AwsCloudtrailTrailArgs

interface AwsCloudtrailTrailArgs extends Omit<aws.cloudtrail.TrailArgs, 'kmsKeyId' | 'name' | 'tags' | 's3BucketName'> {
advancedEventSelectors?: Input<Input<TrailAdvancedEventSelector>[] | undefined>;
cloudWatchLogsGroupArn?: Input<string | undefined>;
cloudWatchLogsRoleArn?: Input<string | undefined>;
enableLogFileValidation?: Input<boolean | undefined>;
enableLogging?: Input<boolean | undefined>;
eventSelectors?: Input<Input<TrailEventSelector>[] | undefined>;
includeGlobalServiceEvents?: Input<boolean | undefined>;
insightSelectors?: Input<Input<TrailInsightSelector>[] | undefined>;
isMultiRegionTrail?: Input<boolean | undefined>;
isOrganizationTrail?: Input<boolean | undefined>;
kmsKey?: AwsKmsKeyInput;
name: Input<string>;
region?: Input<string | undefined>;
s3BucketName: Input<string>;
s3KeyPrefix?: Input<string | undefined>;
snsTopicName?: Input<string | undefined>;
tags?: Input<Record<string, Input<string>>>;
}

Input arguments for the CloudTrail trail capability.

Example

CODE

const trail: AwsCloudtrailTrailArgs = {
  name: 'securityAuditTrail',
  s3BucketName: 'tst-abc12345-audit',
  isMultiRegionTrail: true,
};

Hierarchy

TrailArgs, "kmsKeyId" | "name" | "tags" | "s3BucketName">
AwsCloudtrailTrailArgs

Properties

`advancedEventSelectors: Input<Input<TrailAdvancedEventSelector>[] | undefined>`

Inherited from advancedEventSelectors

Specifies an advanced event selector for enabling data event logging. Fields documented below. Conflicts with eventSelector.

`cloudWatchLogsGroupArn: Input<string | undefined>`

Inherited from cloudWatchLogsGroupArn

Log group name using an ARN that represents the log group to which CloudTrail logs will be delivered. Note that CloudTrail requires the Log Stream wildcard.

`cloudWatchLogsRoleArn: Input<string | undefined>`

Inherited from cloudWatchLogsRoleArn

Role for the CloudWatch Logs endpoint to assume to write to a user’s log group.

`enableLogFileValidation: Input<boolean | undefined>`

Inherited from enableLogFileValidation

Whether log file integrity validation is enabled. Defaults to false.

`enableLogging: Input<boolean | undefined>`

Inherited from enableLogging

Enables logging for the trail. When set to true, logging is started by calling the StartLogging API. When set to false, logging is stopped by calling the StopLogging API. Defaults to true.

`eventSelectors: Input<Input<TrailEventSelector>[] | undefined>`

Inherited from eventSelectors

Specifies an event selector for enabling data event logging. Fields documented below. Please note the CloudTrail limits when configuring these. Conflicts with advancedEventSelector.

`includeGlobalServiceEvents: Input<boolean | undefined>`

Inherited from includeGlobalServiceEvents

Whether the trail is publishing events from global services such as IAM to the log files. Defaults to true.

`insightSelectors: Input<Input<TrailInsightSelector>[] | undefined>`

Inherited from insightSelectors

Configuration block for identifying unusual operational activity. See details below.

`isMultiRegionTrail: Input<boolean | undefined>`

Inherited from isMultiRegionTrail

Whether the trail is created in the current region or in all regions. Defaults to false.

`isOrganizationTrail: Input<boolean | undefined>`

Inherited from isOrganizationTrail

Whether the trail is an AWS Organizations trail. Organization trails log events for the master account and all member accounts. Can only be created in the organization master account. Defaults to false.

`kmsKey: AwsKmsKeyInput`

Optional customer-managed KMS key used to encrypt delivered logs.

`name: Input<string>`

Required trail purpose used to build the AWS resource name ({env}-{projectHash}-{purpose}).

`region: Input<string | undefined>`

Inherited from region

Region where this resource will be managed. Defaults to the Region set in the provider configuration.

`s3BucketName: Input<string>`

Required S3 bucket name used by CloudTrail to deliver log files.

`s3KeyPrefix: Input<string | undefined>`

Inherited from s3KeyPrefix

S3 key prefix that follows the name of the bucket you have designated for log file delivery.

`snsTopicName: Input<string | undefined>`

Inherited from snsTopicName

Name of the Amazon SNS topic defined for notification of log file delivery. Specify the SNS topic ARN if it resides in another region.

`tags: Input<Record<string, Input<string>>>`

Optional tags merged with runtime default tags.