Class CfnTrail
- All Implemented Interfaces:
IConstruct
,IDependable
,IInspectable
,software.amazon.jsii.JsiiSerializable
,software.constructs.IConstruct
AWS::CloudTrail::Trail
.
Creates a trail that specifies the settings for delivery of log data to an Amazon S3 bucket.
Example:
// The code below shows an example of how to instantiate this type. // The values are placeholders you should change. import software.amazon.awscdk.services.cloudtrail.*; CfnTrail cfnTrail = CfnTrail.Builder.create(this, "MyCfnTrail") .isLogging(false) .s3BucketName("s3BucketName") // the properties below are optional .advancedEventSelectors(List.of(AdvancedEventSelectorProperty.builder() .fieldSelectors(List.of(AdvancedFieldSelectorProperty.builder() .field("field") // the properties below are optional .endsWith(List.of("endsWith")) .equalTo(List.of("equalTo")) .notEndsWith(List.of("notEndsWith")) .notEquals(List.of("notEquals")) .notStartsWith(List.of("notStartsWith")) .startsWith(List.of("startsWith")) .build())) // the properties below are optional .name("name") .build())) .cloudWatchLogsLogGroupArn("cloudWatchLogsLogGroupArn") .cloudWatchLogsRoleArn("cloudWatchLogsRoleArn") .enableLogFileValidation(false) .eventSelectors(List.of(EventSelectorProperty.builder() .dataResources(List.of(DataResourceProperty.builder() .type("type") // the properties below are optional .values(List.of("values")) .build())) .excludeManagementEventSources(List.of("excludeManagementEventSources")) .includeManagementEvents(false) .readWriteType("readWriteType") .build())) .includeGlobalServiceEvents(false) .insightSelectors(List.of(InsightSelectorProperty.builder() .insightType("insightType") .build())) .isMultiRegionTrail(false) .isOrganizationTrail(false) .kmsKeyId("kmsKeyId") .s3KeyPrefix("s3KeyPrefix") .snsTopicName("snsTopicName") .tags(List.of(CfnTag.builder() .key("key") .value("value") .build())) .trailName("trailName") .build();
-
Nested Class Summary
Modifier and TypeClassDescriptionstatic interface
Advanced event selectors let you create fine-grained selectors for the following AWS CloudTrail event record fields.static interface
A single selector statement in an advanced event selector.static final class
A fluent builder forCfnTrail
.static interface
The Amazon S3 buckets, AWS Lambda functions, or Amazon DynamoDB tables that you specify in event selectors in your AWS CloudFormation template for your trail to log data events.static interface
Use event selectors to further specify the management and data event settings for your trail.static interface
A JSON string that contains a list of Insights types that are logged on a trail.Nested classes/interfaces inherited from class software.amazon.jsii.JsiiObject
software.amazon.jsii.JsiiObject.InitializationMode
Nested classes/interfaces inherited from interface software.amazon.awscdk.core.IConstruct
IConstruct.Jsii$Default
Nested classes/interfaces inherited from interface software.constructs.IConstruct
software.constructs.IConstruct.Jsii$Default
Nested classes/interfaces inherited from interface software.amazon.awscdk.core.IInspectable
IInspectable.Jsii$Default, IInspectable.Jsii$Proxy
-
Field Summary
Modifier and TypeFieldDescriptionstatic final String
The CloudFormation resource type name for this resource class. -
Constructor Summary
-
Method Summary
Modifier and TypeMethodDescriptionSpecifies the settings for advanced event selectors.Ref
returns the ARN of the CloudTrail trail, such asarn:aws:cloudtrail:us-east-2:123456789012:trail/myCloudTrail
.Ref
returns the ARN of the Amazon SNS topic that's associated with the CloudTrail trail, such asarn:aws:sns:us-east-2:123456789012:mySNSTopic
.Specifies a log group name using an Amazon Resource Name (ARN), a unique identifier that represents the log group to which CloudTrail logs are delivered.Specifies the role for the CloudWatch Logs endpoint to assume to write to a user's log group.Specifies whether log file validation is enabled.Use event selectors to further specify the management and data event settings for your trail.Specifies whether the trail is publishing events from global services such as IAM to the log files.A JSON string that contains the insight types you want to log on a trail.Whether the CloudTrail trail is currently logging AWS API calls.Specifies whether the trail applies only to the current Region or to all Regions.Specifies whether the trail is applied to all accounts in an organization in AWS Organizations , or only for the current AWS account .Specifies the AWS KMS key ID to use to encrypt the logs delivered by CloudTrail.Specifies the name of the Amazon S3 bucket designated for publishing log files.Specifies the Amazon S3 key prefix that comes after the name of the bucket you have designated for log file delivery.Specifies the name of the Amazon SNS topic defined for notification of log file delivery.getTags()
A custom set of tags (key-value pairs) for this trail.Specifies the name of the trail.void
inspect
(TreeInspector inspector) Examines the CloudFormation resource and discloses attributes.renderProperties
(Map<String, Object> props) void
setAdvancedEventSelectors
(List<Object> value) Specifies the settings for advanced event selectors.void
Specifies the settings for advanced event selectors.void
Specifies a log group name using an Amazon Resource Name (ARN), a unique identifier that represents the log group to which CloudTrail logs are delivered.void
setCloudWatchLogsRoleArn
(String value) Specifies the role for the CloudWatch Logs endpoint to assume to write to a user's log group.void
Specifies whether log file validation is enabled.void
Specifies whether log file validation is enabled.void
setEventSelectors
(List<Object> value) Use event selectors to further specify the management and data event settings for your trail.void
setEventSelectors
(IResolvable value) Use event selectors to further specify the management and data event settings for your trail.void
Specifies whether the trail is publishing events from global services such as IAM to the log files.void
Specifies whether the trail is publishing events from global services such as IAM to the log files.void
setInsightSelectors
(List<Object> value) A JSON string that contains the insight types you want to log on a trail.void
setInsightSelectors
(IResolvable value) A JSON string that contains the insight types you want to log on a trail.void
setIsLogging
(Boolean value) Whether the CloudTrail trail is currently logging AWS API calls.void
setIsLogging
(IResolvable value) Whether the CloudTrail trail is currently logging AWS API calls.void
setIsMultiRegionTrail
(Boolean value) Specifies whether the trail applies only to the current Region or to all Regions.void
setIsMultiRegionTrail
(IResolvable value) Specifies whether the trail applies only to the current Region or to all Regions.void
setIsOrganizationTrail
(Boolean value) Specifies whether the trail is applied to all accounts in an organization in AWS Organizations , or only for the current AWS account .void
Specifies whether the trail is applied to all accounts in an organization in AWS Organizations , or only for the current AWS account .void
setKmsKeyId
(String value) Specifies the AWS KMS key ID to use to encrypt the logs delivered by CloudTrail.void
setS3BucketName
(String value) Specifies the name of the Amazon S3 bucket designated for publishing log files.void
setS3KeyPrefix
(String value) Specifies the Amazon S3 key prefix that comes after the name of the bucket you have designated for log file delivery.void
setSnsTopicName
(String value) Specifies the name of the Amazon SNS topic defined for notification of log file delivery.void
setTrailName
(String value) Specifies the name of the trail.Methods inherited from class software.amazon.awscdk.core.CfnResource
addDeletionOverride, addDependsOn, addMetadata, addOverride, addPropertyDeletionOverride, addPropertyOverride, applyRemovalPolicy, applyRemovalPolicy, applyRemovalPolicy, getAtt, getCfnOptions, getCfnResourceType, getMetadata, getUpdatedProperites, isCfnResource, shouldSynthesize, toString, validateProperties
Methods inherited from class software.amazon.awscdk.core.CfnRefElement
getRef
Methods inherited from class software.amazon.awscdk.core.CfnElement
getCreationStack, getLogicalId, getStack, isCfnElement, overrideLogicalId
Methods inherited from class software.amazon.awscdk.core.Construct
getNode, isConstruct, onPrepare, onSynthesize, onValidate, prepare, synthesize, validate
Methods inherited from class software.amazon.jsii.JsiiObject
jsiiAsyncCall, jsiiAsyncCall, jsiiCall, jsiiCall, jsiiGet, jsiiGet, jsiiSet, jsiiStaticCall, jsiiStaticCall, jsiiStaticGet, jsiiStaticGet, jsiiStaticSet, jsiiStaticSet
Methods inherited from class java.lang.Object
clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait
Methods inherited from interface software.amazon.jsii.JsiiSerializable
$jsii$toJson
-
Field Details
-
CFN_RESOURCE_TYPE_NAME
The CloudFormation resource type name for this resource class.
-
-
Constructor Details
-
CfnTrail
protected CfnTrail(software.amazon.jsii.JsiiObjectRef objRef) -
CfnTrail
protected CfnTrail(software.amazon.jsii.JsiiObject.InitializationMode initializationMode) -
CfnTrail
@Stability(Stable) public CfnTrail(@NotNull Construct scope, @NotNull String id, @NotNull CfnTrailProps props) Create a newAWS::CloudTrail::Trail
.- Parameters:
scope
-- scope in which this resource is defined.
id
-- scoped id of the resource.
props
-- resource properties.
-
-
Method Details
-
inspect
Examines the CloudFormation resource and discloses attributes.- Specified by:
inspect
in interfaceIInspectable
- Parameters:
inspector
-- tree inspector to collect and process attributes.
-
renderProperties
@Stability(Stable) @NotNull protected Map<String,Object> renderProperties(@NotNull Map<String, Object> props) - Overrides:
renderProperties
in classCfnResource
- Parameters:
props
- This parameter is required.
-
getAttrArn
Ref
returns the ARN of the CloudTrail trail, such asarn:aws:cloudtrail:us-east-2:123456789012:trail/myCloudTrail
. -
getAttrSnsTopicArn
Ref
returns the ARN of the Amazon SNS topic that's associated with the CloudTrail trail, such asarn:aws:sns:us-east-2:123456789012:mySNSTopic
. -
getCfnProperties
- Overrides:
getCfnProperties
in classCfnResource
-
getTags
A custom set of tags (key-value pairs) for this trail. -
getIsLogging
Whether the CloudTrail trail is currently logging AWS API calls. -
setIsLogging
Whether the CloudTrail trail is currently logging AWS API calls. -
setIsLogging
Whether the CloudTrail trail is currently logging AWS API calls. -
getS3BucketName
Specifies the name of the Amazon S3 bucket designated for publishing log files. -
setS3BucketName
Specifies the name of the Amazon S3 bucket designated for publishing log files. -
getAdvancedEventSelectors
Specifies the settings for advanced event selectors.You can add advanced event selectors, and conditions for your advanced event selectors, up to a maximum of 500 values for all conditions and selectors on a trail. You can use either
AdvancedEventSelectors
orEventSelectors
, but not both. If you applyAdvancedEventSelectors
to a trail, any existingEventSelectors
are overwritten. For more information about advanced event selectors, see Logging data events in the AWS CloudTrail User Guide . -
setAdvancedEventSelectors
Specifies the settings for advanced event selectors.You can add advanced event selectors, and conditions for your advanced event selectors, up to a maximum of 500 values for all conditions and selectors on a trail. You can use either
AdvancedEventSelectors
orEventSelectors
, but not both. If you applyAdvancedEventSelectors
to a trail, any existingEventSelectors
are overwritten. For more information about advanced event selectors, see Logging data events in the AWS CloudTrail User Guide . -
setAdvancedEventSelectors
Specifies the settings for advanced event selectors.You can add advanced event selectors, and conditions for your advanced event selectors, up to a maximum of 500 values for all conditions and selectors on a trail. You can use either
AdvancedEventSelectors
orEventSelectors
, but not both. If you applyAdvancedEventSelectors
to a trail, any existingEventSelectors
are overwritten. For more information about advanced event selectors, see Logging data events in the AWS CloudTrail User Guide . -
getCloudWatchLogsLogGroupArn
Specifies a log group name using an Amazon Resource Name (ARN), a unique identifier that represents the log group to which CloudTrail logs are delivered.You must use a log group that exists in your account.
Not required unless you specify
CloudWatchLogsRoleArn
. -
setCloudWatchLogsLogGroupArn
Specifies a log group name using an Amazon Resource Name (ARN), a unique identifier that represents the log group to which CloudTrail logs are delivered.You must use a log group that exists in your account.
Not required unless you specify
CloudWatchLogsRoleArn
. -
getCloudWatchLogsRoleArn
Specifies the role for the CloudWatch Logs endpoint to assume to write to a user's log group.You must use a role that exists in your account.
-
setCloudWatchLogsRoleArn
Specifies the role for the CloudWatch Logs endpoint to assume to write to a user's log group.You must use a role that exists in your account.
-
getEnableLogFileValidation
Specifies whether log file validation is enabled. The default is false.When you disable log file integrity validation, the chain of digest files is broken after one hour. CloudTrail does not create digest files for log files that were delivered during a period in which log file integrity validation was disabled. For example, if you enable log file integrity validation at noon on January 1, disable it at noon on January 2, and re-enable it at noon on January 10, digest files will not be created for the log files delivered from noon on January 2 to noon on January 10. The same applies whenever you stop CloudTrail logging or delete a trail.
-
setEnableLogFileValidation
Specifies whether log file validation is enabled. The default is false.When you disable log file integrity validation, the chain of digest files is broken after one hour. CloudTrail does not create digest files for log files that were delivered during a period in which log file integrity validation was disabled. For example, if you enable log file integrity validation at noon on January 1, disable it at noon on January 2, and re-enable it at noon on January 10, digest files will not be created for the log files delivered from noon on January 2 to noon on January 10. The same applies whenever you stop CloudTrail logging or delete a trail.
-
setEnableLogFileValidation
Specifies whether log file validation is enabled. The default is false.When you disable log file integrity validation, the chain of digest files is broken after one hour. CloudTrail does not create digest files for log files that were delivered during a period in which log file integrity validation was disabled. For example, if you enable log file integrity validation at noon on January 1, disable it at noon on January 2, and re-enable it at noon on January 10, digest files will not be created for the log files delivered from noon on January 2 to noon on January 10. The same applies whenever you stop CloudTrail logging or delete a trail.
-
getEventSelectors
Use event selectors to further specify the management and data event settings for your trail.By default, trails created without specific event selectors will be configured to log all read and write management events, and no data events. When an event occurs in your account, CloudTrail evaluates the event selector for all trails. For each trail, if the event matches any event selector, the trail processes and logs the event. If the event doesn't match any event selector, the trail doesn't log the event.
You can configure up to five event selectors for a trail.
For more information about how to configure event selectors, see Examples and Configuring event selectors in the AWS CloudTrail User Guide .
-
setEventSelectors
Use event selectors to further specify the management and data event settings for your trail.By default, trails created without specific event selectors will be configured to log all read and write management events, and no data events. When an event occurs in your account, CloudTrail evaluates the event selector for all trails. For each trail, if the event matches any event selector, the trail processes and logs the event. If the event doesn't match any event selector, the trail doesn't log the event.
You can configure up to five event selectors for a trail.
For more information about how to configure event selectors, see Examples and Configuring event selectors in the AWS CloudTrail User Guide .
-
setEventSelectors
Use event selectors to further specify the management and data event settings for your trail.By default, trails created without specific event selectors will be configured to log all read and write management events, and no data events. When an event occurs in your account, CloudTrail evaluates the event selector for all trails. For each trail, if the event matches any event selector, the trail processes and logs the event. If the event doesn't match any event selector, the trail doesn't log the event.
You can configure up to five event selectors for a trail.
For more information about how to configure event selectors, see Examples and Configuring event selectors in the AWS CloudTrail User Guide .
-
getIncludeGlobalServiceEvents
Specifies whether the trail is publishing events from global services such as IAM to the log files. -
setIncludeGlobalServiceEvents
Specifies whether the trail is publishing events from global services such as IAM to the log files. -
setIncludeGlobalServiceEvents
Specifies whether the trail is publishing events from global services such as IAM to the log files. -
getInsightSelectors
A JSON string that contains the insight types you want to log on a trail.ApiCallRateInsight
andApiErrorRateInsight
are valid Insight types.The
ApiCallRateInsight
Insights type analyzes write-only management API calls that are aggregated per minute against a baseline API call volume.The
ApiErrorRateInsight
Insights type analyzes management API calls that result in error codes. The error is shown if the API call is unsuccessful. -
setInsightSelectors
A JSON string that contains the insight types you want to log on a trail.ApiCallRateInsight
andApiErrorRateInsight
are valid Insight types.The
ApiCallRateInsight
Insights type analyzes write-only management API calls that are aggregated per minute against a baseline API call volume.The
ApiErrorRateInsight
Insights type analyzes management API calls that result in error codes. The error is shown if the API call is unsuccessful. -
setInsightSelectors
A JSON string that contains the insight types you want to log on a trail.ApiCallRateInsight
andApiErrorRateInsight
are valid Insight types.The
ApiCallRateInsight
Insights type analyzes write-only management API calls that are aggregated per minute against a baseline API call volume.The
ApiErrorRateInsight
Insights type analyzes management API calls that result in error codes. The error is shown if the API call is unsuccessful. -
getIsMultiRegionTrail
Specifies whether the trail applies only to the current Region or to all Regions.The default is false. If the trail exists only in the current Region and this value is set to true, shadow trails (replications of the trail) will be created in the other Regions. If the trail exists in all Regions and this value is set to false, the trail will remain in the Region where it was created, and its shadow trails in other Regions will be deleted. As a best practice, consider using trails that log events in all Regions.
-
setIsMultiRegionTrail
Specifies whether the trail applies only to the current Region or to all Regions.The default is false. If the trail exists only in the current Region and this value is set to true, shadow trails (replications of the trail) will be created in the other Regions. If the trail exists in all Regions and this value is set to false, the trail will remain in the Region where it was created, and its shadow trails in other Regions will be deleted. As a best practice, consider using trails that log events in all Regions.
-
setIsMultiRegionTrail
Specifies whether the trail applies only to the current Region or to all Regions.The default is false. If the trail exists only in the current Region and this value is set to true, shadow trails (replications of the trail) will be created in the other Regions. If the trail exists in all Regions and this value is set to false, the trail will remain in the Region where it was created, and its shadow trails in other Regions will be deleted. As a best practice, consider using trails that log events in all Regions.
-
getIsOrganizationTrail
Specifies whether the trail is applied to all accounts in an organization in AWS Organizations , or only for the current AWS account .The default is false, and cannot be true unless the call is made on behalf of an AWS account that is the management account or delegated administrator account for an organization in AWS Organizations . If the trail is not an organization trail and this is set to
true
, the trail will be created in all AWS accounts that belong to the organization. If the trail is an organization trail and this is set tofalse
, the trail will remain in the current AWS account but be deleted from all member accounts in the organization. -
setIsOrganizationTrail
Specifies whether the trail is applied to all accounts in an organization in AWS Organizations , or only for the current AWS account .The default is false, and cannot be true unless the call is made on behalf of an AWS account that is the management account or delegated administrator account for an organization in AWS Organizations . If the trail is not an organization trail and this is set to
true
, the trail will be created in all AWS accounts that belong to the organization. If the trail is an organization trail and this is set tofalse
, the trail will remain in the current AWS account but be deleted from all member accounts in the organization. -
setIsOrganizationTrail
Specifies whether the trail is applied to all accounts in an organization in AWS Organizations , or only for the current AWS account .The default is false, and cannot be true unless the call is made on behalf of an AWS account that is the management account or delegated administrator account for an organization in AWS Organizations . If the trail is not an organization trail and this is set to
true
, the trail will be created in all AWS accounts that belong to the organization. If the trail is an organization trail and this is set tofalse
, the trail will remain in the current AWS account but be deleted from all member accounts in the organization. -
getKmsKeyId
Specifies the AWS KMS key ID to use to encrypt the logs delivered by CloudTrail.The value can be an alias name prefixed by "alias/", a fully specified ARN to an alias, a fully specified ARN to a key, or a globally unique identifier.
CloudTrail also supports AWS KMS multi-Region keys. For more information about multi-Region keys, see Using multi-Region keys in the AWS Key Management Service Developer Guide .
Examples:
- alias/MyAliasName
- arn:aws:kms:us-east-2:123456789012:alias/MyAliasName
- arn:aws:kms:us-east-2:123456789012:key/12345678-1234-1234-1234-123456789012
- 12345678-1234-1234-1234-123456789012
-
setKmsKeyId
Specifies the AWS KMS key ID to use to encrypt the logs delivered by CloudTrail.The value can be an alias name prefixed by "alias/", a fully specified ARN to an alias, a fully specified ARN to a key, or a globally unique identifier.
CloudTrail also supports AWS KMS multi-Region keys. For more information about multi-Region keys, see Using multi-Region keys in the AWS Key Management Service Developer Guide .
Examples:
- alias/MyAliasName
- arn:aws:kms:us-east-2:123456789012:alias/MyAliasName
- arn:aws:kms:us-east-2:123456789012:key/12345678-1234-1234-1234-123456789012
- 12345678-1234-1234-1234-123456789012
-
getS3KeyPrefix
Specifies the Amazon S3 key prefix that comes after the name of the bucket you have designated for log file delivery.For more information, see Finding Your CloudTrail Log Files . The maximum length is 200 characters.
-
setS3KeyPrefix
Specifies the Amazon S3 key prefix that comes after the name of the bucket you have designated for log file delivery.For more information, see Finding Your CloudTrail Log Files . The maximum length is 200 characters.
-
getSnsTopicName
Specifies the name of the Amazon SNS topic defined for notification of log file delivery.The maximum length is 256 characters.
-
setSnsTopicName
Specifies the name of the Amazon SNS topic defined for notification of log file delivery.The maximum length is 256 characters.
-
getTrailName
Specifies the name of the trail. The name must meet the following requirements:.- Contain only ASCII letters (a-z, A-Z), numbers (0-9), periods (.), underscores (_), or dashes (-)
- Start with a letter or number, and end with a letter or number
- Be between 3 and 128 characters
- Have no adjacent periods, underscores or dashes. Names like
my-_namespace
andmy--namespace
are not valid. - Not be in IP address format (for example, 192.168.5.4)
-
setTrailName
Specifies the name of the trail. The name must meet the following requirements:.- Contain only ASCII letters (a-z, A-Z), numbers (0-9), periods (.), underscores (_), or dashes (-)
- Start with a letter or number, and end with a letter or number
- Be between 3 and 128 characters
- Have no adjacent periods, underscores or dashes. Names like
my-_namespace
andmy--namespace
are not valid. - Not be in IP address format (for example, 192.168.5.4)
-