このページは日本語には対応しておりません。随時翻訳に取り組んでいます。翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。

aws_cloudtrail_trail

account_id

Type: STRING

advanced_event_selectors

Type: UNORDERED_LIST_STRUCT
Provider name: AdvancedEventSelectors
Description: The advanced event selectors that are configured for the trail.

  • field_selectors
    Type: UNORDERED_LIST_STRUCT
    Provider name: FieldSelectors
    Description: Contains all selector statements in an advanced event selector.
    • ends_with
      Type: UNORDERED_LIST_STRING
      Provider name: EndsWith
      Description: An operator that includes events that match the last few characters of the event record field specified as the value of Field.
    • equals
      Type: UNORDERED_LIST_STRING
      Provider name: Equals
      Description: An operator that includes events that match the exact value of the event record field specified as the value of Field. This is the only valid operator that you can use with the readOnly, eventCategory, and resources.type fields.
    • field
      Type: STRING
      Provider name: Field
      Description: A field in an event record on which to filter events to be logged. Supported fields include readOnly, eventCategory, eventSource (for management events), eventName, resources.type, and resources.ARN.
      • readOnly - Optional. Can be set to Equals a value of true or false. If you do not add this field, CloudTrail logs both read and write events. A value of true logs only read events. A value of false logs only write events.
      • eventSource - For filtering management events only. This can be set only to NotEquals kms.amazonaws.com.
      • eventName - Can use any operator. You can use it to filter in or filter out any data event logged to CloudTrail, such as PutBucket or GetSnapshotBlock. You can have multiple values for this field, separated by commas.
      • eventCategory - This is required. It must be set to Equals, and the value must be Management or Data.
      • resources.type - This field is required. resources.type can only use the Equals operator, and the value can be one of the following:
        • AWS::S3::Object
        • AWS::Lambda::Function
        • AWS::DynamoDB::Table
        • AWS::S3Outposts::Object
        • AWS::ManagedBlockchain::Node
        • AWS::S3ObjectLambda::AccessPoint
        • AWS::EC2::Snapshot
        • AWS::S3::AccessPoint
        • AWS::DynamoDB::Stream
        • AWS::Glue::Table
        You can have only one resources.type field per selector. To log data events on more than one resource type, add another selector.
      • resources.ARN - You can use any operator with resources.ARN, but if you use Equals or NotEquals, the value must exactly match the ARN of a valid resource of the type you’ve specified in the template as the value of resources.type. For example, if resources.type equals AWS::S3::Object, the ARN must be in one of the following formats. To log all data events for all objects in a specific S3 bucket, use the StartsWith operator, and include only the bucket ARN as the matching value. The trailing slash is intentional; do not exclude it. Replace the text between less than and greater than symbols (<>) with resource-specific information.
        • arn:<partition>:s3:::<bucket_name>/
        • arn:<partition>:s3:::<bucket_name>/<object_path>/
        When resources.type equals AWS::S3::AccessPoint, and the operator is set to Equals or NotEquals, the ARN must be in one of the following formats. To log events on all objects in an S3 access point, we recommend that you use only the access point ARN, don’t include the object path, and use the StartsWith or NotStartsWith operators.
        • arn:<partition>:s3:<region>:<account_ID>:accesspoint/<access_point_name>
        • arn:<partition>:s3:<region>:<account_ID>:accesspoint/<access_point_name>/object/<object_path>
        When resources.type equals AWS::Lambda::Function, and the operator is set to Equals or NotEquals, the ARN must be in the following format:
        • arn:<partition>:lambda:<region>:<account_ID>:function:<function_name>
        When resources.type equals AWS::DynamoDB::Table, and the operator is set to Equals or NotEquals, the ARN must be in the following format:
        • arn:<partition>:dynamodb:<region>:<account_ID>:table/<table_name>
        When resources.type equals AWS::S3Outposts::Object, and the operator is set to Equals or NotEquals, the ARN must be in the following format:
        • arn:<partition>:s3-outposts:<region>:<account_ID>:<object_path>
        When resources.type equals AWS::ManagedBlockchain::Node, and the operator is set to Equals or NotEquals, the ARN must be in the following format:
        • arn:<partition>:managedblockchain:<region>:<account_ID>:nodes/<node_ID>
        When resources.type equals AWS::S3ObjectLambda::AccessPoint, and the operator is set to Equals or NotEquals, the ARN must be in the following format:
        • arn:<partition>:s3-object-lambda:<region>:<account_ID>:accesspoint/<access_point_name>
        When resources.type equals AWS::EC2::Snapshot, and the operator is set to Equals or NotEquals, the ARN must be in the following format:
        • arn:<partition>:ec2:<region>::snapshot/<snapshot_ID>
        When resources.type equals AWS::DynamoDB::Stream, and the operator is set to Equals or NotEquals, the ARN must be in the following format:
        • arn:<partition>:dynamodb:<region>:<account_ID>:table/<table_name>/stream/<date_time>
        When resources.type equals AWS::Glue::Table, and the operator is set to Equals or NotEquals, the ARN must be in the following format:
        • arn:<partition>:glue:<region>:<account_ID>:table/<database_name>/<table_name>
    • not_ends_with
      Type: UNORDERED_LIST_STRING
      Provider name: NotEndsWith
      Description: An operator that excludes events that match the last few characters of the event record field specified as the value of Field.
    • not_equals
      Type: UNORDERED_LIST_STRING
      Provider name: NotEquals
      Description: An operator that excludes events that match the exact value of the event record field specified as the value of Field.
    • not_starts_with
      Type: UNORDERED_LIST_STRING
      Provider name: NotStartsWith
      Description: An operator that excludes events that match the first few characters of the event record field specified as the value of Field.
    • starts_with
      Type: UNORDERED_LIST_STRING
      Provider name: StartsWith
      Description: An operator that includes events that match the first few characters of the event record field specified as the value of Field.
  • name
    Type: STRING
    Provider name: Name
    Description: An optional, descriptive name for an advanced event selector, such as “Log data events for only two S3 buckets”.

cloud_watch_logs_log_group_arn

Type: STRING
Provider name: CloudWatchLogsLogGroupArn
Description: Specifies an Amazon Resource Name (ARN), a unique identifier that represents the log group to which CloudTrail logs will be delivered.

cloud_watch_logs_role_arn

Type: STRING
Provider name: CloudWatchLogsRoleArn
Description: Specifies the role for the CloudWatch Logs endpoint to assume to write to a user’s log group.

event_selectors

Type: UNORDERED_LIST_STRUCT
Provider name: EventSelectors
Description: The event selectors that are configured for the trail.

  • data_resources
    Type: UNORDERED_LIST_STRUCT
    Provider name: DataResources
    Description: CloudTrail supports data event logging for Amazon S3 objects, Lambda functions, and Amazon DynamoDB tables with basic event selectors. You can specify up to 250 resources for an individual event selector, but the total number of data resources cannot exceed 250 across all event selectors in a trail. This limit does not apply if you configure resource logging for all data events. For more information, see Data Events and Limits in CloudTrail in the CloudTrail User Guide.
    • type
      Type: STRING
      Provider name: Type
      Description: The resource type in which you want to log data events. You can specify the following basic event selector resource types:
      • AWS::S3::Object
      • AWS::Lambda::Function
      • AWS::DynamoDB::Table
      The following resource types are also availble through advanced event selectors. Basic event selector resource types are valid in advanced event selectors, but advanced event selector resource types are not valid in basic event selectors. For more information, see AdvancedFieldSelector$Field.
      • AWS::S3Outposts::Object
      • AWS::ManagedBlockchain::Node
      • AWS::S3ObjectLambda::AccessPoint
      • AWS::EC2::Snapshot
      • AWS::S3::AccessPoint
      • AWS::DynamoDB::Stream
      • AWS::Glue::Table
    • values
      Type: UNORDERED_LIST_STRING
      Provider name: Values
      Description: An array of Amazon Resource Name (ARN) strings or partial ARN strings for the specified objects.
      • To log data events for all objects in all S3 buckets in your Amazon Web Services account, specify the prefix as arn:aws:s3. This also enables logging of data event activity performed by any user or role in your Amazon Web Services account, even if that activity is performed on a bucket that belongs to another Amazon Web Services account.
      • To log data events for all objects in an S3 bucket, specify the bucket and an empty object prefix such as arn:aws:s3:::bucket-1/. The trail logs data events for all objects in this S3 bucket.
      • To log data events for specific objects, specify the S3 bucket and object prefix such as arn:aws:s3:::bucket-1/example-images. The trail logs data events for objects in this S3 bucket that match the prefix.
      • To log data events for all Lambda functions in your Amazon Web Services account, specify the prefix as arn:aws:lambda. This also enables logging of Invoke activity performed by any user or role in your Amazon Web Services account, even if that activity is performed on a function that belongs to another Amazon Web Services account.
      • To log data events for a specific Lambda function, specify the function ARN. Lambda function ARNs are exact. For example, if you specify a function ARN arn:aws:lambda:us-west-2:111111111111:function:helloworld, data events will only be logged for arn:aws:lambda:us-west-2:111111111111:function:helloworld. They will not be logged for arn:aws:lambda:us-west-2:111111111111:function:helloworld2.
      • To log data events for all DynamoDB tables in your Amazon Web Services account, specify the prefix as arn:aws:dynamodb.
  • exclude_management_event_sources
    Type: UNORDERED_LIST_STRING
    Provider name: ExcludeManagementEventSources
    Description: An optional list of service event sources from which you do not want management events to be logged on your trail. In this release, the list can be empty (disables the filter), or it can filter out Key Management Service or Amazon RDS Data API events by containing kms.amazonaws.com or rdsdata.amazonaws.com. By default, ExcludeManagementEventSources is empty, and KMS and Amazon RDS Data API events are logged to your trail. You can exclude management event sources only in regions that support the event source.
  • include_management_events
    Type: BOOLEAN
    Provider name: IncludeManagementEvents
    Description: Specify if you want your event selector to include management events for your trail. For more information, see Management Events in the CloudTrail User Guide. By default, the value is true. The first copy of management events is free. You are charged for additional copies of management events that you are logging on any subsequent trail in the same region. For more information about CloudTrail pricing, see CloudTrail Pricing.
  • read_write_type
    Type: STRING
    Provider name: ReadWriteType
    Description: Specify if you want your trail to log read-only events, write-only events, or all. For example, the EC2 GetConsoleOutput is a read-only API operation and RunInstances is a write-only API operation. By default, the value is All.

has_custom_event_selectors

Type: BOOLEAN
Provider name: HasCustomEventSelectors
Description: Specifies if the trail has custom event selectors.

has_insight_selectors

Type: BOOLEAN
Provider name: HasInsightSelectors
Description: Specifies whether a trail has insight types specified in an InsightSelector list.

home_region

Type: STRING
Provider name: HomeRegion
Description: The region in which the trail was created.

include_global_service_events

Type: BOOLEAN
Provider name: IncludeGlobalServiceEvents
Description: Set to True to include Amazon Web Services API calls from Amazon Web Services global services such as IAM. Otherwise, False.

is_multi_region_trail

Type: BOOLEAN
Provider name: IsMultiRegionTrail
Description: Specifies whether the trail exists only in one region or exists in all regions.

is_organization_trail

Type: BOOLEAN
Provider name: IsOrganizationTrail
Description: Specifies whether the trail is an organization trail.

kms_key_id

Type: STRING
Provider name: KmsKeyId
Description: Specifies the KMS key ID that encrypts the logs delivered by CloudTrail. The value is a fully specified ARN to a KMS key in the following format. arn:aws:kms:us-east-2:123456789012:key/12345678-1234-1234-1234-123456789012

log_file_validation_enabled

Type: BOOLEAN
Provider name: LogFileValidationEnabled
Description: Specifies whether log file validation is enabled.

name

Type: STRING
Provider name: Name
Description: Name of the trail set by calling CreateTrail. The maximum length is 128 characters.

s3_bucket_name

Type: STRING
Provider name: S3BucketName
Description: Name of the Amazon S3 bucket into which CloudTrail delivers your trail files. See Amazon S3 Bucket Naming Requirements.

s3_key_prefix

Type: STRING
Provider name: S3KeyPrefix
Description: Specifies the Amazon S3 key prefix that comes after the name of the bucket you have designated for log file delivery. For more information, see Finding Your CloudTrail Log Files. The maximum length is 200 characters.

sns_topic_arn

Type: STRING
Provider name: SnsTopicARN
Description: Specifies the ARN of the Amazon SNS topic that CloudTrail uses to send notifications when log files are delivered. The following is the format of a topic ARN. arn:aws:sns:us-east-2:123456789012:MyTopic

sns_topic_name

Type: STRING
Provider name: SnsTopicName
Description: This field is no longer in use. Use SnsTopicARN.

tags

Type: UNORDERED_LIST_STRING

trail_arn

Type: STRING
Provider name: TrailARN
Description: The specified trail ARN that has the event selectors.

trail_status

Type: STRUCT
Provider name: GetTrailStatusResponse

  • is_logging
    Type: BOOLEAN
    Provider name: IsLogging
    Description: Whether the CloudTrail trail is currently logging Amazon Web Services API calls.
  • latest_cloud_watch_logs_delivery_error
    Type: STRING
    Provider name: LatestCloudWatchLogsDeliveryError
    Description: Displays any CloudWatch Logs error that CloudTrail encountered when attempting to deliver logs to CloudWatch Logs.
  • latest_cloud_watch_logs_delivery_time
    Type: TIMESTAMP
    Provider name: LatestCloudWatchLogsDeliveryTime
    Description: Displays the most recent date and time when CloudTrail delivered logs to CloudWatch Logs.
  • latest_delivery_attempt_succeeded
    Type: STRING
    Provider name: LatestDeliveryAttemptSucceeded
    Description: This field is no longer in use.
  • latest_delivery_attempt_time
    Type: STRING
    Provider name: LatestDeliveryAttemptTime
    Description: This field is no longer in use.
  • latest_delivery_error
    Type: STRING
    Provider name: LatestDeliveryError
    Description: Displays any Amazon S3 error that CloudTrail encountered when attempting to deliver log files to the designated bucket. For more information, see Error Responses in the Amazon S3 API Reference. This error occurs only when there is a problem with the destination S3 bucket, and does not occur for requests that time out. To resolve the issue, create a new bucket, and then call UpdateTrail to specify the new bucket; or fix the existing objects so that CloudTrail can again write to the bucket.
  • latest_delivery_time
    Type: TIMESTAMP
    Provider name: LatestDeliveryTime
    Description: Specifies the date and time that CloudTrail last delivered log files to an account’s Amazon S3 bucket.
  • latest_digest_delivery_error
    Type: STRING
    Provider name: LatestDigestDeliveryError
    Description: Displays any Amazon S3 error that CloudTrail encountered when attempting to deliver a digest file to the designated bucket. For more information, see Error Responses in the Amazon S3 API Reference. This error occurs only when there is a problem with the destination S3 bucket, and does not occur for requests that time out. To resolve the issue, create a new bucket, and then call UpdateTrail to specify the new bucket; or fix the existing objects so that CloudTrail can again write to the bucket.
  • latest_digest_delivery_time
    Type: TIMESTAMP
    Provider name: LatestDigestDeliveryTime
    Description: Specifies the date and time that CloudTrail last delivered a digest file to an account’s Amazon S3 bucket.
  • latest_notification_attempt_succeeded
    Type: STRING
    Provider name: LatestNotificationAttemptSucceeded
    Description: This field is no longer in use.
  • latest_notification_attempt_time
    Type: STRING
    Provider name: LatestNotificationAttemptTime
    Description: This field is no longer in use.
  • latest_notification_error
    Type: STRING
    Provider name: LatestNotificationError
    Description: Displays any Amazon SNS error that CloudTrail encountered when attempting to send a notification. For more information about Amazon SNS errors, see the Amazon SNS Developer Guide.
  • latest_notification_time
    Type: TIMESTAMP
    Provider name: LatestNotificationTime
    Description: Specifies the date and time of the most recent Amazon SNS notification that CloudTrail has written a new log file to an account’s Amazon S3 bucket.
  • start_logging_time
    Type: TIMESTAMP
    Provider name: StartLoggingTime
    Description: Specifies the most recent date and time when CloudTrail started recording API calls for an Amazon Web Services account.
  • stop_logging_time
    Type: TIMESTAMP
    Provider name: StopLoggingTime
    Description: Specifies the most recent date and time when CloudTrail stopped recording API calls for an Amazon Web Services account.
  • time_logging_started
    Type: STRING
    Provider name: TimeLoggingStarted
    Description: This field is no longer in use.
  • time_logging_stopped
    Type: STRING
    Provider name: TimeLoggingStopped
    Description: This field is no longer in use.