@renovosolutions/cdk-library-crowdstrike-ingestion/lib/logsubscription.d.ts

A CDK library to ease repetetive construct creation for CrowdStrike data ingestion

import { aws_iam as iam, aws_kms as kms, aws_logs as logs } from 'aws-cdk-lib';
import { Construct } from 'constructs';
/**
 * Properties for the CrowdStrikeLogSubscription construct.
 */
export interface CrowdStrikeLogSubscriptionProps {
    /**
     * The log group to create the subscription filter for.
     */
    readonly logGroup: logs.ILogGroup;
    /**
     * The ARN of the log destination logical resource.
     */
    readonly logDestinationArn: string;
    /**
     * The filter pattern for the subscription filter.
     *
     * @default - '%.%' (matches all log events).
     */
    readonly filterPattern?: string;
    /**
     * The IAM role that CloudWatch Logs will assume to create the subscription.
     * If not provided, a new role will be created with the necessary permissions.
     *
     * @default - a new role will be created.
     */
    readonly role?: iam.IRole;
    /**
     * The KMS key attached to the log group, if any.
     * If this is provided, the necessary KMS permissions will be added to the role.
     * If not provided, a warning will be issued to ensure that the log group is not encrypted,
     * because deployment will fail due to missing permissions if a KMS key is used and not accounted for.
     * If a role is provided, it is assumed that the role has the necessary permissions, and a warning
     * will not be issued if a KMS key is not provided.
     *
     * @default - no KMS key.
     */
    readonly kmsKey?: kms.IKey;
}
/**
 * A construct that creates an CloudWatch log group filter subscription
 * for CrowdStrike data ingestion, along with an IAM role for access.
 */
export declare class CrowdStrikeLogSubscription extends Construct {
    /**
     * The log group for which the subscription filter is created.
     */
    readonly logGroup: logs.ILogGroup;
    /**
     * The subscription filter for the log group.
     */
    readonly subscriptionFilter: logs.CfnSubscriptionFilter;
    /**
     * The IAM role that CloudWatch Logs will assume to create the subscription.
     */
    readonly role: iam.IRole;
    /**
     * Constructs a new CrowdStrikeLogSubscription.
     *
     * @param scope The scope in which this construct is defined.
     * @param id The scoped construct ID.
     * @param props The properties for the subscription.
     */
    constructor(scope: Construct, id: string, props: CrowdStrikeLogSubscriptionProps);
}