@pulumi/aws
Version:
A Pulumi package for creating and managing Amazon Web Services (AWS) cloud resources.
366 lines • 15.4 kB
JavaScript
"use strict";
// *** WARNING: this file was generated by pulumi-language-nodejs. ***
// *** Do not edit by hand unless you're certain you know what you are doing! ***
Object.defineProperty(exports, "__esModule", { value: true });
exports.Trail = void 0;
const pulumi = require("@pulumi/pulumi");
const utilities = require("../utilities");
/**
* Provides a CloudTrail resource.
*
* > **Tip:** For a multi-region trail, this resource must be in the home region of the trail.
*
* > **Tip:** For an organization trail, this resource must be in the master account of the organization.
*
* ## Example Usage
*
* ### Basic
*
* Enable CloudTrail to capture all compatible management events in region.
* For capturing events from services like IAM, `includeGlobalServiceEvents` must be enabled.
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as aws from "@pulumi/aws";
*
* const exampleBucket = new aws.s3.Bucket("example", {
* bucket: "my-test-trail",
* forceDestroy: true,
* });
* const current = aws.getCallerIdentity({});
* const currentGetPartition = aws.getPartition({});
* const currentGetRegion = aws.getRegion({});
* const example = aws.iam.getPolicyDocumentOutput({
* statements: [
* {
* sid: "AWSCloudTrailAclCheck",
* effect: "Allow",
* principals: [{
* type: "Service",
* identifiers: ["cloudtrail.amazonaws.com"],
* }],
* actions: ["s3:GetBucketAcl"],
* resources: [exampleBucket.arn],
* conditions: [{
* test: "StringEquals",
* variable: "aws:SourceArn",
* values: [Promise.all([currentGetPartition, currentGetRegion, current]).then(([currentGetPartition, currentGetRegion, current]) => `arn:${currentGetPartition.partition}:cloudtrail:${currentGetRegion.region}:${current.accountId}:trail/example`)],
* }],
* },
* {
* sid: "AWSCloudTrailWrite",
* effect: "Allow",
* principals: [{
* type: "Service",
* identifiers: ["cloudtrail.amazonaws.com"],
* }],
* actions: ["s3:PutObject"],
* resources: [pulumi.all([exampleBucket.arn, current]).apply(([arn, current]) => `${arn}/prefix/AWSLogs/${current.accountId}/*`)],
* conditions: [
* {
* test: "StringEquals",
* variable: "s3:x-amz-acl",
* values: ["bucket-owner-full-control"],
* },
* {
* test: "StringEquals",
* variable: "aws:SourceArn",
* values: [Promise.all([currentGetPartition, currentGetRegion, current]).then(([currentGetPartition, currentGetRegion, current]) => `arn:${currentGetPartition.partition}:cloudtrail:${currentGetRegion.region}:${current.accountId}:trail/example`)],
* },
* ],
* },
* ],
* });
* const exampleBucketPolicy = new aws.s3.BucketPolicy("example", {
* bucket: exampleBucket.id,
* policy: example.apply(example => example.json),
* });
* const exampleTrail = new aws.cloudtrail.Trail("example", {
* name: "example",
* s3BucketName: exampleBucket.id,
* s3KeyPrefix: "prefix",
* includeGlobalServiceEvents: false,
* }, {
* dependsOn: [exampleBucketPolicy],
* });
* ```
*
* ### Data Event Logging
*
* CloudTrail can log [Data Events](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html) for certain services such as S3 objects and Lambda function invocations. Additional information about data event configuration can be found in the following links:
*
* * [CloudTrail API DataResource documentation](https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_DataResource.html) (for basic event selector).
* * [CloudTrail API AdvancedFieldSelector documentation](https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_AdvancedFieldSelector.html) (for advanced event selector).
*
* ### Logging All Lambda Function Invocations By Using Basic Event Selectors
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as aws from "@pulumi/aws";
*
* const example = new aws.cloudtrail.Trail("example", {eventSelectors: [{
* readWriteType: "All",
* includeManagementEvents: true,
* dataResources: [{
* type: "AWS::Lambda::Function",
* values: ["arn:aws:lambda"],
* }],
* }]});
* ```
*
* ### Logging All S3 Object Events By Using Basic Event Selectors
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as aws from "@pulumi/aws";
*
* const example = new aws.cloudtrail.Trail("example", {eventSelectors: [{
* readWriteType: "All",
* includeManagementEvents: true,
* dataResources: [{
* type: "AWS::S3::Object",
* values: ["arn:aws:s3"],
* }],
* }]});
* ```
*
* ### Logging Individual S3 Bucket Events By Using Basic Event Selectors
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as aws from "@pulumi/aws";
*
* const important_bucket = aws.s3.getBucket({
* bucket: "important-bucket",
* });
* const example = new aws.cloudtrail.Trail("example", {eventSelectors: [{
* readWriteType: "All",
* includeManagementEvents: true,
* dataResources: [{
* type: "AWS::S3::Object",
* values: [important_bucket.then(important_bucket => `${important_bucket.arn}/`)],
* }],
* }]});
* ```
*
* ### Logging All S3 Object Events Except For Two S3 Buckets By Using Advanced Event Selectors
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as aws from "@pulumi/aws";
*
* const not_important_bucket_1 = aws.s3.getBucket({
* bucket: "not-important-bucket-1",
* });
* const not_important_bucket_2 = aws.s3.getBucket({
* bucket: "not-important-bucket-2",
* });
* const example = new aws.cloudtrail.Trail("example", {advancedEventSelectors: [
* {
* name: "Log all S3 objects events except for two S3 buckets",
* fieldSelectors: [
* {
* field: "eventCategory",
* equals: ["Data"],
* },
* {
* field: "resources.ARN",
* notStartsWiths: [
* not_important_bucket_1.then(not_important_bucket_1 => `${not_important_bucket_1.arn}/`),
* not_important_bucket_2.then(not_important_bucket_2 => `${not_important_bucket_2.arn}/`),
* ],
* },
* {
* field: "resources.type",
* equals: ["AWS::S3::Object"],
* },
* ],
* },
* {
* name: "Log readOnly and writeOnly management events",
* fieldSelectors: [{
* field: "eventCategory",
* equals: ["Management"],
* }],
* },
* ]});
* ```
*
* ### Logging Individual S3 Buckets And Specific Event Names By Using Advanced Event Selectors
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as aws from "@pulumi/aws";
*
* const important_bucket_1 = aws.s3.getBucket({
* bucket: "important-bucket-1",
* });
* const important_bucket_2 = aws.s3.getBucket({
* bucket: "important-bucket-2",
* });
* const important_bucket_3 = aws.s3.getBucket({
* bucket: "important-bucket-3",
* });
* const example = new aws.cloudtrail.Trail("example", {advancedEventSelectors: [
* {
* name: "Log PutObject and DeleteObject events for two S3 buckets",
* fieldSelectors: [
* {
* field: "eventCategory",
* equals: ["Data"],
* },
* {
* field: "eventName",
* equals: [
* "PutObject",
* "DeleteObject",
* ],
* },
* {
* field: "resources.ARN",
* startsWiths: [
* important_bucket_1.then(important_bucket_1 => `${important_bucket_1.arn}/`),
* important_bucket_2.then(important_bucket_2 => `${important_bucket_2.arn}/`),
* ],
* },
* {
* field: "readOnly",
* equals: ["false"],
* },
* {
* field: "resources.type",
* equals: ["AWS::S3::Object"],
* },
* ],
* },
* {
* name: "Log Delete* events for one S3 bucket",
* fieldSelectors: [
* {
* field: "eventCategory",
* equals: ["Data"],
* },
* {
* field: "eventName",
* startsWiths: ["Delete"],
* },
* {
* field: "resources.ARN",
* equals: [important_bucket_3.then(important_bucket_3 => `${important_bucket_3.arn}/important-prefix`)],
* },
* {
* field: "readOnly",
* equals: ["false"],
* },
* {
* field: "resources.type",
* equals: ["AWS::S3::Object"],
* },
* ],
* },
* ]});
* ```
*
* ### Sending Events to CloudWatch Logs
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as aws from "@pulumi/aws";
*
* const example = new aws.cloudwatch.LogGroup("example", {name: "Example"});
* const exampleTrail = new aws.cloudtrail.Trail("example", {cloudWatchLogsGroupArn: pulumi.interpolate`${example.arn}:*`});
* ```
*
* ## Import
*
* Using `pulumi import`, import Cloudtrails using the `arn`. For example:
*
* ```sh
* $ pulumi import aws:cloudtrail/trail:Trail sample arn:aws:cloudtrail:us-east-1:123456789012:trail/my-sample-trail
* ```
*/
class Trail extends pulumi.CustomResource {
/**
* Get an existing Trail resource's state with the given name, ID, and optional extra
* properties used to qualify the lookup.
*
* @param name The _unique_ name of the resulting resource.
* @param id The _unique_ provider ID of the resource to lookup.
* @param state Any extra arguments used during the lookup.
* @param opts Optional settings to control the behavior of the CustomResource.
*/
static get(name, id, state, opts) {
return new Trail(name, state, Object.assign(Object.assign({}, opts), { id: id }));
}
/**
* Returns true if the given object is an instance of Trail. This is designed to work even
* when multiple copies of the Pulumi SDK have been loaded into the same process.
*/
static isInstance(obj) {
if (obj === undefined || obj === null) {
return false;
}
return obj['__pulumiType'] === Trail.__pulumiType;
}
constructor(name, argsOrState, opts) {
let resourceInputs = {};
opts = opts || {};
if (opts.id) {
const state = argsOrState;
resourceInputs["advancedEventSelectors"] = state ? state.advancedEventSelectors : undefined;
resourceInputs["arn"] = state ? state.arn : undefined;
resourceInputs["cloudWatchLogsGroupArn"] = state ? state.cloudWatchLogsGroupArn : undefined;
resourceInputs["cloudWatchLogsRoleArn"] = state ? state.cloudWatchLogsRoleArn : undefined;
resourceInputs["enableLogFileValidation"] = state ? state.enableLogFileValidation : undefined;
resourceInputs["enableLogging"] = state ? state.enableLogging : undefined;
resourceInputs["eventSelectors"] = state ? state.eventSelectors : undefined;
resourceInputs["homeRegion"] = state ? state.homeRegion : undefined;
resourceInputs["includeGlobalServiceEvents"] = state ? state.includeGlobalServiceEvents : undefined;
resourceInputs["insightSelectors"] = state ? state.insightSelectors : undefined;
resourceInputs["isMultiRegionTrail"] = state ? state.isMultiRegionTrail : undefined;
resourceInputs["isOrganizationTrail"] = state ? state.isOrganizationTrail : undefined;
resourceInputs["kmsKeyId"] = state ? state.kmsKeyId : undefined;
resourceInputs["name"] = state ? state.name : undefined;
resourceInputs["region"] = state ? state.region : undefined;
resourceInputs["s3BucketName"] = state ? state.s3BucketName : undefined;
resourceInputs["s3KeyPrefix"] = state ? state.s3KeyPrefix : undefined;
resourceInputs["snsTopicArn"] = state ? state.snsTopicArn : undefined;
resourceInputs["snsTopicName"] = state ? state.snsTopicName : undefined;
resourceInputs["tags"] = state ? state.tags : undefined;
resourceInputs["tagsAll"] = state ? state.tagsAll : undefined;
}
else {
const args = argsOrState;
if ((!args || args.s3BucketName === undefined) && !opts.urn) {
throw new Error("Missing required property 's3BucketName'");
}
resourceInputs["advancedEventSelectors"] = args ? args.advancedEventSelectors : undefined;
resourceInputs["cloudWatchLogsGroupArn"] = args ? args.cloudWatchLogsGroupArn : undefined;
resourceInputs["cloudWatchLogsRoleArn"] = args ? args.cloudWatchLogsRoleArn : undefined;
resourceInputs["enableLogFileValidation"] = args ? args.enableLogFileValidation : undefined;
resourceInputs["enableLogging"] = args ? args.enableLogging : undefined;
resourceInputs["eventSelectors"] = args ? args.eventSelectors : undefined;
resourceInputs["includeGlobalServiceEvents"] = args ? args.includeGlobalServiceEvents : undefined;
resourceInputs["insightSelectors"] = args ? args.insightSelectors : undefined;
resourceInputs["isMultiRegionTrail"] = args ? args.isMultiRegionTrail : undefined;
resourceInputs["isOrganizationTrail"] = args ? args.isOrganizationTrail : undefined;
resourceInputs["kmsKeyId"] = args ? args.kmsKeyId : undefined;
resourceInputs["name"] = args ? args.name : undefined;
resourceInputs["region"] = args ? args.region : undefined;
resourceInputs["s3BucketName"] = args ? args.s3BucketName : undefined;
resourceInputs["s3KeyPrefix"] = args ? args.s3KeyPrefix : undefined;
resourceInputs["snsTopicName"] = args ? args.snsTopicName : undefined;
resourceInputs["tags"] = args ? args.tags : undefined;
resourceInputs["arn"] = undefined /*out*/;
resourceInputs["homeRegion"] = undefined /*out*/;
resourceInputs["snsTopicArn"] = undefined /*out*/;
resourceInputs["tagsAll"] = undefined /*out*/;
}
opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts);
super(Trail.__pulumiType, name, resourceInputs, opts);
}
}
exports.Trail = Trail;
/** @internal */
Trail.__pulumiType = 'aws:cloudtrail/trail:Trail';
//# sourceMappingURL=trail.js.map