Class: AWSCDK::CloudTrail::TrailProps

Inherits:
Jsii::Struct
  • Object
show all
Defined in:
cloud_trail/trail_props.rb

Overview

Properties for an AWS CloudTrail trail.

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(bucket: nil, cloud_watch_log_group: nil, cloud_watch_logs_retention: nil, enable_file_validation: nil, encryption_key: nil, include_global_service_events: nil, insight_types: nil, is_multi_region_trail: nil, is_organization_trail: nil, management_events: nil, org_id: nil, s3_key_prefix: nil, send_to_cloud_watch_logs: nil, sns_topic: nil, trail_name: nil) ⇒ TrailProps

Returns a new instance of TrailProps.

Parameters:

  • bucket (AWSCDK::S3::IBucket, nil) (defaults to: nil) —

    The Amazon S3 bucket.

  • cloud_watch_log_group (AWSCDK::Interfaces::AWSLogs::ILogGroupRef, nil) (defaults to: nil) —

    Log Group to which CloudTrail to push logs to.

  • cloud_watch_logs_retention (AWSCDK::Logs::RetentionDays, nil) (defaults to: nil) —

    How long to retain logs in CloudWatchLogs.

  • enable_file_validation (Boolean, nil) (defaults to: nil) —

    To determine whether a log file was modified, deleted, or unchanged after CloudTrail delivered it, you can use CloudTrail log file integrity validation.

  • encryption_key (AWSCDK::KMS::IKey, nil) (defaults to: nil) —

    The AWS Key Management Service (AWS KMS) key ID that you want to use to encrypt CloudTrail logs.

  • include_global_service_events (Boolean, nil) (defaults to: nil) —

    For most services, events are recorded in the region where the action occurred.

  • insight_types (Array<AWSCDK::CloudTrail::InsightType>, nil) (defaults to: nil) —

    A JSON string that contains the insight types you want to log on a trail.

  • is_multi_region_trail (Boolean, nil) (defaults to: nil) —

    Whether or not this trail delivers log files from multiple regions to a single S3 bucket for a single account.

  • is_organization_trail (Boolean, nil) (defaults to: nil) —

    Specifies whether the trail is applied to all accounts in an organization in AWS Organizations, or only for the current AWS account.

  • management_events (AWSCDK::CloudTrail::ReadWriteType, nil) (defaults to: nil) —

    When an event occurs in your account, CloudTrail evaluates whether the event matches the settings for your trails.

  • org_id (String, nil) (defaults to: nil) —

    The orgId.

  • s3_key_prefix (String, nil) (defaults to: nil) —

    An Amazon S3 object key prefix that precedes the name of all log files.

  • send_to_cloud_watch_logs (Boolean, nil) (defaults to: nil) —

    If CloudTrail pushes logs to CloudWatch Logs in addition to S3.

  • sns_topic (AWSCDK::SNS::ITopic, nil) (defaults to: nil) —

    SNS topic that is notified when new log files are published.

  • trail_name (String, nil) (defaults to: nil) —

    The name of the trail.



22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
 
# File 'cloud_trail/trail_props.rb', line 22

def initialize(bucket: nil, cloud_watch_log_group: nil, cloud_watch_logs_retention: nil, enable_file_validation: nil, encryption_key: nil, include_global_service_events: nil, insight_types: nil, is_multi_region_trail: nil, is_organization_trail: nil, management_events: nil, org_id: nil, s3_key_prefix: nil, send_to_cloud_watch_logs: nil, sns_topic: nil, trail_name: nil)
  @bucket = bucket
  Jsii::Type.check_type(@bucket, JSON.parse(Base64.strict_decode64("eyJmcW4iOiJhd3MtY2RrLWxpYi5hd3NfczMuSUJ1Y2tldCJ9")), "bucket") unless @bucket.nil?
  @cloud_watch_log_group = cloud_watch_log_group
  Jsii::Type.check_type(@cloud_watch_log_group, JSON.parse(Base64.strict_decode64("eyJmcW4iOiJhd3MtY2RrLWxpYi5pbnRlcmZhY2VzLmF3c19sb2dzLklMb2dHcm91cFJlZiJ9")), "cloudWatchLogGroup") unless @cloud_watch_log_group.nil?
  @cloud_watch_logs_retention = cloud_watch_logs_retention
  Jsii::Type.check_type(@cloud_watch_logs_retention, JSON.parse(Base64.strict_decode64("eyJmcW4iOiJhd3MtY2RrLWxpYi5hd3NfbG9ncy5SZXRlbnRpb25EYXlzIn0=")), "cloudWatchLogsRetention") unless @cloud_watch_logs_retention.nil?
  @enable_file_validation = enable_file_validation
  Jsii::Type.check_type(@enable_file_validation, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJib29sZWFuIn0=")), "enableFileValidation") unless @enable_file_validation.nil?
  @encryption_key = encryption_key
  Jsii::Type.check_type(@encryption_key, JSON.parse(Base64.strict_decode64("eyJmcW4iOiJhd3MtY2RrLWxpYi5hd3Nfa21zLklLZXkifQ==")), "encryptionKey") unless @encryption_key.nil?
  @include_global_service_events = include_global_service_events
  Jsii::Type.check_type(@include_global_service_events, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJib29sZWFuIn0=")), "includeGlobalServiceEvents") unless @include_global_service_events.nil?
  @insight_types = insight_types
  Jsii::Type.check_type(@insight_types, JSON.parse(Base64.strict_decode64("eyJjb2xsZWN0aW9uIjp7ImVsZW1lbnR0eXBlIjp7ImZxbiI6ImF3cy1jZGstbGliLmF3c19jbG91ZHRyYWlsLkluc2lnaHRUeXBlIn0sImtpbmQiOiJhcnJheSJ9fQ==")), "insightTypes") unless @insight_types.nil?
  @is_multi_region_trail = is_multi_region_trail
  Jsii::Type.check_type(@is_multi_region_trail, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJib29sZWFuIn0=")), "isMultiRegionTrail") unless @is_multi_region_trail.nil?
  @is_organization_trail = is_organization_trail
  Jsii::Type.check_type(@is_organization_trail, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJib29sZWFuIn0=")), "isOrganizationTrail") unless @is_organization_trail.nil?
  @management_events = management_events
  Jsii::Type.check_type(@management_events, JSON.parse(Base64.strict_decode64("eyJmcW4iOiJhd3MtY2RrLWxpYi5hd3NfY2xvdWR0cmFpbC5SZWFkV3JpdGVUeXBlIn0=")), "managementEvents") unless @management_events.nil?
  @org_id = org_id
  Jsii::Type.check_type(@org_id, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "orgId") unless @org_id.nil?
  @s3_key_prefix = s3_key_prefix
  Jsii::Type.check_type(@s3_key_prefix, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "s3KeyPrefix") unless @s3_key_prefix.nil?
  @send_to_cloud_watch_logs = send_to_cloud_watch_logs
  Jsii::Type.check_type(@send_to_cloud_watch_logs, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJib29sZWFuIn0=")), "sendToCloudWatchLogs") unless @send_to_cloud_watch_logs.nil?
  @sns_topic = sns_topic
  Jsii::Type.check_type(@sns_topic, JSON.parse(Base64.strict_decode64("eyJmcW4iOiJhd3MtY2RrLWxpYi5hd3Nfc25zLklUb3BpYyJ9")), "snsTopic") unless @sns_topic.nil?
  @trail_name = trail_name
  Jsii::Type.check_type(@trail_name, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "trailName") unless @trail_name.nil?
end

Instance Attribute Details

#bucket ⇒ AWSCDK::S3::IBucket? (readonly)

Note:

Default: - if not supplied a bucket will be created with all the correct permissions

The Amazon S3 bucket.

Returns:



59
60
61
 
# File 'cloud_trail/trail_props.rb', line 59

def bucket
  @bucket
end

#cloud_watch_log_group ⇒ AWSCDK::Interfaces::AWSLogs::ILogGroupRef? (readonly)

Note:

Default: - a new log group is created and used.

Log Group to which CloudTrail to push logs to.

Ignored if sendToCloudWatchLogs is set to false.

Returns:



66
67
68
 
# File 'cloud_trail/trail_props.rb', line 66

def cloud_watch_log_group
  @cloud_watch_log_group
end

#cloud_watch_logs_retention ⇒ AWSCDK::Logs::RetentionDays? (readonly)

Note:

Default: logs.RetentionDays.ONE_YEAR

How long to retain logs in CloudWatchLogs.

Ignored if sendToCloudWatchLogs is false or if cloudWatchLogGroup is set.

Returns:



73
74
75
 
# File 'cloud_trail/trail_props.rb', line 73

def cloud_watch_logs_retention
  @cloud_watch_logs_retention
end

#enable_file_validation ⇒ Boolean? (readonly)

Note:

Default: true

To determine whether a log file was modified, deleted, or unchanged after CloudTrail delivered it, you can use CloudTrail log file integrity validation.

This feature is built using industry standard algorithms: SHA-256 for hashing and SHA-256 with RSA for digital signing. This makes it computationally infeasible to modify, delete or forge CloudTrail log files without detection. You can use the AWS CLI to validate the files in the location where CloudTrail delivered them.

Returns:

  • (Boolean, nil) 


82
83
84
 
# File 'cloud_trail/trail_props.rb', line 82

def enable_file_validation
  @enable_file_validation
end

#encryption_key ⇒ AWSCDK::KMS::IKey? (readonly)

Note:

Default: - No encryption.

The AWS Key Management Service (AWS KMS) key ID that you want to use to encrypt CloudTrail logs.

Returns:



87
88
89
 
# File 'cloud_trail/trail_props.rb', line 87

def encryption_key
  @encryption_key
end

#include_global_service_events ⇒ Boolean? (readonly)

Note:

Default: true

For most services, events are recorded in the region where the action occurred.

For global services such as AWS Identity and Access Management (IAM), AWS STS, Amazon CloudFront, and Route 53, events are delivered to any trail that includes global services, and are logged as occurring in US East (N. Virginia) Region.

Returns:

  • (Boolean, nil) 


95
96
97
 
# File 'cloud_trail/trail_props.rb', line 95

def include_global_service_events
  @include_global_service_events
end

#insight_types ⇒ Array<AWSCDK::CloudTrail::InsightType>? (readonly)

Note:

Default: - No Value.

A JSON string that contains the insight types you want to log on a trail.

Returns:



100
101
102
 
# File 'cloud_trail/trail_props.rb', line 100

def insight_types
  @insight_types
end

#is_multi_region_trail ⇒ Boolean? (readonly)

Note:

Default: true

Whether or not this trail delivers log files from multiple regions to a single S3 bucket for a single account.

Returns:

  • (Boolean, nil) 


105
106
107
 
# File 'cloud_trail/trail_props.rb', line 105

def is_multi_region_trail
  @is_multi_region_trail
end

#is_organization_trail ⇒ Boolean? (readonly)

Note:

Default: - false

Specifies whether the trail is applied to all accounts in an organization in AWS Organizations, or only for the current AWS account.

If this is set to true then the current account must be the management account. If it is not, then CloudFormation will throw an error.

If this is set to true and the current account is a management account for an organization in AWS Organizations, the trail will be created in all AWS accounts that belong to the organization. If this is set to false, the trail will remain in the current AWS account but be deleted from all member accounts in the organization.

Returns:

  • (Boolean, nil) 


115
116
117
 
# File 'cloud_trail/trail_props.rb', line 115

def is_organization_trail
  @is_organization_trail
end

#management_events ⇒ AWSCDK::CloudTrail::ReadWriteType? (readonly)

Note:

Default: ReadWriteType.ALL

When an event occurs in your account, CloudTrail evaluates whether the event matches the settings for your trails.

Only events that match your trail settings are delivered to your Amazon S3 bucket and Amazon CloudWatch Logs log group.

This method sets the management configuration for this trail.

Management events provide insight into management operations that are performed on resources in your AWS account. These are also known as control plane operations. Management events can also include non-API events that occur in your account. For example, when a user logs in to your account, CloudTrail logs the ConsoleLogin event.

Returns:



129
130
131
 
# File 'cloud_trail/trail_props.rb', line 129

def management_events
  @management_events
end

#org_id ⇒ String? (readonly)

Note:

Default: - No orgId

The orgId.

Required when is_organization_trail is set to true to attach the necessary permissions.

Returns:

  • (String, nil) 


136
137
138
 
# File 'cloud_trail/trail_props.rb', line 136

def org_id
  @org_id
end

#s3_key_prefix ⇒ String? (readonly)

Note:

Default: - No prefix.

An Amazon S3 object key prefix that precedes the name of all log files.

Returns:

  • (String, nil) 


141
142
143
 
# File 'cloud_trail/trail_props.rb', line 141

def s3_key_prefix
  @s3_key_prefix
end

#send_to_cloud_watch_logs ⇒ Boolean? (readonly)

Note:

Default: false

If CloudTrail pushes logs to CloudWatch Logs in addition to S3.

Disabled for cost out of the box.

Returns:

  • (Boolean, nil) 


148
149
150
 
# File 'cloud_trail/trail_props.rb', line 148

def send_to_cloud_watch_logs
  @send_to_cloud_watch_logs
end

#sns_topic ⇒ AWSCDK::SNS::ITopic? (readonly)

Note:

Default: - No notifications.

SNS topic that is notified when new log files are published.

Returns:



153
154
155
 
# File 'cloud_trail/trail_props.rb', line 153

def sns_topic
  @sns_topic
end

#trail_name ⇒ String? (readonly)

Note:

Default: - AWS CloudFormation generated name.

The name of the trail.

Required when is_organization_trail is set to true to attach the necessary permissions.

Otherwise, we recommend customers do not set an explicit name.

Returns:

  • (String, nil) 


162
163
164
 
# File 'cloud_trail/trail_props.rb', line 162

def trail_name
  @trail_name
end

Class Method Details

.jsii_properties ⇒ Object 



164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
 
# File 'cloud_trail/trail_props.rb', line 164

def self.jsii_properties
  {
    :bucket => "bucket",
    :cloud_watch_log_group => "cloudWatchLogGroup",
    :cloud_watch_logs_retention => "cloudWatchLogsRetention",
    :enable_file_validation => "enableFileValidation",
    :encryption_key => "encryptionKey",
    :include_global_service_events => "includeGlobalServiceEvents",
    :insight_types => "insightTypes",
    :is_multi_region_trail => "isMultiRegionTrail",
    :is_organization_trail => "isOrganizationTrail",
    :management_events => "managementEvents",
    :org_id => "orgId",
    :s3_key_prefix => "s3KeyPrefix",
    :send_to_cloud_watch_logs => "sendToCloudWatchLogs",
    :sns_topic => "snsTopic",
    :trail_name => "trailName",
  }
end

Instance Method Details

#to_jsii ⇒ Object 



184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
 
# File 'cloud_trail/trail_props.rb', line 184

def to_jsii
  result = {}
  result.merge!({
    "bucket" => @bucket,
    "cloudWatchLogGroup" => @cloud_watch_log_group,
    "cloudWatchLogsRetention" => @cloud_watch_logs_retention,
    "enableFileValidation" => @enable_file_validation,
    "encryptionKey" => @encryption_key,
    "includeGlobalServiceEvents" => @include_global_service_events,
    "insightTypes" => @insight_types,
    "isMultiRegionTrail" => @is_multi_region_trail,
    "isOrganizationTrail" => @is_organization_trail,
    "managementEvents" => @management_events,
    "orgId" => @org_id,
    "s3KeyPrefix" => @s3_key_prefix,
    "sendToCloudWatchLogs" => @send_to_cloud_watch_logs,
    "snsTopic" => @sns_topic,
    "trailName" => @trail_name,
  })
  result.compact
end