trail resource

Source: internal/service/cloudtrail/trail_rsrc.go:79

Example usage:

imports: {
  aws-cloudtrail: 'github.com/cloudboss/unobin-library-aws//service/cloudtrail'
}

resources: {
  example: aws-cloudtrail.trail {
    # Set input fields here.
  }
}

Inputs

name

string

required

s3-bucket-name

string

required

s3-key-prefix

optional(string)

sns-topic-name

optional(string)

cloud-watch-logs-log-group-arn

optional(string)

cloud-watch-logs-role-arn

optional(string)

kms-key-id

optional(string)

enable-log-file-validation

optional(boolean)

include-global-service-events

optional(boolean)

default true

is-multi-region-trail

optional(boolean)

is-organization-trail

optional(boolean)

enable-logging

optional(boolean)

default true

event-selectors

optional(list(object))

optional(
  list(
    object({
      data-resources: optional(
        list(
          object({
            type: string
            values: optional(list(string))
          })
        )
      )
      exclude-management-event-sources: optional(list(string))
      include-management-events: optional(boolean)
      read-write-type: optional(string)
    })
  )
)

advanced-event-selectors

optional(list(object))

optional(
  list(
    object({
      name: optional(string)
      field-selectors: list(
        object({
          field: string
          equals: optional(list(string))
          not-equals: optional(list(string))
          starts-with: optional(list(string))
          not-starts-with: optional(list(string))
          ends-with: optional(list(string))
          not-ends-with: optional(list(string))
        })
      )
    })
  )
)

insight-selectors

optional(list(object))

optional(
  list(
    object({
      insight-type: string
      event-categories: optional(list(string))
    })
  )
)

aggregation-configurations

optional(list(object))

optional(
  list(
    object({
      event-category: string
      templates: list(string)
    })
  )
)

tags

optional(map(string))

Input Constraints

Field combinations

At most one of event-selectors or advanced-event-selectors.

Event selectors rules

event-selectors holds at most 5 selectors.

Rule logic

Require

@core.length(input.event-selectors ?? []) <= 5

read-write-type must be All, ReadOnly, or WriteOnly.

Rule logic

For each

input.event-selectors ?? []

When

@each.value.read-write-type != null

Require

@each.value.read-write-type == 'All'
|| @each.value.read-write-type == 'ReadOnly'
|| @each.value.read-write-type == 'WriteOnly'

data resource type must be supported by CloudTrail.

Rule logic

For each

@s in input.event-selectors ?? []
@d in @s.value.data-resources ?? []

Require

@d.value.type == 'AWS::S3::Object'
|| @d.value.type == 'AWS::Lambda::Function'
|| @d.value.type == 'AWS::DynamoDB::Table'

data resource values holds at most 250 entries.

Rule logic

For each

@s in input.event-selectors ?? []
@d in @s.value.data-resources ?? []

Require

@core.length(@d.value.values ?? []) <= 250

Advanced event selectors rules

an advanced event selector requires field-selectors.

Rule logic

For each

input.advanced-event-selectors ?? []

Require

@core.length(@each.value.field-selectors) >= 1

advanced selector field is invalid.

Rule logic

For each

@s in input.advanced-event-selectors ?? []
@f in @s.value.field-selectors

Require

@f.value.field == 'errorCode'
|| @f.value.field == 'eventCategory'
|| @f.value.field == 'eventName'
|| @f.value.field == 'eventSource'
|| @f.value.field == 'eventType'
|| @f.value.field == 'readOnly'
|| @f.value.field == 'resources.ARN'
|| @f.value.field == 'resources.type'
|| @f.value.field == 'sessionCredentialFromConsole'
|| @f.value.field == 'userIdentity.arn'
|| @f.value.field == 'vpcEndpointId'

equals must not be empty.

Rule logic

For each

@s in input.advanced-event-selectors ?? []
@f in @s.value.field-selectors

Require

@f.value.equals == null
|| @core.length(@f.value.equals) >= 1

not-equals must not be empty.

Rule logic

For each

@s in input.advanced-event-selectors ?? []
@f in @s.value.field-selectors

Require

@f.value.not-equals == null
|| @core.length(@f.value.not-equals) >= 1

starts-with must not be empty.

Rule logic

For each

@s in input.advanced-event-selectors ?? []
@f in @s.value.field-selectors

Require

@f.value.starts-with == null
|| @core.length(@f.value.starts-with) >= 1

not-starts-with must not be empty.

Rule logic

For each

@s in input.advanced-event-selectors ?? []
@f in @s.value.field-selectors

Require

@f.value.not-starts-with == null
|| @core.length(@f.value.not-starts-with) >= 1

ends-with must not be empty.

Rule logic

For each

@s in input.advanced-event-selectors ?? []
@f in @s.value.field-selectors

Require

@f.value.ends-with == null
|| @core.length(@f.value.ends-with) >= 1

not-ends-with must not be empty.

Rule logic

For each

@s in input.advanced-event-selectors ?? []
@f in @s.value.field-selectors

Require

@f.value.not-ends-with == null
|| @core.length(@f.value.not-ends-with) >= 1

Insight selectors rules

insight-type must be a CloudTrail Insights type.

Rule logic

For each

input.insight-selectors ?? []

Require

@each.value.insight-type == 'ApiCallRateInsight'
|| @each.value.insight-type == 'ApiErrorRateInsight'

event-categories holds one or two entries.

Rule logic

For each

input.insight-selectors ?? []

Require

(@each.value.event-categories == null || @core.length(@each.value.event-categories) >= 1)
&& @core.length(@each.value.event-categories ?? []) <= 2

event category must be Management or Data.

Rule logic

For each

@s in input.insight-selectors ?? []
@category in @s.value.event-categories ?? []

Require

@category.value == 'Management'
|| @category.value == 'Data'

Aggregation configurations rules

aggregation-configurations holds at most 1 entry.

Rule logic

Require

@core.length(input.aggregation-configurations ?? []) <= 1

aggregation event-category must be Data.

Rule logic

For each

input.aggregation-configurations ?? []

Require

@each.value.event-category == 'Data'

aggregation templates holds 1 to 50 entries.

Rule logic

For each

input.aggregation-configurations ?? []

Require

@core.length(@each.value.templates) >= 1
&& @core.length(@each.value.templates) <= 50

aggregation template is invalid.

Rule logic

For each

@a in input.aggregation-configurations ?? []
@template in @a.value.templates

Require

@template.value == 'API_ACTIVITY'
|| @template.value == 'RESOURCE_ACCESS'
|| @template.value == 'USER_ACTIONS'

Outputs

arn

string

home-region

string

sns-topic-arn

string