n
          • \n
        • \n

          \n AWS::CodeWhisperer::Profile\n

          \n
          • \n
        • \n

          \n AWS::Cognito::IdentityPool\n

          \n
          • \n
        • \n

          \n AWS::DynamoDB::Stream\n

          \n
          • \n
        • \n

          \n AWS::EC2::Snapshot\n

          \n
          • \n
        • \n

          \n AWS::EMRWAL::Workspace\n

          \n
          • \n
        • \n

          \n AWS::FinSpace::Environment\n

          \n
          • \n
        • \n

          \n AWS::Glue::Table\n

          \n
          • \n
        • \n

          \n AWS::GreengrassV2::ComponentVersion\n

          \n
          • \n
        • \n

          \n AWS::GreengrassV2::Deployment\n

          \n
          • \n
        • \n

          \n AWS::GuardDuty::Detector\n

          \n
          • \n
        • \n

          \n AWS::IoT::Certificate\n

          \n
          • \n
        • \n

          \n AWS::IoT::Thing\n

          \n
          • \n
        • \n

          \n AWS::IoTSiteWise::Asset\n

          \n
          • \n
        • \n

          \n AWS::IoTSiteWise::TimeSeries\n

          \n
          • \n
        • \n

          \n AWS::IoTTwinMaker::Entity\n

          \n
          • \n
        • \n

          \n AWS::IoTTwinMaker::Workspace\n

          \n
          • \n
        • \n

          \n AWS::KendraRanking::ExecutionPlan\n

          \n
          • \n
        • \n

          \n AWS::KinesisVideo::Stream\n

          \n
          • \n
        • \n

          \n AWS::ManagedBlockchain::Network\n

          \n
          • \n
        • \n

          \n AWS::ManagedBlockchain::Node\n

          \n
          • \n
        • \n

          \n AWS::MedicalImaging::Datastore\n

          \n
          • \n
        • \n

          \n AWS::NeptuneGraph::Graph\n

          \n
          • \n
        • \n

          \n AWS::PCAConnectorAD::Connector\n

          \n
          • \n
        • \n

          \n AWS::QApps:QApp\n

          \n
          • \n
        • \n

          \n AWS::QBusiness::Application\n

          \n
          • \n
        • \n

          \n AWS::QBusiness::DataSource\n

          \n
          • \n
        • \n

          \n AWS::QBusiness::Index\n

          \n
          • \n
        • \n

          \n AWS::QBusiness::WebExperience\n

          \n
          • \n
        • \n

          \n AWS::RDS::DBCluster\n

          \n
          • \n
        • \n

          \n AWS::S3::AccessPoint\n

          \n
          • \n
        • \n

          \n AWS::S3ObjectLambda::AccessPoint\n

          \n
          • \n
        • \n

          \n AWS::S3Outposts::Object\n

          \n
          • \n
        • \n

          \n AWS::SageMaker::Endpoint\n

          \n
          • \n
        • \n

          \n AWS::SageMaker::ExperimentTrialComponent\n

          \n
          • \n
        • \n

          \n AWS::SageMaker::FeatureGroup\n

          \n
          • \n
        • \n

          \n AWS::ServiceDiscovery::Namespace \n

          \n
          • \n
        • \n

          \n AWS::ServiceDiscovery::Service\n

          \n
          • \n
        • \n

          \n AWS::SCN::Instance\n

          \n
          • \n
        • \n

          \n AWS::SNS::PlatformEndpoint\n

          \n
          • \n
        • \n

          \n AWS::SNS::Topic\n

          \n
          • \n
        • \n

          \n AWS::SQS::Queue\n

          \n
          • \n
        • \n

          \n AWS::SSM::ManagedNode\n

          \n
          • \n
        • \n

          \n AWS::SSMMessages::ControlChannel\n

          \n
          • \n
        • \n

          \n AWS::SWF::Domain\n

          \n
          • \n
        • \n

          \n AWS::ThinClient::Device\n

          \n
          • \n
        • \n

          \n AWS::ThinClient::Environment\n

          \n
          • \n
        • \n

          \n AWS::Timestream::Database\n

          \n
          • \n
        • \n

          \n AWS::Timestream::Table\n

          \n
          • \n
        • \n

          \n AWS::VerifiedPermissions::PolicyStore\n

          \n
          • \n
        • \n

          \n AWS::XRay::Trace\n

          \n
          • \n
        \n

        You can have only one resources.type field per selector. To log data\n events on more than one resource type, add another selector.

        \n
        • \n
      • \n

        \n \n resources.ARN\n - You can use any\n operator with resources.ARN, but if you use Equals or\n NotEquals, the value must exactly match the ARN of a valid resource\n of the type you've specified in the template as the value of resources.type.

        \n \n

        You can't use the resources.ARN field to filter resource types that do not have ARNs.

        \n         \n

        The resources.ARN field can be set one of the following.

        \n

        If resources.type equals AWS::S3::Object, the ARN must be in\n one of the following formats. To log all data events for all objects in a specific S3\n bucket, use the StartsWith operator, and include only the bucket ARN as\n the matching value.

        \n

        The trailing slash is intentional; do not exclude it. Replace the text between\n less than and greater than symbols (<>) with resource-specific information.

        \n
          \n
        • \n

          \n arn::s3:::/\n

          \n
          • \n
        • \n

          \n arn::s3::://\n

          \n
          • \n
        \n

        When resources.type equals AWS::DynamoDB::Table, and the operator is\n set to Equals or NotEquals, the ARN must be in the\n following format:

        \n
          \n
        • \n

          \n arn::dynamodb:::table/\n

          \n
          • \n
        \n

        When resources.type equals AWS::Lambda::Function, and the operator is\n set to Equals or NotEquals, the ARN must be in the\n following format:

        \n
          \n
        • \n

          \n arn::lambda:::function:\n

          \n
          • \n
        \n

        When resources.type equals AWS::AppConfig::Configuration, and the operator is\n set to Equals or NotEquals, the ARN must be in the\n following format:

        \n
          \n
        • \n

          \n arn::appconfig:::application//environment//configuration/\n

          \n
          • \n
        \n

        When resources.type equals AWS::B2BI::Transformer, and the operator is\n set to Equals or NotEquals, the ARN must be in the\n following format:

        \n
          \n
        • \n

          \n arn::b2bi:::transformer/\n

          \n
          • \n
        \n

        When resources.type equals AWS::Bedrock::AgentAlias, and the operator is\n set to Equals or NotEquals, the ARN must be in the\n following format:

        \n
          \n
        • \n

          \n arn::bedrock:::agent-alias//\n

          \n
          • \n
        \n

        When resources.type equals AWS::Bedrock::KnowledgeBase, and the operator is\n set to Equals or NotEquals, the ARN must be in the\n following format:

        \n
          \n
        • \n

          \n arn::bedrock:::knowledge-base/\n

          \n
          • \n
        \n

        When resources.type equals AWS::Cassandra::Table, and the operator is\n set to Equals or NotEquals, the ARN must be in the\n following format:

        \n
          \n
        • \n

          \n arn::cassandra:::/keyspace//table/\n

          \n
          • \n
        \n

        When resources.type equals AWS::CloudFront::KeyValueStore, and the operator is\n set to Equals or NotEquals, the ARN must be in the\n following format:

        \n
          \n
        • \n

          \n arn::cloudfront:::key-value-store/\n

          \n
          • \n
        \n

        When resources.type equals AWS::CloudTrail::Channel, and the operator is\n set to Equals or NotEquals, the ARN must be in the\n following format:

        \n
          \n
        • \n

          \n arn::cloudtrail:::channel/\n

          \n
          • \n
        \n

        When resources.type equals AWS::CodeWhisperer::Customization, and the operator is\n set to Equals or NotEquals, the ARN must be in the\n following format:

        \n
          \n
        • \n

          \n arn::codewhisperer:::customization/\n

          \n
          • \n
        \n

        When resources.type equals AWS::CodeWhisperer::Profile, and the operator is\n set to Equals or NotEquals, the ARN must be in the\n following format:

        \n
          \n
        • \n

          \n arn::codewhisperer:::profile/\n

          \n
          • \n
        \n

        When resources.type equals AWS::Cognito::IdentityPool, and the operator is\n set to Equals or NotEquals, the ARN must be in the\n following format:

        \n
          \n
        • \n

          \n arn::cognito-identity:::identitypool/\n

          \n
          • \n
        \n

        When resources.type equals AWS::DynamoDB::Stream, and\n the operator is set to Equals or NotEquals, the ARN must be\n in the following format:

        \n
          \n
        • \n

          \n arn::dynamodb:::table//stream/\n

          \n
          • \n
        \n

        When resources.type equals AWS::EC2::Snapshot, and the\n operator is set to Equals or NotEquals, the ARN must be in\n the following format:

        \n
          \n
        • \n

          \n arn::ec2:::snapshot/\n

          \n
          • \n
        \n

        When resources.type equals AWS::EMRWAL::Workspace, and the\n operator is set to Equals or NotEquals, the ARN must be in\n the following format:

        \n
          \n
        • \n

          \n arn::emrwal:::workspace/\n

          \n
          • \n
        \n

        When resources.type equals AWS::FinSpace::Environment,\n and the operator is set to Equals or NotEquals, the ARN\n must be in the following format:

        \n
          \n
        • \n

          \n arn::finspace:::environment/\n

          \n
          • \n
        \n

        When resources.type equals AWS::Glue::Table, and the\n operator is set to Equals or NotEquals, the ARN must be in\n the following format:

        \n
          \n
        • \n

          \n arn::glue:::table//\n

          \n
          • \n
        \n

        When resources.type equals AWS::GreengrassV2::ComponentVersion, and the\n operator is set to Equals or NotEquals, the ARN must be in\n the following format:

        \n
          \n
        • \n

          \n arn::greengrass:::components/\n

          \n
          • \n
        \n

        When resources.type equals AWS::GreengrassV2::Deployment, and the\n operator is set to Equals or NotEquals, the ARN must be in\n the following format:

        \n
          \n
        • \n

          \n arn::greengrass:::deployments/\n

          \n
          • \n
        \n

        When resources.type equals AWS::GuardDuty::Detector, and the\n operator is set to Equals or NotEquals, the ARN must be in\n the following format:

        \n
          \n
        • \n

          \n arn::guardduty:::detector/\n

          \n
          • \n
        \n

        When resources.type equals AWS::IoT::Certificate,\n and the operator is set to Equals or NotEquals, the ARN\n must be in the following format:

        \n
          \n
        • \n

          \n arn::iot:::cert/\n

          \n
          • \n
        \n

        When resources.type equals AWS::IoT::Thing,\n and the operator is set to Equals or NotEquals, the ARN\n must be in the following format:

        \n
          \n
        • \n

          \n arn::iot:::thing/\n

          \n
          • \n
        \n

        When resources.type equals AWS::IoTSiteWise::Asset,\n and the operator is set to Equals or NotEquals, the ARN\n must be in the following format:

        \n
          \n
        • \n

          \n arn::iotsitewise:::asset/\n

          \n
          • \n
        \n

        When resources.type equals AWS::IoTSiteWise::TimeSeries,\n and the operator is set to Equals or NotEquals, the ARN\n must be in the following format:

        \n
          \n
        • \n

          \n arn::iotsitewise:::timeseries/\n

          \n
          • \n
        \n

        When resources.type equals AWS::IoTTwinMaker::Entity,\n and the operator is set to Equals or NotEquals, the ARN\n must be in the following format:

        \n
          \n
        • \n

          \n arn::iottwinmaker:::workspace//entity/\n

          \n
          • \n
        \n

        When resources.type equals AWS::IoTTwinMaker::Workspace,\n and the operator is set to Equals or NotEquals, the ARN\n must be in the following format:

        \n
          \n
        • \n

          \n arn::iottwinmaker:::workspace/\n

          \n
          • \n
        \n

        When resources.type equals AWS::KendraRanking::ExecutionPlan, and the\n operator is set to Equals or NotEquals, the ARN must be in\n the following format:

        \n
          \n
        • \n

          \n arn::kendra-ranking:::rescore-execution-plan/\n

          \n
          • \n
        \n

        When resources.type equals AWS::KinesisVideo::Stream, and the\n operator is set to Equals or NotEquals, the ARN must be in\n the following format:

        \n
          \n
        • \n

          \n arn::kinesisvideo:::stream//\n

          \n
          • \n
        \n

        When resources.type equals AWS::ManagedBlockchain::Network,\n and the operator is set to Equals or NotEquals, the ARN\n must be in the following format:

        \n
          \n
        • \n

          \n arn::managedblockchain:::networks/\n

          \n
          • \n
        \n

        When resources.type equals AWS::ManagedBlockchain::Node,\n and the operator is set to Equals or NotEquals, the ARN\n must be in the following format:

        \n
          \n
        • \n

          \n arn::managedblockchain:::nodes/\n

          \n
          • \n
        \n

        When resources.type equals AWS::MedicalImaging::Datastore,\n and the operator is set to Equals or NotEquals, the ARN\n must be in the following format:

        \n
          \n
        • \n

          \n arn::medical-imaging:::datastore/\n

          \n
          • \n
        \n

        When resources.type equals AWS::NeptuneGraph::Graph,\n and the operator is set to Equals or NotEquals, the ARN\n must be in the following format:

        \n
          \n
        • \n

          \n arn::neptune-graph:::graph/\n

          \n
          • \n
        \n

        When resources.type equals AWS::PCAConnectorAD::Connector,\n and the operator is set to Equals or NotEquals, the ARN\n must be in the following format:

        \n
          \n
        • \n

          \n arn::pca-connector-ad:::connector/\n

          \n
          • \n
        \n

        When resources.type equals AWS::QApps:QApp,\n and the operator is set to Equals or NotEquals, the ARN\n must be in the following format:

        \n
          \n
        • \n

          \n arn::qapps:::application//qapp/\n

          \n
          • \n
        \n

        When resources.type equals AWS::QBusiness::Application,\n and the operator is set to Equals or NotEquals, the ARN\n must be in the following format:

        \n
          \n
        • \n

          \n arn::qbusiness:::application/\n

          \n
          • \n
        \n

        When resources.type equals AWS::QBusiness::DataSource,\n and the operator is set to Equals or NotEquals, the ARN\n must be in the following format:

        \n
          \n
        • \n

          \n arn::qbusiness:::application//index//data-source/\n

          \n
          • \n
        \n

        When resources.type equals AWS::QBusiness::Index,\n and the operator is set to Equals or NotEquals, the ARN\n must be in the following format:

        \n
          \n
        • \n

          \n arn::qbusiness:::application//index/\n

          \n
          • \n
        \n

        When resources.type equals AWS::QBusiness::WebExperience,\n and the operator is set to Equals or NotEquals, the ARN\n must be in the following format:

        \n
          \n
        • \n

          \n arn::qbusiness:::application//web-experience/\n

          \n
          • \n
        \n

        When resources.type equals AWS::RDS::DBCluster,\n and the operator is set to Equals or NotEquals, the ARN\n must be in the following format:

        \n
          \n
        • \n

          \n arn::rds:::cluster/\n

          \n
          • \n
        \n

        When resources.type equals AWS::S3::AccessPoint, and the\n operator is set to Equals or NotEquals, the ARN must be in\n one of the following formats. To log events on all objects in an S3 access point, we\n recommend that you use only the access point ARN, don’t include the object path, and\n use the StartsWith or NotStartsWith operators.

        \n
          \n
        • \n

          \n arn::s3:::accesspoint/\n

          \n
          • \n
        • \n

          \n arn::s3:::accesspoint//object/\n

          \n
          • \n
        \n

        When resources.type equals\n AWS::S3ObjectLambda::AccessPoint, and the operator is set to\n Equals or NotEquals, the ARN must be in the following\n format:

        \n
          \n
        • \n

          \n arn::s3-object-lambda:::accesspoint/\n

          \n
          • \n
        \n

        When resources.type equals AWS::S3Outposts::Object, and\n the operator is set to Equals or NotEquals, the ARN must be\n in the following format:

        \n
          \n
        • \n

          \n arn::s3-outposts:::\n

          \n
          • \n
        \n

        When resources.type equals AWS::SageMaker::Endpoint, and the operator is set to\n Equals or NotEquals, the ARN must be in the following format:

        \n
          \n
        • \n

          \n arn::sagemaker:::endpoint/\n

          \n
          • \n
        \n

        When resources.type equals AWS::SageMaker::ExperimentTrialComponent, and the operator is set to\n Equals or NotEquals, the ARN must be in the following format:

        \n
          \n
        • \n

          \n arn::sagemaker:::experiment-trial-component/\n

          \n
          • \n
        \n

        When resources.type equals AWS::SageMaker::FeatureGroup, and the operator is set to\n Equals or NotEquals, the ARN must be in the following format:

        \n
          \n
        • \n

          \n arn::sagemaker:::feature-group/\n

          \n
          • \n
        \n

        When resources.type equals AWS::SCN::Instance, and the operator is set to\n Equals or NotEquals, the ARN must be in the following format:

        \n
          \n
        • \n

          \n arn::scn:::instance/\n

          \n
          • \n
        \n

        When resources.type equals AWS::ServiceDiscovery::Namespace, and the operator is set to\n Equals or NotEquals, the ARN must be in the following format:

        \n
          \n
        • \n

          \n arn::servicediscovery:::namespace/\n

          \n
          • \n
        \n

        When resources.type equals AWS::ServiceDiscovery::Service, and the operator is set to\n Equals or NotEquals, the ARN must be in the following format:

        \n
          \n
        • \n

          \n arn::servicediscovery:::service/\n

          \n
          • \n
        \n

        When resources.type equals AWS::SNS::PlatformEndpoint,\n and the operator is set to Equals or NotEquals, the ARN\n must be in the following format:

        \n
          \n
        • \n

          \n arn::sns:::endpoint///\n

          \n
          • \n
        \n

        When resources.type equals AWS::SNS::Topic,\n and the operator is set to Equals or NotEquals, the ARN\n must be in the following format:

        \n
          \n
        • \n

          \n arn::sns:::\n

          \n
          • \n
        \n

        When resources.type equals AWS::SQS::Queue,\n and the operator is set to Equals or NotEquals, the ARN\n must be in the following format:

        \n
          \n
        • \n

          \n arn::sqs:::\n

          \n
          • \n
        \n

        When resources.type equals AWS::SSM::ManagedNode, and\n the operator is set to Equals or NotEquals, the ARN must be\n in one of the following formats:

        \n
          \n
        • \n

          \n arn::ssm:::managed-instance/\n

          \n
          • \n
        • \n

          \n arn::ec2:::instance/\n

          \n
          • \n
        \n

        When resources.type equals AWS::SSMMessages::ControlChannel, and\n the operator is set to Equals or NotEquals, the ARN must be\n in the following format:

        \n
          \n
        • \n

          \n arn::ssmmessages:::control-channel/\n

          \n
          • \n
        \n

        When resources.type equals AWS::SWF::Domain,\n and the operator is set to Equals or NotEquals, the ARN\n must be in the following format:

        \n
          \n
        • \n

          \n arn::swf:::domain/\n

          \n
          • \n
        \n

        When resources.type equals AWS::ThinClient::Device, and\n the operator is set to Equals or NotEquals, the ARN must be\n in the following format:

        \n
          \n
        • \n

          \n arn::thinclient:::device/\n

          \n
          • \n
        \n

        When resources.type equals AWS::ThinClient::Environment, and\n the operator is set to Equals or NotEquals, the ARN must be\n in the following format:

        \n
          \n
        • \n

          \n arn::thinclient:::environment/\n

          \n
          • \n
        \n

        When resources.type equals AWS::Timestream::Database,\n and the operator is set to Equals or NotEquals, the ARN\n must be in the following format:

        \n
          \n
        • \n

          \n arn::timestream:::database/\n

          \n
          • \n
        \n

        When resources.type equals AWS::Timestream::Table,\n and the operator is set to Equals or NotEquals, the ARN\n must be in the following format:

        \n
          \n
        • \n

          \n arn::timestream:::database//table/\n

          \n
          • \n
        \n

        When resources.type equals AWS::VerifiedPermissions::PolicyStore, and the operator is\n set to Equals or NotEquals, the ARN must be in the\n following format:

        \n
          \n
        • \n

          \n arn::verifiedpermissions:::policy-store/\n

          \n
          • \n
        \n
        • \n
      ", + "smithy.api#documentation": "

      A field in a CloudTrail event record on which to filter events to be logged. For\n event data stores for CloudTrail Insights events, Config configuration items, Audit Manager evidence, or events outside of Amazon Web Services, the field is used only for\n selecting events as filtering is not supported.

      \n

      For CloudTrail management events, supported fields include eventCategory (required), eventSource, and readOnly.

      \n

      For CloudTrail data events, supported fields include eventCategory (required), resources.type (required), eventName, readOnly,\n and resources.ARN.

      \n

      For CloudTrail network activity events, supported fields include eventCategory (required), eventSource (required), eventName,\n errorCode, and vpcEndpointId.

      \n

      For event data stores for CloudTrail Insights events, Config configuration items, Audit Manager evidence, or events outside of Amazon Web Services, the only supported field is\n eventCategory.

      \n
        \n
      • \n

        \n \n readOnly\n - This is an optional field that is only used for management events and data events. This field can be set to\n Equals with a value of true or false. If you do\n not add this field, CloudTrail logs both read and\n write events. A value of true logs only\n read events. A value of false logs only\n write events.

        \n
        • \n
      • \n

        \n \n eventSource\n - This field is only used for management events and network activity events.

        \n

        For management events, this is an optional field that can be set to NotEquals\n kms.amazonaws.com to exclude KMS management events, or NotEquals\n rdsdata.amazonaws.com to exclude RDS management events.

        \n

        For network activity events, this is a required field that only uses the\n Equals operator. Set this field to the event source for which you want to\n log network activity events. If you want to log network activity events for multiple\n event sources, you must create a separate field selector for each event\n source.

        \n

        The following are valid values for network activity events:

        \n
          \n
        • \n

          \n cloudtrail.amazonaws.com\n

          \n
          • \n
        • \n

          \n ec2.amazonaws.com\n

          \n
          • \n
        • \n

          \n kms.amazonaws.com\n

          \n
          • \n
        • \n

          \n secretsmanager.amazonaws.com\n

          \n
          • \n
        \n
        • \n
      • \n

        \n \n eventName\n - This is an optional field that is only used for data events and network activity events. You can use any operator with \n eventName. You can use it to filter in or filter out specific events. You can have\n multiple values for this field, separated by commas.

        \n
        • \n
      • \n

        \n \n eventCategory\n - This field is required and\n must be set to Equals. \n

        \n
          \n
        • \n

          \n For CloudTrail management events, the value\n must be Management. \n

          \n
          • \n
        • \n

          \n For CloudTrail data events, the value\n must be Data. \n

          \n
          • \n
        • \n

          \n For CloudTrail network activity events, the value\n must be NetworkActivity. \n

          \n
          • \n
        \n

        The following are used only for event data stores:

        \n
          \n
        • \n

          \n For CloudTrail Insights events, the value\n must be Insight. \n

          \n
          • \n
        • \n

          \n For Config\n configuration items, the value must be ConfigurationItem.\n

          \n
          • \n
        • \n

          \n For Audit Manager evidence, the value must be Evidence.\n

          \n
          • \n
        • \n

          \n For non-Amazon Web Services events, the value must be ActivityAuditLog.\n

          \n
          • \n
        \n
        • \n
      • \n

        \n \n errorCode\n - This field is only used to filter CloudTrail network activity events\n and is optional. This is the error code to filter on. Currently, the only valid errorCode is VpceAccessDenied. \n errorCode can only use the Equals operator.

        \n
        • \n
      • \n

        \n \n resources.type\n - This field is\n required for CloudTrail data events. resources.type can only\n use the Equals operator.

        \n

        The value can be one of the following:

        \n
          \n
        • \n

          \n AWS::AppConfig::Configuration\n

          \n
          • \n
        • \n

          \n AWS::B2BI::Transformer\n

          \n
          • \n
        • \n

          \n AWS::Bedrock::AgentAlias\n

          \n
          • \n
        • \n

          \n AWS::Bedrock::FlowAlias\n

          \n
          • \n
        • \n

          \n AWS::Bedrock::Guardrail\n

          \n
          • \n
        • \n

          \n AWS::Bedrock::KnowledgeBase\n

          \n
          • \n
        • \n

          \n AWS::Cassandra::Table\n

          \n
          • \n
        • \n

          \n AWS::CloudFront::KeyValueStore\n

          \n
          • \n
        • \n

          \n AWS::CloudTrail::Channel\n

          \n
          • \n
        • \n

          \n AWS::CloudWatch::Metric\n

          \n
          • \n
        • \n

          \n AWS::CodeWhisperer::Customization\n

          \n
          • \n
        • \n

          \n AWS::CodeWhisperer::Profile\n

          \n
          • \n
        • \n

          \n AWS::Cognito::IdentityPool\n

          \n
          • \n
        • \n

          \n AWS::DynamoDB::Stream\n

          \n
          • \n
        • \n

          \n AWS::DynamoDB::Table\n

          \n
          • \n
        • \n

          \n AWS::EC2::Snapshot\n

          \n
          • \n
        • \n

          \n AWS::EMRWAL::Workspace\n

          \n
          • \n
        • \n

          \n AWS::FinSpace::Environment\n

          \n
          • \n
        • \n

          \n AWS::Glue::Table\n

          \n
          • \n
        • \n

          \n AWS::GreengrassV2::ComponentVersion\n

          \n
          • \n
        • \n

          \n AWS::GreengrassV2::Deployment\n

          \n
          • \n
        • \n

          \n AWS::GuardDuty::Detector\n

          \n
          • \n
        • \n

          \n AWS::IoT::Certificate\n

          \n
          • \n
        • \n

          \n AWS::IoT::Thing\n

          \n
          • \n
        • \n

          \n AWS::IoTSiteWise::Asset\n

          \n
          • \n
        • \n

          \n AWS::IoTSiteWise::TimeSeries\n

          \n
          • \n
        • \n

          \n AWS::IoTTwinMaker::Entity\n

          \n
          • \n
        • \n

          \n AWS::IoTTwinMaker::Workspace\n

          \n
          • \n
        • \n

          \n AWS::KendraRanking::ExecutionPlan\n

          \n
          • \n
        • \n

          \n AWS::Kinesis::Stream\n

          \n
          • \n
        • \n

          \n AWS::Kinesis::StreamConsumer\n

          \n
          • \n
        • \n

          \n AWS::KinesisVideo::Stream\n

          \n
          • \n
        • \n

          \n AWS::Lambda::Function\n

          \n
          • \n
        • \n

          \n AWS::MachineLearning::MlModel\n

          \n
          • \n
        • \n

          \n AWS::ManagedBlockchain::Network\n

          \n
          • \n
        • \n

          \n AWS::ManagedBlockchain::Node\n

          \n
          • \n
        • \n

          \n AWS::MedicalImaging::Datastore\n

          \n
          • \n
        • \n

          \n AWS::NeptuneGraph::Graph\n

          \n
          • \n
        • \n

          \n AWS::One::UKey\n

          \n
          • \n
        • \n

          \n AWS::One::User\n

          \n
          • \n
        • \n

          \n AWS::PaymentCryptography::Alias\n

          \n
          • \n
        • \n

          \n AWS::PaymentCryptography::Key\n

          \n
          • \n
        • \n

          \n AWS::PCAConnectorAD::Connector\n

          \n
          • \n
        • \n

          \n AWS::PCAConnectorSCEP::Connector\n

          \n
          • \n
        • \n

          \n AWS::QApps:QApp\n

          \n
          • \n
        • \n

          \n AWS::QBusiness::Application\n

          \n
          • \n
        • \n

          \n AWS::QBusiness::DataSource\n

          \n
          • \n
        • \n

          \n AWS::QBusiness::Index\n

          \n
          • \n
        • \n

          \n AWS::QBusiness::WebExperience\n

          \n
          • \n
        • \n

          \n AWS::RDS::DBCluster\n

          \n
          • \n
        • \n

          \n AWS::RUM::AppMonitor\n

          \n
          • \n
        • \n

          \n AWS::S3::AccessPoint\n

          \n
          • \n
        • \n

          \n AWS::S3::Object\n

          \n
          • \n
        • \n

          \n AWS::S3Express::Object\n

          \n
          • \n
        • \n

          \n AWS::S3ObjectLambda::AccessPoint\n

          \n
          • \n
        • \n

          \n AWS::S3Outposts::Object\n

          \n
          • \n
        • \n

          \n AWS::SageMaker::Endpoint\n

          \n
          • \n
        • \n

          \n AWS::SageMaker::ExperimentTrialComponent\n

          \n
          • \n
        • \n

          \n AWS::SageMaker::FeatureGroup\n

          \n
          • \n
        • \n

          \n AWS::ServiceDiscovery::Namespace \n

          \n
          • \n
        • \n

          \n AWS::ServiceDiscovery::Service\n

          \n
          • \n
        • \n

          \n AWS::SCN::Instance\n

          \n
          • \n
        • \n

          \n AWS::SNS::PlatformEndpoint\n

          \n
          • \n
        • \n

          \n AWS::SNS::Topic\n

          \n
          • \n
        • \n

          \n AWS::SQS::Queue\n

          \n
          • \n
        • \n

          \n AWS::SSM::ManagedNode\n

          \n
          • \n
        • \n

          \n AWS::SSMMessages::ControlChannel\n

          \n
          • \n
        • \n

          \n AWS::StepFunctions::StateMachine\n

          \n
          • \n
        • \n

          \n AWS::SWF::Domain\n

          \n
          • \n
        • \n

          \n AWS::ThinClient::Device\n

          \n
          • \n
        • \n

          \n AWS::ThinClient::Environment\n

          \n
          • \n
        • \n

          \n AWS::Timestream::Database\n

          \n
          • \n
        • \n

          \n AWS::Timestream::Table\n

          \n
          • \n
        • \n

          \n AWS::VerifiedPermissions::PolicyStore\n

          \n
          • \n
        • \n

          \n AWS::XRay::Trace\n

          \n
          • \n
        \n

        You can have only one resources.type field per selector. To log events on more than one resource type, add another selector.

        \n
        • \n
      • \n

        \n \n resources.ARN\n - The resources.ARN is an optional field for \n data events. You can use any\n operator with resources.ARN, but if you use Equals or\n NotEquals, the value must exactly match the ARN of a valid resource\n of the type you've specified in the template as the value of resources.type. To log all data events for all objects in a specific S3 bucket, \n use the StartsWith operator, and include only the bucket ARN as the matching value.

        \n

        For information about filtering data events on the resources.ARN field, see \n Filtering data \n events by resources.ARN in the CloudTrail User Guide.

        \n \n

        You can't use the resources.ARN field to filter resource types that do not have ARNs.

        \n         \n
        • \n
      • \n

        \n \n vpcEndpointId\n - This field is only used to filter CloudTrail network activity events\n and is optional. This field identifies the VPC endpoint that the request passed through. You can use any operator with vpcEndpointId.

        \n
        • \n
      ", "smithy.api#required": {} } }, @@ -2551,12 +2551,12 @@ "Values": { "target": "com.amazonaws.cloudtrail#DataResourceValues", "traits": { - "smithy.api#documentation": "

      An array of Amazon Resource Name (ARN) strings or partial ARN strings for the specified\n resource type.

      \n
        \n
      • \n

        To log data events for all objects in all S3 buckets in your Amazon Web Services account, specify the prefix as arn:aws:s3.

        \n \n

        This also enables logging of data event activity performed by any user or role\n in your Amazon Web Services account, even if that activity is performed on a bucket\n that belongs to another Amazon Web Services account.

        \n         \n
        • \n
      • \n

        To log data events for all objects in an S3 bucket, specify the bucket and an\n empty object prefix such as arn:aws:s3:::bucket-1/. The trail logs data\n events for all objects in this S3 bucket.

        \n
        • \n
      • \n

        To log data events for specific objects, specify the S3 bucket and object prefix\n such as arn:aws:s3:::bucket-1/example-images. The trail logs data events\n for objects in this S3 bucket that match the prefix.

        \n
        • \n
      • \n

        To log data events for all Lambda functions in your Amazon Web Services account, specify the prefix as arn:aws:lambda.

        \n \n

        This also enables logging of Invoke activity performed by any user\n or role in your Amazon Web Services account, even if that activity is performed on\n a function that belongs to another Amazon Web Services account.

        \n         \n
        • \n
      • \n

        To log data events for a specific Lambda function, specify the\n function ARN.

        \n \n

        Lambda function ARNs are exact. For example, if you specify a\n function ARN\n arn:aws:lambda:us-west-2:111111111111:function:helloworld,\n data events will only be logged for\n arn:aws:lambda:us-west-2:111111111111:function:helloworld.\n They will not be logged for\n arn:aws:lambda:us-west-2:111111111111:function:helloworld2.

        \n         \n
        • \n
      • \n

        To log data events for all DynamoDB tables in your Amazon Web Services account, specify the prefix as arn:aws:dynamodb.

        \n
        • \n
      " + "smithy.api#documentation": "

      An array of Amazon Resource Name (ARN) strings or partial ARN strings for the specified\n resource type.

      \n
        \n
      • \n

        To log data events for all objects in all S3 buckets in your Amazon Web Services account, specify the prefix as arn:aws:s3.

        \n \n

        This also enables logging of data event activity performed by any user or role\n in your Amazon Web Services account, even if that activity is performed on a bucket\n that belongs to another Amazon Web Services account.

        \n         \n
        • \n
      • \n

        To log data events for all objects in an S3 bucket, specify the bucket and an\n empty object prefix such as arn:aws:s3:::amzn-s3-demo-bucket1/. The trail logs data\n events for all objects in this S3 bucket.

        \n
        • \n
      • \n

        To log data events for specific objects, specify the S3 bucket and object prefix\n such as arn:aws:s3:::amzn-s3-demo-bucket1/example-images. The trail logs data events\n for objects in this S3 bucket that match the prefix.

        \n
        • \n
      • \n

        To log data events for all Lambda functions in your Amazon Web Services account, specify the prefix as arn:aws:lambda.

        \n \n

        This also enables logging of Invoke activity performed by any user\n or role in your Amazon Web Services account, even if that activity is performed on\n a function that belongs to another Amazon Web Services account.

        \n         \n
        • \n
      • \n

        To log data events for a specific Lambda function, specify the\n function ARN.

        \n \n

        Lambda function ARNs are exact. For example, if you specify a\n function ARN\n arn:aws:lambda:us-west-2:111111111111:function:helloworld,\n data events will only be logged for\n arn:aws:lambda:us-west-2:111111111111:function:helloworld.\n They will not be logged for\n arn:aws:lambda:us-west-2:111111111111:function:helloworld2.

        \n         \n
        • \n
      • \n

        To log data events for all DynamoDB tables in your Amazon Web Services account, specify the prefix as arn:aws:dynamodb.

        \n
        • \n
      " } } }, "traits": { - "smithy.api#documentation": "

      Data events provide information about the resource operations performed on or within a resource\n itself. These are also known as data plane operations. You can specify up to 250 data\n resources for a trail.

      \n

      Configure the DataResource to specify the resource type and resource ARNs for which you want to log data events.

      \n

      You can specify the following resource types in your event selectors for your trail:

      \n
        \n
      • \n

        \n AWS::DynamoDB::Table\n

        \n
        • \n
      • \n

        \n AWS::Lambda::Function\n

        \n
        • \n
      • \n

        \n AWS::S3::Object\n

        \n
        • \n
      \n \n

      The total number of allowed data resources is 250. This number can be distributed\n between 1 and 5 event selectors, but the total cannot exceed 250 across all\n selectors for the trail.

      \n

      If you are using advanced event selectors, the maximum total number of values for\n all conditions, across all advanced event selectors for the trail, is 500.

      \n       \n

      The following example demonstrates how logging works when you configure logging of all\n data events for an S3 bucket named bucket-1. In this example, the CloudTrail user specified an empty prefix, and the option to log both Read\n and Write data events.

      \n
        \n
      1. \n

        A user uploads an image file to bucket-1.

        \n
        2. \n
      2. \n

        The PutObject API operation is an Amazon S3 object-level API.\n It is recorded as a data event in CloudTrail. Because the CloudTrail\n user specified an S3 bucket with an empty prefix, events that occur on any object in\n that bucket are logged. The trail processes and logs the event.

        \n
        3. \n
      3. \n

        A user uploads an object to an Amazon S3 bucket named\n arn:aws:s3:::bucket-2.

        \n
        4. \n
      4. \n

        The PutObject API operation occurred for an object in an S3 bucket\n that the CloudTrail user didn't specify for the trail. The trail doesn’t log\n the event.

        \n
        5. \n
      \n

      The following example demonstrates how logging works when you configure logging of\n Lambda data events for a Lambda function named\n MyLambdaFunction, but not for all Lambda\n functions.

      \n
        \n
      1. \n

        A user runs a script that includes a call to the\n MyLambdaFunction function and the\n MyOtherLambdaFunction function.

        \n
        2. \n
      2. \n

        The Invoke API operation on MyLambdaFunction is\n an Lambda API. It is recorded as a data event in CloudTrail.\n Because the CloudTrail user specified logging data events for\n MyLambdaFunction, any invocations of that function are\n logged. The trail processes and logs the event.

        \n
        3. \n
      3. \n

        The Invoke API operation on\n MyOtherLambdaFunction is an Lambda API. Because\n the CloudTrail user did not specify logging data events for all Lambda functions, the Invoke operation for\n MyOtherLambdaFunction does not match the function specified\n for the trail. The trail doesn’t log the event.

        \n
        4. \n
      " + "smithy.api#documentation": "

      You can configure the DataResource in an EventSelector to log data events for the following three resource types:

      \n
        \n
      • \n

        \n AWS::DynamoDB::Table\n

        \n
        • \n
      • \n

        \n AWS::Lambda::Function\n

        \n
        • \n
      • \n

        \n AWS::S3::Object\n

        \n
        • \n
      \n

      To log data events for all other resource types including objects stored in \n directory buckets, you must use AdvancedEventSelectors. You must also \n use AdvancedEventSelectors if you want to filter on the eventName field.

      \n

      Configure the DataResource to specify the resource type and resource ARNs for which you want to log data events.

      \n \n

      The total number of allowed data resources is 250. This number can be distributed\n between 1 and 5 event selectors, but the total cannot exceed 250 across all\n selectors for the trail.

      \n       \n

      The following example demonstrates how logging works when you configure logging of all\n data events for a general purpose bucket named amzn-s3-demo-bucket1. In this example, the CloudTrail user specified an empty prefix, and the option to log both Read\n and Write data events.

      \n
        \n
      1. \n

        A user uploads an image file to amzn-s3-demo-bucket1.

        \n
        2. \n
      2. \n

        The PutObject API operation is an Amazon S3 object-level API.\n It is recorded as a data event in CloudTrail. Because the CloudTrail\n user specified an S3 bucket with an empty prefix, events that occur on any object in\n that bucket are logged. The trail processes and logs the event.

        \n
        3. \n
      3. \n

        A user uploads an object to an Amazon S3 bucket named\n arn:aws:s3:::amzn-s3-demo-bucket1.

        \n
        4. \n
      4. \n

        The PutObject API operation occurred for an object in an S3 bucket\n that the CloudTrail user didn't specify for the trail. The trail doesn’t log\n the event.

        \n
        5. \n
      \n

      The following example demonstrates how logging works when you configure logging of\n Lambda data events for a Lambda function named\n MyLambdaFunction, but not for all Lambda\n functions.

      \n
        \n
      1. \n

        A user runs a script that includes a call to the\n MyLambdaFunction function and the\n MyOtherLambdaFunction function.

        \n
        2. \n
      2. \n

        The Invoke API operation on MyLambdaFunction is\n an Lambda API. It is recorded as a data event in CloudTrail.\n Because the CloudTrail user specified logging data events for\n MyLambdaFunction, any invocations of that function are\n logged. The trail processes and logs the event.

        \n
        3. \n
      3. \n

        The Invoke API operation on\n MyOtherLambdaFunction is an Lambda API. Because\n the CloudTrail user did not specify logging data events for all Lambda functions, the Invoke operation for\n MyOtherLambdaFunction does not match the function specified\n for the trail. The trail doesn’t log the event.

        \n
        4. \n
      " } }, "com.amazonaws.cloudtrail#DataResourceValues": { @@ -3867,7 +3867,7 @@ "DataResources": { "target": "com.amazonaws.cloudtrail#DataResources", "traits": { - "smithy.api#documentation": "

      CloudTrail supports data event logging for Amazon S3 objects, Lambda functions, and Amazon DynamoDB tables with basic event selectors.\n You can specify up to 250 resources for an individual event selector, but the total number\n of data resources cannot exceed 250 across all event selectors in a trail. This limit does\n not apply if you configure resource logging for all data events.

      \n

      For more information, see Data\n Events and Limits in CloudTrail in the CloudTrail User\n Guide.

      " + "smithy.api#documentation": "

      CloudTrail supports data event logging for Amazon S3 objects in standard S3 buckets, Lambda functions, and Amazon DynamoDB tables with basic event selectors.\n You can specify up to 250 resources for an individual event selector, but the total number\n of data resources cannot exceed 250 across all event selectors in a trail. This limit does\n not apply if you configure resource logging for all data events.

      \n

      For more information, see Data\n Events and Limits in CloudTrail in the CloudTrail User\n Guide.

      \n \n

      To log data events for all other resource types including objects stored in \n directory buckets, you must use AdvancedEventSelectors. You must also \n use AdvancedEventSelectors if you want to filter on the eventName field.

      \n       " } }, "ExcludeManagementEventSources": { @@ -4209,7 +4209,7 @@ } ], "traits": { - "smithy.api#documentation": "

      Describes the settings for the event selectors that you configured for your trail. The\n information returned for your event selectors includes the following:

      \n
        \n
      • \n

        If your event selector includes read-only events, write-only events, or all\n events. This applies to both management events and data events.

        \n
        • \n
      • \n

        If your event selector includes management events.

        \n
        • \n
      • \n

        If your event selector includes data events, the resources on which you are\n logging data events.

        \n
        • \n
      \n

      For more information about logging management and data events, see the following topics\n in the CloudTrail User Guide:

      \n ", + "smithy.api#documentation": "

      Describes the settings for the event selectors that you configured for your trail. The\n information returned for your event selectors includes the following:

      \n
        \n
      • \n

        If your event selector includes read-only events, write-only events, or all\n events. This applies to management events, data events, and network activity events.

        \n
        • \n
      • \n

        If your event selector includes management events.

        \n
        • \n
      • \n

        If your event selector includes network activity events, the event sources \n for which you are logging network activity events.

        \n
        • \n
      • \n

        If your event selector includes data events, the resources on which you are\n logging data events.

        \n
        • \n
      \n

      For more information about logging management, data, and network activity events, see the following topics\n in the CloudTrail User Guide:

      \n ", "smithy.api#idempotent": {} } }, @@ -7366,7 +7366,7 @@ } ], "traits": { - "smithy.api#documentation": "

      Configures an event selector or advanced event selectors for your trail. Use event\n selectors or advanced event selectors to specify management and data event settings for\n your trail. If you want your trail to log Insights events, be sure the event selector \n enables logging of the Insights event types you want configured for your trail. For more information about logging Insights events, see Logging Insights events in the CloudTrail User Guide.\n By default, trails created without specific event selectors are configured to\n log all read and write management events, and no data events.

      \n

      When an event occurs in your account, CloudTrail evaluates the event selectors or\n advanced event selectors in all trails. For each trail, if the event matches any event\n selector, the trail processes and logs the event. If the event doesn't match any event\n selector, the trail doesn't log the event.

      \n

      Example

      \n
        \n
      1. \n

        You create an event selector for a trail and specify that you want write-only\n events.

        \n
        2. \n
      2. \n

        The EC2 GetConsoleOutput and RunInstances API operations\n occur in your account.

        \n
        3. \n
      3. \n

        CloudTrail evaluates whether the events match your event selectors.

        \n
        4. \n
      4. \n

        The RunInstances is a write-only event and it matches your event\n selector. The trail logs the event.

        \n
        5. \n
      5. \n

        The GetConsoleOutput is a read-only event that doesn't match your\n event selector. The trail doesn't log the event.

        \n
        6. \n
      \n

      The PutEventSelectors operation must be called from the Region in which the\n trail was created; otherwise, an InvalidHomeRegionException exception is\n thrown.

      \n

      You can configure up to five event selectors for each trail. For more information, see\n Logging management events, Logging\n data events, and Quotas in CloudTrail in the CloudTrail User\n Guide.

      \n

      You can add advanced event selectors, and conditions for your advanced event selectors,\n up to a maximum of 500 values for all conditions and selectors on a trail. You can use\n either AdvancedEventSelectors or EventSelectors, but not both. If\n you apply AdvancedEventSelectors to a trail, any existing\n EventSelectors are overwritten. For more information about advanced event\n selectors, see Logging data events in the CloudTrail User Guide.

      ", + "smithy.api#documentation": "

      Configures event selectors (also referred to as basic event selectors) or advanced event selectors for your trail. You can use\n either AdvancedEventSelectors or EventSelectors, but not both. If\n you apply AdvancedEventSelectors to a trail, any existing\n EventSelectors are overwritten.

      \n

      You can use AdvancedEventSelectors to \n log management events, data events for all resource types, and network activity events.

      \n

      You can use EventSelectors to log management events and data events for the following resource types:

      \n
        \n
      • \n

        \n AWS::DynamoDB::Table\n

        \n
        • \n
      • \n

        \n AWS::Lambda::Function\n

        \n
        • \n
      • \n

        \n AWS::S3::Object\n

        \n
        • \n
      \n

      You can't use EventSelectors to log network activity events.

      \n

      If you want your trail to log Insights events, be sure the event selector or advanced event selector enables \n logging of the Insights event types you want configured for your trail. For more information about logging Insights events, see Logging Insights events in the CloudTrail User Guide.\n By default, trails created without specific event selectors are configured to\n log all read and write management events, and no data events or network activity events.

      \n

      When an event occurs in your account, CloudTrail evaluates the event selectors or\n advanced event selectors in all trails. For each trail, if the event matches any event\n selector, the trail processes and logs the event. If the event doesn't match any event\n selector, the trail doesn't log the event.

      \n

      Example

      \n
        \n
      1. \n

        You create an event selector for a trail and specify that you want to log write-only\n events.

        \n
        2. \n
      2. \n

        The EC2 GetConsoleOutput and RunInstances API operations\n occur in your account.

        \n
        3. \n
      3. \n

        CloudTrail evaluates whether the events match your event selectors.

        \n
        4. \n
      4. \n

        The RunInstances is a write-only event and it matches your event\n selector. The trail logs the event.

        \n
        5. \n
      5. \n

        The GetConsoleOutput is a read-only event that doesn't match your\n event selector. The trail doesn't log the event.

        \n
        6. \n
      \n

      The PutEventSelectors operation must be called from the Region in which the\n trail was created; otherwise, an InvalidHomeRegionException exception is\n thrown.

      \n

      You can configure up to five event selectors for each trail.

      \n

      You can add advanced event selectors, and conditions for your advanced event selectors,\n up to a maximum of 500 values for all conditions and selectors on a trail. For more information, see\n Logging management events, Logging\n data events, Logging\n network activity events, and Quotas in CloudTrail in the CloudTrail User\n Guide.

      ", "smithy.api#idempotent": {} } }, @@ -7383,13 +7383,13 @@ "EventSelectors": { "target": "com.amazonaws.cloudtrail#EventSelectors", "traits": { - "smithy.api#documentation": "

      Specifies the settings for your event selectors. You can configure up to five event\n selectors for a trail. You can use either EventSelectors or\n AdvancedEventSelectors in a PutEventSelectors request, but not\n both. If you apply EventSelectors to a trail, any existing\n AdvancedEventSelectors are overwritten.

      " + "smithy.api#documentation": "

      Specifies the settings for your event selectors. You can use event selectors to log management events and data events for the following resource types:

      \n
        \n
      • \n

        \n AWS::DynamoDB::Table\n

        \n
        • \n
      • \n

        \n AWS::Lambda::Function\n

        \n
        • \n
      • \n

        \n AWS::S3::Object\n

        \n
        • \n
      \n

      You can't use event selectors to log network activity events.

      \n

      You can configure up to five event\n selectors for a trail. You can use either EventSelectors or\n AdvancedEventSelectors in a PutEventSelectors request, but not\n both. If you apply EventSelectors to a trail, any existing\n AdvancedEventSelectors are overwritten.

      " } }, "AdvancedEventSelectors": { "target": "com.amazonaws.cloudtrail#AdvancedEventSelectors", "traits": { - "smithy.api#documentation": "

      Specifies the settings for advanced event selectors. You can add advanced event\n selectors, and conditions for your advanced event selectors, up to a maximum of 500 values\n for all conditions and selectors on a trail. You can use either\n AdvancedEventSelectors or EventSelectors, but not both. If you\n apply AdvancedEventSelectors to a trail, any existing\n EventSelectors are overwritten. For more information about advanced event\n selectors, see Logging data events in the CloudTrail User Guide.

      " + "smithy.api#documentation": "

      Specifies the settings for advanced event selectors. You can use advanced event selectors to \n log management events, data events for all resource types, and network activity events.

      \n

      You can add advanced event\n selectors, and conditions for your advanced event selectors, up to a maximum of 500 values\n for all conditions and selectors on a trail. You can use either\n AdvancedEventSelectors or EventSelectors, but not both. If you\n apply AdvancedEventSelectors to a trail, any existing\n EventSelectors are overwritten. For more information about advanced event\n selectors, see Logging data events and \n Logging network activity events\n in the CloudTrail User Guide.

      " } } }, @@ -8518,7 +8518,7 @@ } ], "traits": { - "smithy.api#documentation": "

      Starts the ingestion of live events on an event data store specified as either an ARN or the ID portion of the ARN. To start ingestion, the event data store Status must be STOPPED_INGESTION \n and the eventCategory must be Management, Data, or ConfigurationItem.

      " + "smithy.api#documentation": "

      Starts the ingestion of live events on an event data store specified as either an ARN or the ID portion of the ARN. To start ingestion, the event data store Status must be STOPPED_INGESTION \n and the eventCategory must be Management, Data, NetworkActivity, or ConfigurationItem.

      " } }, "com.amazonaws.cloudtrail#StartEventDataStoreIngestionRequest": { @@ -8903,7 +8903,7 @@ } ], "traits": { - "smithy.api#documentation": "

      Stops the ingestion of live events on an event data store specified as either an ARN or the ID portion of the ARN. To stop ingestion, the event data store Status must be ENABLED \n and the eventCategory must be Management, Data, or ConfigurationItem.

      " + "smithy.api#documentation": "

      Stops the ingestion of live events on an event data store specified as either an ARN or the ID portion of the ARN. To stop ingestion, the event data store Status must be ENABLED \n and the eventCategory must be Management, Data, NetworkActivity, or ConfigurationItem.

      " } }, "com.amazonaws.cloudtrail#StopEventDataStoreIngestionRequest": { @@ -9621,7 +9621,7 @@ } ], "traits": { - "smithy.api#documentation": "

      Updates an event data store. The required EventDataStore value is an ARN or\n the ID portion of the ARN. Other parameters are optional, but at least one optional\n parameter must be specified, or CloudTrail throws an error.\n RetentionPeriod is in days, and valid values are integers between 7 and\n 3653 if the BillingMode is set to EXTENDABLE_RETENTION_PRICING, or between 7 and 2557 if BillingMode is set to FIXED_RETENTION_PRICING. By default, TerminationProtection is enabled.

      \n

      For event data stores for CloudTrail events, AdvancedEventSelectors\n includes or excludes management or data events in your event data store. For more\n information about AdvancedEventSelectors, see AdvancedEventSelectors.

      \n

      For event data stores for CloudTrail Insights events, Config configuration items, Audit Manager evidence, or non-Amazon Web Services events,\n AdvancedEventSelectors includes events of that type in your event data store.

      ", + "smithy.api#documentation": "

      Updates an event data store. The required EventDataStore value is an ARN or\n the ID portion of the ARN. Other parameters are optional, but at least one optional\n parameter must be specified, or CloudTrail throws an error.\n RetentionPeriod is in days, and valid values are integers between 7 and\n 3653 if the BillingMode is set to EXTENDABLE_RETENTION_PRICING, or between 7 and 2557 if BillingMode is set to FIXED_RETENTION_PRICING. By default, TerminationProtection is enabled.

      \n

      For event data stores for CloudTrail events, AdvancedEventSelectors\n includes or excludes management, data, or network activity events in your event data store. For more\n information about AdvancedEventSelectors, see AdvancedEventSelectors.

      \n

      For event data stores for CloudTrail Insights events, Config configuration items, Audit Manager evidence, or non-Amazon Web Services events,\n AdvancedEventSelectors includes events of that type in your event data store.

      ", "smithy.api#idempotent": {} } },