@pulumi/aws
Version:
A Pulumi package for creating and managing Amazon Web Services (AWS) cloud resources.
366 lines • 14.7 kB
JavaScript
;
// *** WARNING: this file was generated by pulumi-language-nodejs. ***
// *** Do not edit by hand unless you're certain you know what you are doing! ***
Object.defineProperty(exports, "__esModule", { value: true });
exports.Trail = void 0;
const pulumi = require("@pulumi/pulumi");
const utilities = require("../utilities");
/**
* Provides a CloudTrail resource.
*
* > **Tip:** For a multi-region trail, this resource must be in the home region of the trail.
*
* > **Tip:** For an organization trail, this resource must be in the master account of the organization.
*
* ## Example Usage
*
* ### Basic
*
* Enable CloudTrail to capture all compatible management events in region.
* For capturing events from services like IAM, `includeGlobalServiceEvents` must be enabled.
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as aws from "@pulumi/aws";
*
* const exampleBucket = new aws.s3.Bucket("example", {
* bucket: "my-test-trail",
* forceDestroy: true,
* });
* const current = aws.getCallerIdentity({});
* const currentGetPartition = aws.getPartition({});
* const currentGetRegion = aws.getRegion({});
* const example = aws.iam.getPolicyDocumentOutput({
* statements: [
* {
* sid: "AWSCloudTrailAclCheck",
* effect: "Allow",
* principals: [{
* type: "Service",
* identifiers: ["cloudtrail.amazonaws.com"],
* }],
* actions: ["s3:GetBucketAcl"],
* resources: [exampleBucket.arn],
* conditions: [{
* test: "StringEquals",
* variable: "aws:SourceArn",
* values: [Promise.all([currentGetPartition, currentGetRegion, current]).then(([currentGetPartition, currentGetRegion, current]) => `arn:${currentGetPartition.partition}:cloudtrail:${currentGetRegion.region}:${current.accountId}:trail/example`)],
* }],
* },
* {
* sid: "AWSCloudTrailWrite",
* effect: "Allow",
* principals: [{
* type: "Service",
* identifiers: ["cloudtrail.amazonaws.com"],
* }],
* actions: ["s3:PutObject"],
* resources: [Promise.all([exampleBucket.arn, current]).then(([arn, current]) => `${arn}/prefix/AWSLogs/${current.accountId}/*`)],
* conditions: [
* {
* test: "StringEquals",
* variable: "s3:x-amz-acl",
* values: ["bucket-owner-full-control"],
* },
* {
* test: "StringEquals",
* variable: "aws:SourceArn",
* values: [Promise.all([currentGetPartition, currentGetRegion, current]).then(([currentGetPartition, currentGetRegion, current]) => `arn:${currentGetPartition.partition}:cloudtrail:${currentGetRegion.region}:${current.accountId}:trail/example`)],
* },
* ],
* },
* ],
* });
* const exampleBucketPolicy = new aws.s3.BucketPolicy("example", {
* bucket: exampleBucket.id,
* policy: example.apply(example => example.json),
* });
* const exampleTrail = new aws.cloudtrail.Trail("example", {
* name: "example",
* s3BucketName: exampleBucket.id,
* s3KeyPrefix: "prefix",
* includeGlobalServiceEvents: false,
* }, {
* dependsOn: [exampleBucketPolicy],
* });
* ```
*
* ### Data Event Logging
*
* CloudTrail can log [Data Events](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html) for certain services such as S3 objects and Lambda function invocations. Additional information about data event configuration can be found in the following links:
*
* * [CloudTrail API DataResource documentation](https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_DataResource.html) (for basic event selector).
* * [CloudTrail API AdvancedFieldSelector documentation](https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_AdvancedFieldSelector.html) (for advanced event selector).
*
* ### Logging All Lambda Function Invocations By Using Basic Event Selectors
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as aws from "@pulumi/aws";
*
* const example = new aws.cloudtrail.Trail("example", {eventSelectors: [{
* readWriteType: "All",
* includeManagementEvents: true,
* dataResources: [{
* type: "AWS::Lambda::Function",
* values: ["arn:aws:lambda"],
* }],
* }]});
* ```
*
* ### Logging All S3 Object Events By Using Basic Event Selectors
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as aws from "@pulumi/aws";
*
* const example = new aws.cloudtrail.Trail("example", {eventSelectors: [{
* readWriteType: "All",
* includeManagementEvents: true,
* dataResources: [{
* type: "AWS::S3::Object",
* values: ["arn:aws:s3"],
* }],
* }]});
* ```
*
* ### Logging Individual S3 Bucket Events By Using Basic Event Selectors
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as aws from "@pulumi/aws";
*
* const important_bucket = aws.s3.getBucket({
* bucket: "important-bucket",
* });
* const example = new aws.cloudtrail.Trail("example", {eventSelectors: [{
* readWriteType: "All",
* includeManagementEvents: true,
* dataResources: [{
* type: "AWS::S3::Object",
* values: [important_bucket.then(important_bucket => `${important_bucket.arn}/`)],
* }],
* }]});
* ```
*
* ### Logging All S3 Object Events Except For Two S3 Buckets By Using Advanced Event Selectors
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as aws from "@pulumi/aws";
*
* const not_important_bucket_1 = aws.s3.getBucket({
* bucket: "not-important-bucket-1",
* });
* const not_important_bucket_2 = aws.s3.getBucket({
* bucket: "not-important-bucket-2",
* });
* const example = new aws.cloudtrail.Trail("example", {advancedEventSelectors: [
* {
* name: "Log all S3 objects events except for two S3 buckets",
* fieldSelectors: [
* {
* field: "eventCategory",
* equals: ["Data"],
* },
* {
* field: "resources.ARN",
* notStartsWiths: [
* not_important_bucket_1.then(not_important_bucket_1 => `${not_important_bucket_1.arn}/`),
* not_important_bucket_2.then(not_important_bucket_2 => `${not_important_bucket_2.arn}/`),
* ],
* },
* {
* field: "resources.type",
* equals: ["AWS::S3::Object"],
* },
* ],
* },
* {
* name: "Log readOnly and writeOnly management events",
* fieldSelectors: [{
* field: "eventCategory",
* equals: ["Management"],
* }],
* },
* ]});
* ```
*
* ### Logging Individual S3 Buckets And Specific Event Names By Using Advanced Event Selectors
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as aws from "@pulumi/aws";
*
* const important_bucket_1 = aws.s3.getBucket({
* bucket: "important-bucket-1",
* });
* const important_bucket_2 = aws.s3.getBucket({
* bucket: "important-bucket-2",
* });
* const important_bucket_3 = aws.s3.getBucket({
* bucket: "important-bucket-3",
* });
* const example = new aws.cloudtrail.Trail("example", {advancedEventSelectors: [
* {
* name: "Log PutObject and DeleteObject events for two S3 buckets",
* fieldSelectors: [
* {
* field: "eventCategory",
* equals: ["Data"],
* },
* {
* field: "eventName",
* equals: [
* "PutObject",
* "DeleteObject",
* ],
* },
* {
* field: "resources.ARN",
* startsWiths: [
* important_bucket_1.then(important_bucket_1 => `${important_bucket_1.arn}/`),
* important_bucket_2.then(important_bucket_2 => `${important_bucket_2.arn}/`),
* ],
* },
* {
* field: "readOnly",
* equals: ["false"],
* },
* {
* field: "resources.type",
* equals: ["AWS::S3::Object"],
* },
* ],
* },
* {
* name: "Log Delete* events for one S3 bucket",
* fieldSelectors: [
* {
* field: "eventCategory",
* equals: ["Data"],
* },
* {
* field: "eventName",
* startsWiths: ["Delete"],
* },
* {
* field: "resources.ARN",
* equals: [important_bucket_3.then(important_bucket_3 => `${important_bucket_3.arn}/important-prefix`)],
* },
* {
* field: "readOnly",
* equals: ["false"],
* },
* {
* field: "resources.type",
* equals: ["AWS::S3::Object"],
* },
* ],
* },
* ]});
* ```
*
* ### Sending Events to CloudWatch Logs
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as aws from "@pulumi/aws";
*
* const example = new aws.cloudwatch.LogGroup("example", {name: "Example"});
* const exampleTrail = new aws.cloudtrail.Trail("example", {cloudWatchLogsGroupArn: pulumi.interpolate`${example.arn}:*`});
* ```
*
* ## Import
*
* Using `pulumi import`, import Cloudtrails using the `arn`. For example:
*
* ```sh
* $ pulumi import aws:cloudtrail/trail:Trail sample arn:aws:cloudtrail:us-east-1:123456789012:trail/my-sample-trail
* ```
*/
class Trail extends pulumi.CustomResource {
/**
* Get an existing Trail resource's state with the given name, ID, and optional extra
* properties used to qualify the lookup.
*
* @param name The _unique_ name of the resulting resource.
* @param id The _unique_ provider ID of the resource to lookup.
* @param state Any extra arguments used during the lookup.
* @param opts Optional settings to control the behavior of the CustomResource.
*/
static get(name, id, state, opts) {
return new Trail(name, state, { ...opts, id: id });
}
/**
* Returns true if the given object is an instance of Trail. This is designed to work even
* when multiple copies of the Pulumi SDK have been loaded into the same process.
*/
static isInstance(obj) {
if (obj === undefined || obj === null) {
return false;
}
return obj['__pulumiType'] === Trail.__pulumiType;
}
constructor(name, argsOrState, opts) {
let resourceInputs = {};
opts = opts || {};
if (opts.id) {
const state = argsOrState;
resourceInputs["advancedEventSelectors"] = state?.advancedEventSelectors;
resourceInputs["arn"] = state?.arn;
resourceInputs["cloudWatchLogsGroupArn"] = state?.cloudWatchLogsGroupArn;
resourceInputs["cloudWatchLogsRoleArn"] = state?.cloudWatchLogsRoleArn;
resourceInputs["enableLogFileValidation"] = state?.enableLogFileValidation;
resourceInputs["enableLogging"] = state?.enableLogging;
resourceInputs["eventSelectors"] = state?.eventSelectors;
resourceInputs["homeRegion"] = state?.homeRegion;
resourceInputs["includeGlobalServiceEvents"] = state?.includeGlobalServiceEvents;
resourceInputs["insightSelectors"] = state?.insightSelectors;
resourceInputs["isMultiRegionTrail"] = state?.isMultiRegionTrail;
resourceInputs["isOrganizationTrail"] = state?.isOrganizationTrail;
resourceInputs["kmsKeyId"] = state?.kmsKeyId;
resourceInputs["name"] = state?.name;
resourceInputs["region"] = state?.region;
resourceInputs["s3BucketName"] = state?.s3BucketName;
resourceInputs["s3KeyPrefix"] = state?.s3KeyPrefix;
resourceInputs["snsTopicArn"] = state?.snsTopicArn;
resourceInputs["snsTopicName"] = state?.snsTopicName;
resourceInputs["tags"] = state?.tags;
resourceInputs["tagsAll"] = state?.tagsAll;
}
else {
const args = argsOrState;
if (args?.s3BucketName === undefined && !opts.urn) {
throw new Error("Missing required property 's3BucketName'");
}
resourceInputs["advancedEventSelectors"] = args?.advancedEventSelectors;
resourceInputs["cloudWatchLogsGroupArn"] = args?.cloudWatchLogsGroupArn;
resourceInputs["cloudWatchLogsRoleArn"] = args?.cloudWatchLogsRoleArn;
resourceInputs["enableLogFileValidation"] = args?.enableLogFileValidation;
resourceInputs["enableLogging"] = args?.enableLogging;
resourceInputs["eventSelectors"] = args?.eventSelectors;
resourceInputs["includeGlobalServiceEvents"] = args?.includeGlobalServiceEvents;
resourceInputs["insightSelectors"] = args?.insightSelectors;
resourceInputs["isMultiRegionTrail"] = args?.isMultiRegionTrail;
resourceInputs["isOrganizationTrail"] = args?.isOrganizationTrail;
resourceInputs["kmsKeyId"] = args?.kmsKeyId;
resourceInputs["name"] = args?.name;
resourceInputs["region"] = args?.region;
resourceInputs["s3BucketName"] = args?.s3BucketName;
resourceInputs["s3KeyPrefix"] = args?.s3KeyPrefix;
resourceInputs["snsTopicName"] = args?.snsTopicName;
resourceInputs["tags"] = args?.tags;
resourceInputs["arn"] = undefined /*out*/;
resourceInputs["homeRegion"] = undefined /*out*/;
resourceInputs["snsTopicArn"] = undefined /*out*/;
resourceInputs["tagsAll"] = undefined /*out*/;
}
opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts);
super(Trail.__pulumiType, name, resourceInputs, opts);
}
}
exports.Trail = Trail;
/** @internal */
Trail.__pulumiType = 'aws:cloudtrail/trail:Trail';
//# sourceMappingURL=trail.js.map