Copyright | (c) 2013-2021 Brendan Hay |
---|---|
License | Mozilla Public License, v. 2.0. |
Maintainer | Brendan Hay <brendan.g.hay+amazonka@gmail.com> |
Stability | auto-generated |
Portability | non-portable (GHC extensions) |
Safe Haskell | None |
- Service Configuration
- Errors
- InvalidTimeRangeException
- InsufficientS3BucketPolicyException
- MaximumNumberOfTrailsExceededException
- InsufficientDependencyServiceAccessPermissionException
- UnsupportedOperationException
- InvalidEventCategoryException
- KmsKeyDisabledException
- InsufficientEncryptionPolicyException
- InsufficientSnsTopicPolicyException
- InvalidCloudWatchLogsRoleArnException
- CloudTrailAccessNotEnabledException
- TagsLimitExceededException
- CloudTrailARNInvalidException
- InvalidLookupAttributesException
- InvalidTrailNameException
- InvalidSnsTopicNameException
- ResourceTypeNotSupportedException
- CloudWatchLogsDeliveryUnavailableException
- OrganizationsNotInUseException
- KmsKeyNotFoundException
- TrailNotFoundException
- ConflictException
- InsightNotEnabledException
- NotOrganizationMasterAccountException
- InvalidEventSelectorsException
- TrailNotProvidedException
- InvalidS3BucketNameException
- InvalidCloudWatchLogsLogGroupArnException
- KmsException
- CloudTrailInvalidClientTokenIdException
- S3BucketDoesNotExistException
- InvalidNextTokenException
- InvalidTagParameterException
- OperationNotPermittedException
- InvalidTokenException
- InvalidMaxResultsException
- TrailAlreadyExistsException
- OrganizationNotInAllFeaturesModeException
- InvalidInsightSelectorsException
- InvalidS3PrefixException
- ResourceNotFoundException
- InvalidParameterCombinationException
- InvalidKmsKeyIdException
- InvalidHomeRegionException
- Waiters
- Operations
- Types
Derived from API version 2013-11-01
of the AWS service descriptions, licensed under Apache 2.0.
CloudTrail
This is the CloudTrail API Reference. It provides descriptions of actions, data types, common parameters, and common errors for CloudTrail.
CloudTrail is a web service that records Amazon Web Services API calls for your Amazon Web Services account and delivers log files to an Amazon S3 bucket. The recorded information includes the identity of the user, the start time of the Amazon Web Services API call, the source IP address, the request parameters, and the response elements returned by the service.
As an alternative to the API, you can use one of the Amazon Web Services SDKs, which consist of libraries and sample code for various programming languages and platforms (Java, Ruby, .NET, iOS, Android, etc.). The SDKs provide programmatic access to CloudTrail. For example, the SDKs handle cryptographically signing requests, managing errors, and retrying requests automatically. For more information about the Amazon Web Services SDKs, including how to download and install them, see Tools to Build on Amazon Web Services.
See the CloudTrail User Guide for information about the data that is included with each Amazon Web Services API call listed in the log files.
Synopsis
- defaultService :: Service
- _InvalidTimeRangeException :: AsError a => Getting (First ServiceError) a ServiceError
- _InsufficientS3BucketPolicyException :: AsError a => Getting (First ServiceError) a ServiceError
- _MaximumNumberOfTrailsExceededException :: AsError a => Getting (First ServiceError) a ServiceError
- _InsufficientDependencyServiceAccessPermissionException :: AsError a => Getting (First ServiceError) a ServiceError
- _UnsupportedOperationException :: AsError a => Getting (First ServiceError) a ServiceError
- _InvalidEventCategoryException :: AsError a => Getting (First ServiceError) a ServiceError
- _KmsKeyDisabledException :: AsError a => Getting (First ServiceError) a ServiceError
- _InsufficientEncryptionPolicyException :: AsError a => Getting (First ServiceError) a ServiceError
- _InsufficientSnsTopicPolicyException :: AsError a => Getting (First ServiceError) a ServiceError
- _InvalidCloudWatchLogsRoleArnException :: AsError a => Getting (First ServiceError) a ServiceError
- _CloudTrailAccessNotEnabledException :: AsError a => Getting (First ServiceError) a ServiceError
- _TagsLimitExceededException :: AsError a => Getting (First ServiceError) a ServiceError
- _CloudTrailARNInvalidException :: AsError a => Getting (First ServiceError) a ServiceError
- _InvalidLookupAttributesException :: AsError a => Getting (First ServiceError) a ServiceError
- _InvalidTrailNameException :: AsError a => Getting (First ServiceError) a ServiceError
- _InvalidSnsTopicNameException :: AsError a => Getting (First ServiceError) a ServiceError
- _ResourceTypeNotSupportedException :: AsError a => Getting (First ServiceError) a ServiceError
- _CloudWatchLogsDeliveryUnavailableException :: AsError a => Getting (First ServiceError) a ServiceError
- _OrganizationsNotInUseException :: AsError a => Getting (First ServiceError) a ServiceError
- _KmsKeyNotFoundException :: AsError a => Getting (First ServiceError) a ServiceError
- _TrailNotFoundException :: AsError a => Getting (First ServiceError) a ServiceError
- _ConflictException :: AsError a => Getting (First ServiceError) a ServiceError
- _InsightNotEnabledException :: AsError a => Getting (First ServiceError) a ServiceError
- _NotOrganizationMasterAccountException :: AsError a => Getting (First ServiceError) a ServiceError
- _InvalidEventSelectorsException :: AsError a => Getting (First ServiceError) a ServiceError
- _TrailNotProvidedException :: AsError a => Getting (First ServiceError) a ServiceError
- _InvalidS3BucketNameException :: AsError a => Getting (First ServiceError) a ServiceError
- _InvalidCloudWatchLogsLogGroupArnException :: AsError a => Getting (First ServiceError) a ServiceError
- _KmsException :: AsError a => Getting (First ServiceError) a ServiceError
- _CloudTrailInvalidClientTokenIdException :: AsError a => Getting (First ServiceError) a ServiceError
- _S3BucketDoesNotExistException :: AsError a => Getting (First ServiceError) a ServiceError
- _InvalidNextTokenException :: AsError a => Getting (First ServiceError) a ServiceError
- _InvalidTagParameterException :: AsError a => Getting (First ServiceError) a ServiceError
- _OperationNotPermittedException :: AsError a => Getting (First ServiceError) a ServiceError
- _InvalidTokenException :: AsError a => Getting (First ServiceError) a ServiceError
- _InvalidMaxResultsException :: AsError a => Getting (First ServiceError) a ServiceError
- _TrailAlreadyExistsException :: AsError a => Getting (First ServiceError) a ServiceError
- _OrganizationNotInAllFeaturesModeException :: AsError a => Getting (First ServiceError) a ServiceError
- _InvalidInsightSelectorsException :: AsError a => Getting (First ServiceError) a ServiceError
- _InvalidS3PrefixException :: AsError a => Getting (First ServiceError) a ServiceError
- _ResourceNotFoundException :: AsError a => Getting (First ServiceError) a ServiceError
- _InvalidParameterCombinationException :: AsError a => Getting (First ServiceError) a ServiceError
- _InvalidKmsKeyIdException :: AsError a => Getting (First ServiceError) a ServiceError
- _InvalidHomeRegionException :: AsError a => Getting (First ServiceError) a ServiceError
- data DescribeTrails = DescribeTrails' (Maybe Bool) (Maybe [Text])
- newDescribeTrails :: DescribeTrails
- data DescribeTrailsResponse = DescribeTrailsResponse' (Maybe [Trail]) Int
- newDescribeTrailsResponse :: Int -> DescribeTrailsResponse
- data ListPublicKeys = ListPublicKeys' (Maybe POSIX) (Maybe Text) (Maybe POSIX)
- newListPublicKeys :: ListPublicKeys
- data ListPublicKeysResponse = ListPublicKeysResponse' (Maybe [PublicKey]) (Maybe Text) Int
- newListPublicKeysResponse :: Int -> ListPublicKeysResponse
- data RemoveTags = RemoveTags' (Maybe [Tag]) Text
- newRemoveTags :: Text -> RemoveTags
- data RemoveTagsResponse = RemoveTagsResponse' Int
- newRemoveTagsResponse :: Int -> RemoveTagsResponse
- data LookupEvents = LookupEvents' (Maybe EventCategory) (Maybe POSIX) (Maybe [LookupAttribute]) (Maybe Text) (Maybe POSIX) (Maybe Natural)
- newLookupEvents :: LookupEvents
- data LookupEventsResponse = LookupEventsResponse' (Maybe Text) (Maybe [Event]) Int
- newLookupEventsResponse :: Int -> LookupEventsResponse
- data StopLogging = StopLogging' Text
- newStopLogging :: Text -> StopLogging
- data StopLoggingResponse = StopLoggingResponse' Int
- newStopLoggingResponse :: Int -> StopLoggingResponse
- data DeleteTrail = DeleteTrail' Text
- newDeleteTrail :: Text -> DeleteTrail
- data DeleteTrailResponse = DeleteTrailResponse' Int
- newDeleteTrailResponse :: Int -> DeleteTrailResponse
- data UpdateTrail = UpdateTrail' (Maybe Text) (Maybe Text) (Maybe Bool) (Maybe Text) (Maybe Text) (Maybe Bool) (Maybe Bool) (Maybe Text) (Maybe Text) (Maybe Bool) Text
- newUpdateTrail :: Text -> UpdateTrail
- data UpdateTrailResponse = UpdateTrailResponse' (Maybe Bool) (Maybe Text) (Maybe Text) (Maybe Text) (Maybe Text) (Maybe Text) (Maybe Text) (Maybe Text) (Maybe Bool) (Maybe Bool) (Maybe Text) (Maybe Text) (Maybe Bool) Int
- newUpdateTrailResponse :: Int -> UpdateTrailResponse
- data CreateTrail = CreateTrail' (Maybe Text) (Maybe Text) (Maybe Bool) (Maybe Text) (Maybe Text) (Maybe Bool) (Maybe [Tag]) (Maybe Bool) (Maybe Text) (Maybe Bool) Text Text
- newCreateTrail :: Text -> Text -> CreateTrail
- data CreateTrailResponse = CreateTrailResponse' (Maybe Bool) (Maybe Text) (Maybe Text) (Maybe Text) (Maybe Text) (Maybe Text) (Maybe Text) (Maybe Text) (Maybe Bool) (Maybe Bool) (Maybe Text) (Maybe Text) (Maybe Bool) Int
- newCreateTrailResponse :: Int -> CreateTrailResponse
- data PutInsightSelectors = PutInsightSelectors' Text [InsightSelector]
- newPutInsightSelectors :: Text -> PutInsightSelectors
- data PutInsightSelectorsResponse = PutInsightSelectorsResponse' (Maybe Text) (Maybe [InsightSelector]) Int
- newPutInsightSelectorsResponse :: Int -> PutInsightSelectorsResponse
- data GetEventSelectors = GetEventSelectors' Text
- newGetEventSelectors :: Text -> GetEventSelectors
- data GetEventSelectorsResponse = GetEventSelectorsResponse' (Maybe Text) (Maybe [EventSelector]) (Maybe [AdvancedEventSelector]) Int
- newGetEventSelectorsResponse :: Int -> GetEventSelectorsResponse
- data GetTrail = GetTrail' Text
- newGetTrail :: Text -> GetTrail
- data GetTrailResponse = GetTrailResponse' (Maybe Trail) Int
- newGetTrailResponse :: Int -> GetTrailResponse
- data GetTrailStatus = GetTrailStatus' Text
- newGetTrailStatus :: Text -> GetTrailStatus
- data GetTrailStatusResponse = GetTrailStatusResponse' (Maybe Text) (Maybe Text) (Maybe POSIX) (Maybe Text) (Maybe POSIX) (Maybe Text) (Maybe Text) (Maybe Bool) (Maybe Text) (Maybe Text) (Maybe Text) (Maybe POSIX) (Maybe POSIX) (Maybe Text) (Maybe POSIX) (Maybe Text) (Maybe POSIX) Int
- newGetTrailStatusResponse :: Int -> GetTrailStatusResponse
- data AddTags = AddTags' (Maybe [Tag]) Text
- newAddTags :: Text -> AddTags
- data AddTagsResponse = AddTagsResponse' Int
- newAddTagsResponse :: Int -> AddTagsResponse
- data ListTags = ListTags' (Maybe Text) [Text]
- newListTags :: ListTags
- data ListTagsResponse = ListTagsResponse' (Maybe Text) (Maybe [ResourceTag]) Int
- newListTagsResponse :: Int -> ListTagsResponse
- data PutEventSelectors = PutEventSelectors' (Maybe [EventSelector]) (Maybe [AdvancedEventSelector]) Text
- newPutEventSelectors :: Text -> PutEventSelectors
- data PutEventSelectorsResponse = PutEventSelectorsResponse' (Maybe Text) (Maybe [EventSelector]) (Maybe [AdvancedEventSelector]) Int
- newPutEventSelectorsResponse :: Int -> PutEventSelectorsResponse
- data StartLogging = StartLogging' Text
- newStartLogging :: Text -> StartLogging
- data StartLoggingResponse = StartLoggingResponse' Int
- newStartLoggingResponse :: Int -> StartLoggingResponse
- data ListTrails = ListTrails' (Maybe Text)
- newListTrails :: ListTrails
- data ListTrailsResponse = ListTrailsResponse' (Maybe Text) (Maybe [TrailInfo]) Int
- newListTrailsResponse :: Int -> ListTrailsResponse
- data GetInsightSelectors = GetInsightSelectors' Text
- newGetInsightSelectors :: Text -> GetInsightSelectors
- data GetInsightSelectorsResponse = GetInsightSelectorsResponse' (Maybe Text) (Maybe [InsightSelector]) Int
- newGetInsightSelectorsResponse :: Int -> GetInsightSelectorsResponse
- newtype EventCategory where
- EventCategory' { }
- pattern EventCategory_Insight :: EventCategory
- newtype InsightType where
- InsightType' { }
- pattern InsightType_ApiCallRateInsight :: InsightType
- newtype LookupAttributeKey where
- LookupAttributeKey' { }
- pattern LookupAttributeKey_AccessKeyId :: LookupAttributeKey
- pattern LookupAttributeKey_EventId :: LookupAttributeKey
- pattern LookupAttributeKey_EventName :: LookupAttributeKey
- pattern LookupAttributeKey_EventSource :: LookupAttributeKey
- pattern LookupAttributeKey_ReadOnly :: LookupAttributeKey
- pattern LookupAttributeKey_ResourceName :: LookupAttributeKey
- pattern LookupAttributeKey_ResourceType :: LookupAttributeKey
- pattern LookupAttributeKey_Username :: LookupAttributeKey
- newtype ReadWriteType where
- ReadWriteType' { }
- pattern ReadWriteType_All :: ReadWriteType
- pattern ReadWriteType_ReadOnly :: ReadWriteType
- pattern ReadWriteType_WriteOnly :: ReadWriteType
- data AdvancedEventSelector = AdvancedEventSelector' (Maybe Text) (NonEmpty AdvancedFieldSelector)
- newAdvancedEventSelector :: NonEmpty AdvancedFieldSelector -> AdvancedEventSelector
- data AdvancedFieldSelector = AdvancedFieldSelector' (Maybe (NonEmpty Text)) (Maybe (NonEmpty Text)) (Maybe (NonEmpty Text)) (Maybe (NonEmpty Text)) (Maybe (NonEmpty Text)) (Maybe (NonEmpty Text)) Text
- newAdvancedFieldSelector :: Text -> AdvancedFieldSelector
- data DataResource = DataResource' (Maybe [Text]) (Maybe Text)
- newDataResource :: DataResource
- data Event = Event' (Maybe Text) (Maybe [Resource]) (Maybe POSIX) (Maybe Text) (Maybe Text) (Maybe Text) (Maybe Text) (Maybe Text) (Maybe Text)
- newEvent :: Event
- data EventSelector = EventSelector' (Maybe [DataResource]) (Maybe ReadWriteType) (Maybe [Text]) (Maybe Bool)
- newEventSelector :: EventSelector
- data InsightSelector = InsightSelector' (Maybe InsightType)
- newInsightSelector :: InsightSelector
- data LookupAttribute = LookupAttribute' LookupAttributeKey Text
- newLookupAttribute :: LookupAttributeKey -> Text -> LookupAttribute
- data PublicKey = PublicKey' (Maybe Text) (Maybe POSIX) (Maybe Base64) (Maybe POSIX)
- newPublicKey :: PublicKey
- data Resource = Resource' (Maybe Text) (Maybe Text)
- newResource :: Resource
- data ResourceTag = ResourceTag' (Maybe Text) (Maybe [Tag])
- newResourceTag :: ResourceTag
- data Tag = Tag' (Maybe Text) Text
- newTag :: Text -> Tag
- data Trail = Trail' (Maybe Bool) (Maybe Text) (Maybe Text) (Maybe Bool) (Maybe Text) (Maybe Text) (Maybe Text) (Maybe Text) (Maybe Text) (Maybe Text) (Maybe Bool) (Maybe Bool) (Maybe Bool) (Maybe Text) (Maybe Text) (Maybe Bool)
- newTrail :: Trail
- data TrailInfo = TrailInfo' (Maybe Text) (Maybe Text) (Maybe Text)
- newTrailInfo :: TrailInfo
Service Configuration
defaultService :: Service Source #
API version 2013-11-01
of the Amazon CloudTrail SDK configuration.
Errors
Error matchers are designed for use with the functions provided by
Control.Exception.Lens.
This allows catching (and rethrowing) service specific errors returned
by CloudTrail
.
InvalidTimeRangeException
_InvalidTimeRangeException :: AsError a => Getting (First ServiceError) a ServiceError Source #
Occurs if the timestamp values are not valid. Either the start time occurs after the end time, or the time range is outside the range of possible values.
InsufficientS3BucketPolicyException
_InsufficientS3BucketPolicyException :: AsError a => Getting (First ServiceError) a ServiceError Source #
This exception is thrown when the policy on the S3 bucket is not sufficient.
MaximumNumberOfTrailsExceededException
_MaximumNumberOfTrailsExceededException :: AsError a => Getting (First ServiceError) a ServiceError Source #
This exception is thrown when the maximum number of trails is reached.
InsufficientDependencyServiceAccessPermissionException
_InsufficientDependencyServiceAccessPermissionException :: AsError a => Getting (First ServiceError) a ServiceError Source #
This exception is thrown when the IAM user or role that is used to create the organization trail is lacking one or more required permissions for creating an organization trail in a required service. For more information, see Prepare For Creating a Trail For Your Organization.
UnsupportedOperationException
_UnsupportedOperationException :: AsError a => Getting (First ServiceError) a ServiceError Source #
This exception is thrown when the requested operation is not supported.
InvalidEventCategoryException
_InvalidEventCategoryException :: AsError a => Getting (First ServiceError) a ServiceError Source #
Occurs if an event category that is not valid is specified as a value of
EventCategory
.
KmsKeyDisabledException
_KmsKeyDisabledException :: AsError a => Getting (First ServiceError) a ServiceError Source #
This exception is no longer in use.
InsufficientEncryptionPolicyException
_InsufficientEncryptionPolicyException :: AsError a => Getting (First ServiceError) a ServiceError Source #
This exception is thrown when the policy on the S3 bucket or KMS key is not sufficient.
InsufficientSnsTopicPolicyException
_InsufficientSnsTopicPolicyException :: AsError a => Getting (First ServiceError) a ServiceError Source #
This exception is thrown when the policy on the Amazon SNS topic is not sufficient.
InvalidCloudWatchLogsRoleArnException
_InvalidCloudWatchLogsRoleArnException :: AsError a => Getting (First ServiceError) a ServiceError Source #
This exception is thrown when the provided role is not valid.
CloudTrailAccessNotEnabledException
_CloudTrailAccessNotEnabledException :: AsError a => Getting (First ServiceError) a ServiceError Source #
This exception is thrown when trusted access has not been enabled between CloudTrail and Organizations. For more information, see Enabling Trusted Access with Other Amazon Web Services Services and Prepare For Creating a Trail For Your Organization.
TagsLimitExceededException
_TagsLimitExceededException :: AsError a => Getting (First ServiceError) a ServiceError Source #
The number of tags per trail has exceeded the permitted amount. Currently, the limit is 50.
CloudTrailARNInvalidException
_CloudTrailARNInvalidException :: AsError a => Getting (First ServiceError) a ServiceError Source #
This exception is thrown when an operation is called with a trail ARN that is not valid. The following is the format of a trail ARN.
arn:aws:cloudtrail:us-east-2:123456789012:trail/MyTrail
InvalidLookupAttributesException
_InvalidLookupAttributesException :: AsError a => Getting (First ServiceError) a ServiceError Source #
Occurs when a lookup attribute is specified that is not valid.
InvalidTrailNameException
_InvalidTrailNameException :: AsError a => Getting (First ServiceError) a ServiceError Source #
This exception is thrown when the provided trail name is not valid. Trail names must meet the following requirements:
- Contain only ASCII letters (a-z, A-Z), numbers (0-9), periods (.), underscores (_), or dashes (-)
- Start with a letter or number, and end with a letter or number
- Be between 3 and 128 characters
- Have no adjacent periods, underscores or dashes. Names like
my-_namespace
andmy--namespace
are not valid. - Not be in IP address format (for example, 192.168.5.4)
InvalidSnsTopicNameException
_InvalidSnsTopicNameException :: AsError a => Getting (First ServiceError) a ServiceError Source #
This exception is thrown when the provided SNS topic name is not valid.
ResourceTypeNotSupportedException
_ResourceTypeNotSupportedException :: AsError a => Getting (First ServiceError) a ServiceError Source #
This exception is thrown when the specified resource type is not supported by CloudTrail.
CloudWatchLogsDeliveryUnavailableException
_CloudWatchLogsDeliveryUnavailableException :: AsError a => Getting (First ServiceError) a ServiceError Source #
Cannot set a CloudWatch Logs delivery for this region.
OrganizationsNotInUseException
_OrganizationsNotInUseException :: AsError a => Getting (First ServiceError) a ServiceError Source #
This exception is thrown when the request is made from an Amazon Web Services account that is not a member of an organization. To make this request, sign in using the credentials of an account that belongs to an organization.
KmsKeyNotFoundException
_KmsKeyNotFoundException :: AsError a => Getting (First ServiceError) a ServiceError Source #
This exception is thrown when the KMS key does not exist, when the S3 bucket and the KMS key are not in the same region, or when the KMS key associated with the Amazon SNS topic either does not exist or is not in the same region.
TrailNotFoundException
_TrailNotFoundException :: AsError a => Getting (First ServiceError) a ServiceError Source #
This exception is thrown when the trail with the given name is not found.
ConflictException
_ConflictException :: AsError a => Getting (First ServiceError) a ServiceError Source #
This exception is thrown when the specified resource is not ready for an operation. This can occur when you try to run an operation on a trail before CloudTrail has time to fully load the trail. If this exception occurs, wait a few minutes, and then try the operation again.
InsightNotEnabledException
_InsightNotEnabledException :: AsError a => Getting (First ServiceError) a ServiceError Source #
If you run GetInsightSelectors
on a trail that does not have Insights
events enabled, the operation throws the exception
InsightNotEnabledException
.
NotOrganizationMasterAccountException
_NotOrganizationMasterAccountException :: AsError a => Getting (First ServiceError) a ServiceError Source #
This exception is thrown when the Amazon Web Services account making the request to create or update an organization trail is not the management account for an organization in Organizations. For more information, see Prepare For Creating a Trail For Your Organization.
InvalidEventSelectorsException
_InvalidEventSelectorsException :: AsError a => Getting (First ServiceError) a ServiceError Source #
This exception is thrown when the PutEventSelectors
operation is
called with a number of event selectors, advanced event selectors, or
data resources that is not valid. The combination of event selectors or
advanced event selectors and data resources is not valid. A trail can
have up to 5 event selectors. If a trail uses advanced event selectors,
a maximum of 500 total values for all conditions in all advanced event
selectors is allowed. A trail is limited to 250 data resources. These
data resources can be distributed across event selectors, but the
overall total cannot exceed 250.
You can:
- Specify a valid number of event selectors (1 to 5) for a trail.
- Specify a valid number of data resources (1 to 250) for an event selector. The limit of number of resources on an individual event selector is configurable up to 250. However, this upper limit is allowed only if the total number of data resources does not exceed 250 across all event selectors for a trail.
- Specify up to 500 values for all conditions in all advanced event selectors for a trail.
- Specify a valid value for a parameter. For example, specifying the
ReadWriteType
parameter with a value ofread-only
is not valid.
TrailNotProvidedException
_TrailNotProvidedException :: AsError a => Getting (First ServiceError) a ServiceError Source #
This exception is no longer in use.
InvalidS3BucketNameException
_InvalidS3BucketNameException :: AsError a => Getting (First ServiceError) a ServiceError Source #
This exception is thrown when the provided S3 bucket name is not valid.
InvalidCloudWatchLogsLogGroupArnException
_InvalidCloudWatchLogsLogGroupArnException :: AsError a => Getting (First ServiceError) a ServiceError Source #
This exception is thrown when the provided CloudWatch Logs log group is not valid.
KmsException
_KmsException :: AsError a => Getting (First ServiceError) a ServiceError Source #
This exception is thrown when there is an issue with the specified KMS key and the trail can’t be updated.
CloudTrailInvalidClientTokenIdException
_CloudTrailInvalidClientTokenIdException :: AsError a => Getting (First ServiceError) a ServiceError Source #
This exception is thrown when a call results in the
InvalidClientTokenId
error code. This can occur when you are creating
or updating a trail to send notifications to an Amazon SNS topic that is
in a suspended Amazon Web Services account.
S3BucketDoesNotExistException
_S3BucketDoesNotExistException :: AsError a => Getting (First ServiceError) a ServiceError Source #
This exception is thrown when the specified S3 bucket does not exist.
InvalidNextTokenException
_InvalidNextTokenException :: AsError a => Getting (First ServiceError) a ServiceError Source #
A token that is not valid, or a token that was previously used in a request with different parameters. This exception is thrown if the token is not valid.
InvalidTagParameterException
_InvalidTagParameterException :: AsError a => Getting (First ServiceError) a ServiceError Source #
This exception is thrown when the specified tag key or values are not valid. It can also occur if there are duplicate tags or too many tags on the resource.
OperationNotPermittedException
_OperationNotPermittedException :: AsError a => Getting (First ServiceError) a ServiceError Source #
This exception is thrown when the requested operation is not permitted.
InvalidTokenException
_InvalidTokenException :: AsError a => Getting (First ServiceError) a ServiceError Source #
Reserved for future use.
InvalidMaxResultsException
_InvalidMaxResultsException :: AsError a => Getting (First ServiceError) a ServiceError Source #
This exception is thrown if the limit specified is not valid.
TrailAlreadyExistsException
_TrailAlreadyExistsException :: AsError a => Getting (First ServiceError) a ServiceError Source #
This exception is thrown when the specified trail already exists.
OrganizationNotInAllFeaturesModeException
_OrganizationNotInAllFeaturesModeException :: AsError a => Getting (First ServiceError) a ServiceError Source #
This exception is thrown when Organizations is not configured to support all features. All features must be enabled in Organizations to support creating an organization trail. For more information, see Prepare For Creating a Trail For Your Organization.
InvalidInsightSelectorsException
_InvalidInsightSelectorsException :: AsError a => Getting (First ServiceError) a ServiceError Source #
The formatting or syntax of the InsightSelectors
JSON statement in
your PutInsightSelectors
or GetInsightSelectors
request is not
valid, or the specified insight type in the InsightSelectors
statement
is not a valid insight type.
InvalidS3PrefixException
_InvalidS3PrefixException :: AsError a => Getting (First ServiceError) a ServiceError Source #
This exception is thrown when the provided S3 prefix is not valid.
ResourceNotFoundException
_ResourceNotFoundException :: AsError a => Getting (First ServiceError) a ServiceError Source #
This exception is thrown when the specified resource is not found.
InvalidParameterCombinationException
_InvalidParameterCombinationException :: AsError a => Getting (First ServiceError) a ServiceError Source #
This exception is thrown when the combination of parameters provided is not valid.
InvalidKmsKeyIdException
_InvalidKmsKeyIdException :: AsError a => Getting (First ServiceError) a ServiceError Source #
This exception is thrown when the KMS key ARN is not valid.
InvalidHomeRegionException
_InvalidHomeRegionException :: AsError a => Getting (First ServiceError) a ServiceError Source #
This exception is thrown when an operation is called on a trail from a region other than the region in which the trail was created.
Waiters
Waiters poll by repeatedly sending a request until some remote success condition
configured by the Wait
specification is fulfilled. The Wait
specification
determines how many attempts should be made, in addition to delay and retry strategies.
Operations
Some AWS operations return results that are incomplete and require subsequent
requests in order to obtain the entire result set. The process of sending
subsequent requests to continue where a previous request left off is called
pagination. For example, the ListObjects
operation of Amazon S3 returns up to
1000 objects at a time, and you must send subsequent requests with the
appropriate Marker in order to retrieve the next page of results.
Operations that have an AWSPager
instance can transparently perform subsequent
requests, correctly setting Markers and other request facets to iterate through
the entire result set of a truncated API operation. Operations which support
this have an additional note in the documentation.
Many operations have the ability to filter results on the server side. See the individual operation parameters for details.
DescribeTrails
data DescribeTrails Source #
Returns information about the trail.
See: newDescribeTrails
smart constructor.
DescribeTrails' (Maybe Bool) (Maybe [Text]) |
Instances
newDescribeTrails :: DescribeTrails Source #
Create a value of DescribeTrails
with all optional fields omitted.
Use generic-lens or optics to modify other optional fields.
The following record fields are available, with the corresponding lenses provided for backwards compatibility:
$sel:includeShadowTrails:DescribeTrails'
, describeTrails_includeShadowTrails
- Specifies whether to include shadow trails in the response. A shadow
trail is the replication in a region of a trail that was created in a
different region, or in the case of an organization trail, the
replication of an organization trail in member accounts. If you do not
include shadow trails, organization trails in a member account and
region replication trails will not be returned. The default is true.
$sel:trailNameList:DescribeTrails'
, describeTrails_trailNameList
- Specifies a list of trail names, trail ARNs, or both, of the trails to
describe. The format of a trail ARN is:
arn:aws:cloudtrail:us-east-2:123456789012:trail/MyTrail
If an empty list is specified, information for the trail in the current region is returned.
- If an empty list is specified and
IncludeShadowTrails
is false, then information for all trails in the current region is returned. - If an empty list is specified and IncludeShadowTrails is null or true, then information for all trails in the current region and any associated shadow trails in other regions is returned.
If one or more trail names are specified, information is returned only if the names match the names of trails belonging only to the current region. To return information about a trail in another region, you must specify its trail ARN.
data DescribeTrailsResponse Source #
Returns the objects or data listed below if successful. Otherwise, returns an error.
See: newDescribeTrailsResponse
smart constructor.
Instances
newDescribeTrailsResponse Source #
Create a value of DescribeTrailsResponse
with all optional fields omitted.
Use generic-lens or optics to modify other optional fields.
The following record fields are available, with the corresponding lenses provided for backwards compatibility:
$sel:trailList:DescribeTrailsResponse'
, describeTrailsResponse_trailList
- The list of trail objects. Trail objects with string values are only
returned if values for the objects exist in a trail's configuration.
For example, SNSTopicName
and SNSTopicARN
are only returned in
results if a trail is configured to send SNS notifications. Similarly,
KMSKeyId
only appears in results if a trail's log files are encrypted
with KMS customer managed keys.
$sel:httpStatus:DescribeTrailsResponse'
, describeTrailsResponse_httpStatus
- The response's http status code.
ListPublicKeys (Paginated)
data ListPublicKeys Source #
Requests the public keys for a specified time range.
See: newListPublicKeys
smart constructor.
Instances
newListPublicKeys :: ListPublicKeys Source #
Create a value of ListPublicKeys
with all optional fields omitted.
Use generic-lens or optics to modify other optional fields.
The following record fields are available, with the corresponding lenses provided for backwards compatibility:
$sel:startTime:ListPublicKeys'
, listPublicKeys_startTime
- Optionally specifies, in UTC, the start of the time range to look up
public keys for CloudTrail digest files. If not specified, the current
time is used, and the current public key is returned.
$sel:nextToken:ListPublicKeys'
, listPublicKeys_nextToken
- Reserved for future use.
$sel:endTime:ListPublicKeys'
, listPublicKeys_endTime
- Optionally specifies, in UTC, the end of the time range to look up
public keys for CloudTrail digest files. If not specified, the current
time is used.
data ListPublicKeysResponse Source #
Returns the objects or data listed below if successful. Otherwise, returns an error.
See: newListPublicKeysResponse
smart constructor.
Instances
newListPublicKeysResponse Source #
Create a value of ListPublicKeysResponse
with all optional fields omitted.
Use generic-lens or optics to modify other optional fields.
The following record fields are available, with the corresponding lenses provided for backwards compatibility:
$sel:publicKeyList:ListPublicKeysResponse'
, listPublicKeysResponse_publicKeyList
- Contains an array of PublicKey objects.
The returned public keys may have validity time ranges that overlap.
$sel:nextToken:ListPublicKeys'
, listPublicKeysResponse_nextToken
- Reserved for future use.
$sel:httpStatus:ListPublicKeysResponse'
, listPublicKeysResponse_httpStatus
- The response's http status code.
RemoveTags
data RemoveTags Source #
Specifies the tags to remove from a trail.
See: newRemoveTags
smart constructor.
RemoveTags' (Maybe [Tag]) Text |
Instances
Create a value of RemoveTags
with all optional fields omitted.
Use generic-lens or optics to modify other optional fields.
The following record fields are available, with the corresponding lenses provided for backwards compatibility:
$sel:tagsList:RemoveTags'
, removeTags_tagsList
- Specifies a list of tags to be removed.
$sel:resourceId:RemoveTags'
, removeTags_resourceId
- Specifies the ARN of the trail from which tags should be removed. The
format of a trail ARN is:
arn:aws:cloudtrail:us-east-2:123456789012:trail/MyTrail
data RemoveTagsResponse Source #
Returns the objects or data listed below if successful. Otherwise, returns an error.
See: newRemoveTagsResponse
smart constructor.
Instances
newRemoveTagsResponse Source #
Create a value of RemoveTagsResponse
with all optional fields omitted.
Use generic-lens or optics to modify other optional fields.
The following record fields are available, with the corresponding lenses provided for backwards compatibility:
$sel:httpStatus:RemoveTagsResponse'
, removeTagsResponse_httpStatus
- The response's http status code.
LookupEvents (Paginated)
data LookupEvents Source #
Contains a request for LookupEvents.
See: newLookupEvents
smart constructor.
LookupEvents' (Maybe EventCategory) (Maybe POSIX) (Maybe [LookupAttribute]) (Maybe Text) (Maybe POSIX) (Maybe Natural) |
Instances
newLookupEvents :: LookupEvents Source #
Create a value of LookupEvents
with all optional fields omitted.
Use generic-lens or optics to modify other optional fields.
The following record fields are available, with the corresponding lenses provided for backwards compatibility:
$sel:eventCategory:LookupEvents'
, lookupEvents_eventCategory
- Specifies the event category. If you do not specify an event category,
events of the category are not returned in the response. For example, if
you do not specify insight
as the value of EventCategory
, no
Insights events are returned.
$sel:startTime:LookupEvents'
, lookupEvents_startTime
- Specifies that only events that occur after or at the specified time are
returned. If the specified start time is after the specified end time,
an error is returned.
$sel:lookupAttributes:LookupEvents'
, lookupEvents_lookupAttributes
- Contains a list of lookup attributes. Currently the list can contain
only one item.
$sel:nextToken:LookupEvents'
, lookupEvents_nextToken
- The token to use to get the next page of results after a previous API
call. This token must be passed in with the same parameters that were
specified in the the original call. For example, if the original call
specified an AttributeKey of 'Username' with a value of 'root', the
call with NextToken should include those same parameters.
$sel:endTime:LookupEvents'
, lookupEvents_endTime
- Specifies that only events that occur before or at the specified time
are returned. If the specified end time is before the specified start
time, an error is returned.
$sel:maxResults:LookupEvents'
, lookupEvents_maxResults
- The number of events to return. Possible values are 1 through 50. The
default is 50.
data LookupEventsResponse Source #
Contains a response to a LookupEvents action.
See: newLookupEventsResponse
smart constructor.
Instances
newLookupEventsResponse Source #
Create a value of LookupEventsResponse
with all optional fields omitted.
Use generic-lens or optics to modify other optional fields.
The following record fields are available, with the corresponding lenses provided for backwards compatibility:
$sel:nextToken:LookupEvents'
, lookupEventsResponse_nextToken
- The token to use to get the next page of results after a previous API
call. If the token does not appear, there are no more results to return.
The token must be passed in with the same parameters as the previous
call. For example, if the original call specified an AttributeKey of
'Username' with a value of 'root', the call with NextToken should
include those same parameters.
$sel:events:LookupEventsResponse'
, lookupEventsResponse_events
- A list of events returned based on the lookup attributes specified and
the CloudTrail event. The events list is sorted by time. The most recent
event is listed first.
$sel:httpStatus:LookupEventsResponse'
, lookupEventsResponse_httpStatus
- The response's http status code.
StopLogging
data StopLogging Source #
Passes the request to CloudTrail to stop logging Amazon Web Services API calls for the specified account.
See: newStopLogging
smart constructor.
Instances
Create a value of StopLogging
with all optional fields omitted.
Use generic-lens or optics to modify other optional fields.
The following record fields are available, with the corresponding lenses provided for backwards compatibility:
$sel:name:StopLogging'
, stopLogging_name
- Specifies the name or the CloudTrail ARN of the trail for which
CloudTrail will stop logging Amazon Web Services API calls. The
following is the format of a trail ARN.
arn:aws:cloudtrail:us-east-2:123456789012:trail/MyTrail
data StopLoggingResponse Source #
Returns the objects or data listed below if successful. Otherwise, returns an error.
See: newStopLoggingResponse
smart constructor.
Instances
newStopLoggingResponse Source #
Create a value of StopLoggingResponse
with all optional fields omitted.
Use generic-lens or optics to modify other optional fields.
The following record fields are available, with the corresponding lenses provided for backwards compatibility:
$sel:httpStatus:StopLoggingResponse'
, stopLoggingResponse_httpStatus
- The response's http status code.
DeleteTrail
data DeleteTrail Source #
The request that specifies the name of a trail to delete.
See: newDeleteTrail
smart constructor.
Instances
Create a value of DeleteTrail
with all optional fields omitted.
Use generic-lens or optics to modify other optional fields.
The following record fields are available, with the corresponding lenses provided for backwards compatibility:
$sel:name:DeleteTrail'
, deleteTrail_name
- Specifies the name or the CloudTrail ARN of the trail to be deleted. The
following is the format of a trail ARN.
arn:aws:cloudtrail:us-east-2:123456789012:trail/MyTrail
data DeleteTrailResponse Source #
Returns the objects or data listed below if successful. Otherwise, returns an error.
See: newDeleteTrailResponse
smart constructor.
Instances
newDeleteTrailResponse Source #
Create a value of DeleteTrailResponse
with all optional fields omitted.
Use generic-lens or optics to modify other optional fields.
The following record fields are available, with the corresponding lenses provided for backwards compatibility:
$sel:httpStatus:DeleteTrailResponse'
, deleteTrailResponse_httpStatus
- The response's http status code.
UpdateTrail
data UpdateTrail Source #
Specifies settings to update for the trail.
See: newUpdateTrail
smart constructor.
UpdateTrail' (Maybe Text) (Maybe Text) (Maybe Bool) (Maybe Text) (Maybe Text) (Maybe Bool) (Maybe Bool) (Maybe Text) (Maybe Text) (Maybe Bool) Text |
Instances
Create a value of UpdateTrail
with all optional fields omitted.
Use generic-lens or optics to modify other optional fields.
The following record fields are available, with the corresponding lenses provided for backwards compatibility:
$sel:s3KeyPrefix:UpdateTrail'
, updateTrail_s3KeyPrefix
- Specifies the Amazon S3 key prefix that comes after the name of the
bucket you have designated for log file delivery. For more information,
see
Finding Your CloudTrail Log Files.
The maximum length is 200 characters.
$sel:snsTopicName:UpdateTrail'
, updateTrail_snsTopicName
- Specifies the name of the Amazon SNS topic defined for notification of
log file delivery. The maximum length is 256 characters.
$sel:enableLogFileValidation:UpdateTrail'
, updateTrail_enableLogFileValidation
- Specifies whether log file validation is enabled. The default is false.
When you disable log file integrity validation, the chain of digest files is broken after one hour. CloudTrail does not create digest files for log files that were delivered during a period in which log file integrity validation was disabled. For example, if you enable log file integrity validation at noon on January 1, disable it at noon on January 2, and re-enable it at noon on January 10, digest files will not be created for the log files delivered from noon on January 2 to noon on January 10. The same applies whenever you stop CloudTrail logging or delete a trail.
$sel:cloudWatchLogsLogGroupArn:UpdateTrail'
, updateTrail_cloudWatchLogsLogGroupArn
- Specifies a log group name using an Amazon Resource Name (ARN), a unique
identifier that represents the log group to which CloudTrail logs are
delivered. Not required unless you specify CloudWatchLogsRoleArn
.
$sel:kmsKeyId:UpdateTrail'
, updateTrail_kmsKeyId
- Specifies the KMS key ID to use to encrypt the logs delivered by
CloudTrail. The value can be an alias name prefixed by "alias/", a
fully specified ARN to an alias, a fully specified ARN to a key, or a
globally unique identifier.
CloudTrail also supports KMS multi-Region keys. For more information about multi-Region keys, see Using multi-Region keys in the Key Management Service Developer Guide.
Examples:
- alias/MyAliasName
- arn:aws:kms:us-east-2:123456789012:alias/MyAliasName
- arn:aws:kms:us-east-2:123456789012:key/12345678-1234-1234-1234-123456789012
- 12345678-1234-1234-1234-123456789012
$sel:includeGlobalServiceEvents:UpdateTrail'
, updateTrail_includeGlobalServiceEvents
- Specifies whether the trail is publishing events from global services
such as IAM to the log files.
$sel:isOrganizationTrail:UpdateTrail'
, updateTrail_isOrganizationTrail
- Specifies whether the trail is applied to all accounts in an
organization in Organizations, or only for the current Amazon Web
Services account. The default is false, and cannot be true unless the
call is made on behalf of an Amazon Web Services account that is the
management account for an organization in Organizations. If the trail is
not an organization trail and this is set to true
, the trail will be
created in all Amazon Web Services accounts that belong to the
organization. If the trail is an organization trail and this is set to
false
, the trail will remain in the current Amazon Web Services
account but be deleted from all member accounts in the organization.
$sel:cloudWatchLogsRoleArn:UpdateTrail'
, updateTrail_cloudWatchLogsRoleArn
- Specifies the role for the CloudWatch Logs endpoint to assume to write
to a user's log group.
$sel:s3BucketName:UpdateTrail'
, updateTrail_s3BucketName
- Specifies the name of the Amazon S3 bucket designated for publishing log
files. See
Amazon S3 Bucket Naming Requirements.
$sel:isMultiRegionTrail:UpdateTrail'
, updateTrail_isMultiRegionTrail
- Specifies whether the trail applies only to the current region or to all
regions. The default is false. If the trail exists only in the current
region and this value is set to true, shadow trails (replications of the
trail) will be created in the other regions. If the trail exists in all
regions and this value is set to false, the trail will remain in the
region where it was created, and its shadow trails in other regions will
be deleted. As a best practice, consider using trails that log events in
all regions.
$sel:name:UpdateTrail'
, updateTrail_name
- Specifies the name of the trail or trail ARN. If Name
is a trail name,
the string must meet the following requirements:
- Contain only ASCII letters (a-z, A-Z), numbers (0-9), periods (.), underscores (_), or dashes (-)
- Start with a letter or number, and end with a letter or number
- Be between 3 and 128 characters
- Have no adjacent periods, underscores or dashes. Names like
my-_namespace
andmy--namespace
are not valid. - Not be in IP address format (for example, 192.168.5.4)
If Name
is a trail ARN, it must be in the following format.
arn:aws:cloudtrail:us-east-2:123456789012:trail/MyTrail
data UpdateTrailResponse Source #
Returns the objects or data listed below if successful. Otherwise, returns an error.
See: newUpdateTrailResponse
smart constructor.
UpdateTrailResponse' (Maybe Bool) (Maybe Text) (Maybe Text) (Maybe Text) (Maybe Text) (Maybe Text) (Maybe Text) (Maybe Text) (Maybe Bool) (Maybe Bool) (Maybe Text) (Maybe Text) (Maybe Bool) Int |
Instances
newUpdateTrailResponse Source #
Create a value of UpdateTrailResponse
with all optional fields omitted.
Use generic-lens or optics to modify other optional fields.
The following record fields are available, with the corresponding lenses provided for backwards compatibility:
$sel:logFileValidationEnabled:UpdateTrailResponse'
, updateTrailResponse_logFileValidationEnabled
- Specifies whether log file integrity validation is enabled.
$sel:trailARN:UpdateTrailResponse'
, updateTrailResponse_trailARN
- Specifies the ARN of the trail that was updated. The following is the
format of a trail ARN.
arn:aws:cloudtrail:us-east-2:123456789012:trail/MyTrail
$sel:s3KeyPrefix:UpdateTrail'
, updateTrailResponse_s3KeyPrefix
- Specifies the Amazon S3 key prefix that comes after the name of the
bucket you have designated for log file delivery. For more information,
see
Finding Your IAM Log Files.
$sel:snsTopicARN:UpdateTrailResponse'
, updateTrailResponse_snsTopicARN
- Specifies the ARN of the Amazon SNS topic that CloudTrail uses to send
notifications when log files are delivered. The following is the format
of a topic ARN.
arn:aws:sns:us-east-2:123456789012:MyTopic
$sel:snsTopicName:UpdateTrail'
, updateTrailResponse_snsTopicName
- This field is no longer in use. Use UpdateTrailResponse$SnsTopicARN.
$sel:cloudWatchLogsLogGroupArn:UpdateTrail'
, updateTrailResponse_cloudWatchLogsLogGroupArn
- Specifies the Amazon Resource Name (ARN) of the log group to which
CloudTrail logs are delivered.
$sel:kmsKeyId:UpdateTrail'
, updateTrailResponse_kmsKeyId
- Specifies the KMS key ID that encrypts the logs delivered by CloudTrail.
The value is a fully specified ARN to a KMS key in the following format.
arn:aws:kms:us-east-2:123456789012:key/12345678-1234-1234-1234-123456789012
$sel:name:UpdateTrail'
, updateTrailResponse_name
- Specifies the name of the trail.
$sel:includeGlobalServiceEvents:UpdateTrail'
, updateTrailResponse_includeGlobalServiceEvents
- Specifies whether the trail is publishing events from global services
such as IAM to the log files.
$sel:isOrganizationTrail:UpdateTrail'
, updateTrailResponse_isOrganizationTrail
- Specifies whether the trail is an organization trail.
$sel:cloudWatchLogsRoleArn:UpdateTrail'
, updateTrailResponse_cloudWatchLogsRoleArn
- Specifies the role for the CloudWatch Logs endpoint to assume to write
to a user's log group.
$sel:s3BucketName:UpdateTrail'
, updateTrailResponse_s3BucketName
- Specifies the name of the Amazon S3 bucket designated for publishing log
files.
$sel:isMultiRegionTrail:UpdateTrail'
, updateTrailResponse_isMultiRegionTrail
- Specifies whether the trail exists in one region or in all regions.
$sel:httpStatus:UpdateTrailResponse'
, updateTrailResponse_httpStatus
- The response's http status code.
CreateTrail
data CreateTrail Source #
Specifies the settings for each trail.
See: newCreateTrail
smart constructor.
CreateTrail' (Maybe Text) (Maybe Text) (Maybe Bool) (Maybe Text) (Maybe Text) (Maybe Bool) (Maybe [Tag]) (Maybe Bool) (Maybe Text) (Maybe Bool) Text Text |
Instances
Create a value of CreateTrail
with all optional fields omitted.
Use generic-lens or optics to modify other optional fields.
The following record fields are available, with the corresponding lenses provided for backwards compatibility:
$sel:s3KeyPrefix:CreateTrail'
, createTrail_s3KeyPrefix
- Specifies the Amazon S3 key prefix that comes after the name of the
bucket you have designated for log file delivery. For more information,
see
Finding Your CloudTrail Log Files.
The maximum length is 200 characters.
$sel:snsTopicName:CreateTrail'
, createTrail_snsTopicName
- Specifies the name of the Amazon SNS topic defined for notification of
log file delivery. The maximum length is 256 characters.
$sel:enableLogFileValidation:CreateTrail'
, createTrail_enableLogFileValidation
- Specifies whether log file integrity validation is enabled. The default
is false.
When you disable log file integrity validation, the chain of digest files is broken after one hour. CloudTrail does not create digest files for log files that were delivered during a period in which log file integrity validation was disabled. For example, if you enable log file integrity validation at noon on January 1, disable it at noon on January 2, and re-enable it at noon on January 10, digest files will not be created for the log files delivered from noon on January 2 to noon on January 10. The same applies whenever you stop CloudTrail logging or delete a trail.
$sel:cloudWatchLogsLogGroupArn:CreateTrail'
, createTrail_cloudWatchLogsLogGroupArn
- Specifies a log group name using an Amazon Resource Name (ARN), a unique
identifier that represents the log group to which CloudTrail logs will
be delivered. Not required unless you specify CloudWatchLogsRoleArn
.
$sel:kmsKeyId:CreateTrail'
, createTrail_kmsKeyId
- Specifies the KMS key ID to use to encrypt the logs delivered by
CloudTrail. The value can be an alias name prefixed by "alias/", a
fully specified ARN to an alias, a fully specified ARN to a key, or a
globally unique identifier.
CloudTrail also supports KMS multi-Region keys. For more information about multi-Region keys, see Using multi-Region keys in the Key Management Service Developer Guide.
Examples:
- alias/MyAliasName
- arn:aws:kms:us-east-2:123456789012:alias/MyAliasName
- arn:aws:kms:us-east-2:123456789012:key/12345678-1234-1234-1234-123456789012
- 12345678-1234-1234-1234-123456789012
$sel:includeGlobalServiceEvents:CreateTrail'
, createTrail_includeGlobalServiceEvents
- Specifies whether the trail is publishing events from global services
such as IAM to the log files.
$sel:tagsList:CreateTrail'
, createTrail_tagsList
- Undocumented member.
$sel:isOrganizationTrail:CreateTrail'
, createTrail_isOrganizationTrail
- Specifies whether the trail is created for all accounts in an
organization in Organizations, or only for the current Amazon Web
Services account. The default is false, and cannot be true unless the
call is made on behalf of an Amazon Web Services account that is the
management account for an organization in Organizations.
$sel:cloudWatchLogsRoleArn:CreateTrail'
, createTrail_cloudWatchLogsRoleArn
- Specifies the role for the CloudWatch Logs endpoint to assume to write
to a user's log group.
$sel:isMultiRegionTrail:CreateTrail'
, createTrail_isMultiRegionTrail
- Specifies whether the trail is created in the current region or in all
regions. The default is false, which creates a trail only in the region
where you are signed in. As a best practice, consider creating trails
that log events in all regions.
$sel:name:CreateTrail'
, createTrail_name
- Specifies the name of the trail. The name must meet the following
requirements:
- Contain only ASCII letters (a-z, A-Z), numbers (0-9), periods (.), underscores (_), or dashes (-)
- Start with a letter or number, and end with a letter or number
- Be between 3 and 128 characters
- Have no adjacent periods, underscores or dashes. Names like
my-_namespace
andmy--namespace
are not valid. - Not be in IP address format (for example, 192.168.5.4)
$sel:s3BucketName:CreateTrail'
, createTrail_s3BucketName
- Specifies the name of the Amazon S3 bucket designated for publishing log
files. See
Amazon S3 Bucket Naming Requirements.
data CreateTrailResponse Source #
Returns the objects or data listed below if successful. Otherwise, returns an error.
See: newCreateTrailResponse
smart constructor.
CreateTrailResponse' (Maybe Bool) (Maybe Text) (Maybe Text) (Maybe Text) (Maybe Text) (Maybe Text) (Maybe Text) (Maybe Text) (Maybe Bool) (Maybe Bool) (Maybe Text) (Maybe Text) (Maybe Bool) Int |
Instances
newCreateTrailResponse Source #
Create a value of CreateTrailResponse
with all optional fields omitted.
Use generic-lens or optics to modify other optional fields.
The following record fields are available, with the corresponding lenses provided for backwards compatibility:
$sel:logFileValidationEnabled:CreateTrailResponse'
, createTrailResponse_logFileValidationEnabled
- Specifies whether log file integrity validation is enabled.
$sel:trailARN:CreateTrailResponse'
, createTrailResponse_trailARN
- Specifies the ARN of the trail that was created. The format of a trail
ARN is:
arn:aws:cloudtrail:us-east-2:123456789012:trail/MyTrail
$sel:s3KeyPrefix:CreateTrail'
, createTrailResponse_s3KeyPrefix
- Specifies the Amazon S3 key prefix that comes after the name of the
bucket you have designated for log file delivery. For more information,
see
Finding Your CloudTrail Log Files.
$sel:snsTopicARN:CreateTrailResponse'
, createTrailResponse_snsTopicARN
- Specifies the ARN of the Amazon SNS topic that CloudTrail uses to send
notifications when log files are delivered. The format of a topic ARN
is:
arn:aws:sns:us-east-2:123456789012:MyTopic
$sel:snsTopicName:CreateTrail'
, createTrailResponse_snsTopicName
- This field is no longer in use. Use SnsTopicARN.
$sel:cloudWatchLogsLogGroupArn:CreateTrail'
, createTrailResponse_cloudWatchLogsLogGroupArn
- Specifies the Amazon Resource Name (ARN) of the log group to which
CloudTrail logs will be delivered.
$sel:kmsKeyId:CreateTrail'
, createTrailResponse_kmsKeyId
- Specifies the KMS key ID that encrypts the logs delivered by CloudTrail.
The value is a fully specified ARN to a KMS key in the following format.
arn:aws:kms:us-east-2:123456789012:key/12345678-1234-1234-1234-123456789012
$sel:name:CreateTrail'
, createTrailResponse_name
- Specifies the name of the trail.
$sel:includeGlobalServiceEvents:CreateTrail'
, createTrailResponse_includeGlobalServiceEvents
- Specifies whether the trail is publishing events from global services
such as IAM to the log files.
$sel:isOrganizationTrail:CreateTrail'
, createTrailResponse_isOrganizationTrail
- Specifies whether the trail is an organization trail.
$sel:cloudWatchLogsRoleArn:CreateTrail'
, createTrailResponse_cloudWatchLogsRoleArn
- Specifies the role for the CloudWatch Logs endpoint to assume to write
to a user's log group.
$sel:s3BucketName:CreateTrail'
, createTrailResponse_s3BucketName
- Specifies the name of the Amazon S3 bucket designated for publishing log
files.
$sel:isMultiRegionTrail:CreateTrail'
, createTrailResponse_isMultiRegionTrail
- Specifies whether the trail exists in one region or in all regions.
$sel:httpStatus:CreateTrailResponse'
, createTrailResponse_httpStatus
- The response's http status code.
PutInsightSelectors
data PutInsightSelectors Source #
See: newPutInsightSelectors
smart constructor.
Instances
newPutInsightSelectors Source #
Create a value of PutInsightSelectors
with all optional fields omitted.
Use generic-lens or optics to modify other optional fields.
The following record fields are available, with the corresponding lenses provided for backwards compatibility:
$sel:trailName:PutInsightSelectors'
, putInsightSelectors_trailName
- The name of the CloudTrail trail for which you want to change or add
Insights selectors.
$sel:insightSelectors:PutInsightSelectors'
, putInsightSelectors_insightSelectors
- A JSON string that contains the Insights types that you want to log on a
trail. The valid Insights type in this release is ApiCallRateInsight
.
data PutInsightSelectorsResponse Source #
See: newPutInsightSelectorsResponse
smart constructor.
Instances
newPutInsightSelectorsResponse Source #
Create a value of PutInsightSelectorsResponse
with all optional fields omitted.
Use generic-lens or optics to modify other optional fields.
The following record fields are available, with the corresponding lenses provided for backwards compatibility:
$sel:trailARN:PutInsightSelectorsResponse'
, putInsightSelectorsResponse_trailARN
- The Amazon Resource Name (ARN) of a trail for which you want to change
or add Insights selectors.
$sel:insightSelectors:PutInsightSelectors'
, putInsightSelectorsResponse_insightSelectors
- A JSON string that contains the Insights event types that you want to
log on a trail. The valid Insights type in this release is
ApiCallRateInsight
.
$sel:httpStatus:PutInsightSelectorsResponse'
, putInsightSelectorsResponse_httpStatus
- The response's http status code.
GetEventSelectors
data GetEventSelectors Source #
See: newGetEventSelectors
smart constructor.
Instances
Create a value of GetEventSelectors
with all optional fields omitted.
Use generic-lens or optics to modify other optional fields.
The following record fields are available, with the corresponding lenses provided for backwards compatibility:
$sel:trailName:GetEventSelectors'
, getEventSelectors_trailName
- Specifies the name of the trail or trail ARN. If you specify a trail
name, the string must meet the following requirements:
- Contain only ASCII letters (a-z, A-Z), numbers (0-9), periods (.), underscores (_), or dashes (-)
- Start with a letter or number, and end with a letter or number
- Be between 3 and 128 characters
- Have no adjacent periods, underscores or dashes. Names like
my-_namespace
andmy--namespace
are not valid. - Not be in IP address format (for example, 192.168.5.4)
If you specify a trail ARN, it must be in the format:
arn:aws:cloudtrail:us-east-2:123456789012:trail/MyTrail
data GetEventSelectorsResponse Source #
See: newGetEventSelectorsResponse
smart constructor.
Instances
newGetEventSelectorsResponse Source #
Create a value of GetEventSelectorsResponse
with all optional fields omitted.
Use generic-lens or optics to modify other optional fields.
The following record fields are available, with the corresponding lenses provided for backwards compatibility:
$sel:trailARN:GetEventSelectorsResponse'
, getEventSelectorsResponse_trailARN
- The specified trail ARN that has the event selectors.
$sel:eventSelectors:GetEventSelectorsResponse'
, getEventSelectorsResponse_eventSelectors
- The event selectors that are configured for the trail.
$sel:advancedEventSelectors:GetEventSelectorsResponse'
, getEventSelectorsResponse_advancedEventSelectors
- The advanced event selectors that are configured for the trail.
$sel:httpStatus:GetEventSelectorsResponse'
, getEventSelectorsResponse_httpStatus
- The response's http status code.
GetTrail
See: newGetTrail
smart constructor.
Instances
Eq GetTrail Source # | |
Read GetTrail Source # | |
Show GetTrail Source # | |
Generic GetTrail Source # | |
NFData GetTrail Source # | |
Defined in Amazonka.CloudTrail.GetTrail | |
Hashable GetTrail Source # | |
Defined in Amazonka.CloudTrail.GetTrail | |
ToJSON GetTrail Source # | |
Defined in Amazonka.CloudTrail.GetTrail | |
AWSRequest GetTrail Source # | |
Defined in Amazonka.CloudTrail.GetTrail type AWSResponse GetTrail # request :: GetTrail -> Request GetTrail # response :: MonadResource m => Logger -> Service -> Proxy GetTrail -> ClientResponse ClientBody -> m (Either Error (ClientResponse (AWSResponse GetTrail))) # | |
ToHeaders GetTrail Source # | |
Defined in Amazonka.CloudTrail.GetTrail | |
ToPath GetTrail Source # | |
Defined in Amazonka.CloudTrail.GetTrail toPath :: GetTrail -> ByteString # | |
ToQuery GetTrail Source # | |
Defined in Amazonka.CloudTrail.GetTrail toQuery :: GetTrail -> QueryString # | |
type Rep GetTrail Source # | |
Defined in Amazonka.CloudTrail.GetTrail | |
type AWSResponse GetTrail Source # | |
Defined in Amazonka.CloudTrail.GetTrail |
Create a value of GetTrail
with all optional fields omitted.
Use generic-lens or optics to modify other optional fields.
The following record fields are available, with the corresponding lenses provided for backwards compatibility:
$sel:name:GetTrail'
, getTrail_name
- The name or the Amazon Resource Name (ARN) of the trail for which you
want to retrieve settings information.
data GetTrailResponse Source #
See: newGetTrailResponse
smart constructor.
Instances
Create a value of GetTrailResponse
with all optional fields omitted.
Use generic-lens or optics to modify other optional fields.
The following record fields are available, with the corresponding lenses provided for backwards compatibility:
$sel:trail:GetTrailResponse'
, getTrailResponse_trail
- Undocumented member.
$sel:httpStatus:GetTrailResponse'
, getTrailResponse_httpStatus
- The response's http status code.
GetTrailStatus
data GetTrailStatus Source #
The name of a trail about which you want the current status.
See: newGetTrailStatus
smart constructor.
Instances
Create a value of GetTrailStatus
with all optional fields omitted.
Use generic-lens or optics to modify other optional fields.
The following record fields are available, with the corresponding lenses provided for backwards compatibility:
$sel:name:GetTrailStatus'
, getTrailStatus_name
- Specifies the name or the CloudTrail ARN of the trail for which you are
requesting status. To get the status of a shadow trail (a replication of
the trail in another region), you must specify its ARN. The following is
the format of a trail ARN.
arn:aws:cloudtrail:us-east-2:123456789012:trail/MyTrail
data GetTrailStatusResponse Source #
Returns the objects or data listed below if successful. Otherwise, returns an error.
See: newGetTrailStatusResponse
smart constructor.
GetTrailStatusResponse' (Maybe Text) (Maybe Text) (Maybe POSIX) (Maybe Text) (Maybe POSIX) (Maybe Text) (Maybe Text) (Maybe Bool) (Maybe Text) (Maybe Text) (Maybe Text) (Maybe POSIX) (Maybe POSIX) (Maybe Text) (Maybe POSIX) (Maybe Text) (Maybe POSIX) Int |
Instances
newGetTrailStatusResponse Source #
Create a value of GetTrailStatusResponse
with all optional fields omitted.
Use generic-lens or optics to modify other optional fields.
The following record fields are available, with the corresponding lenses provided for backwards compatibility:
$sel:timeLoggingStopped:GetTrailStatusResponse'
, getTrailStatusResponse_timeLoggingStopped
- This field is no longer in use.
$sel:latestDeliveryError:GetTrailStatusResponse'
, getTrailStatusResponse_latestDeliveryError
- Displays any Amazon S3 error that CloudTrail encountered when attempting
to deliver log files to the designated bucket. For more information, see
Error Responses
in the Amazon S3 API Reference.
This error occurs only when there is a problem with the destination S3
bucket, and does not occur for requests that time out. To resolve the
issue, create a new bucket, and then call UpdateTrail
to specify the
new bucket; or fix the existing objects so that CloudTrail can again
write to the bucket.
$sel:latestDigestDeliveryTime:GetTrailStatusResponse'
, getTrailStatusResponse_latestDigestDeliveryTime
- Specifies the date and time that CloudTrail last delivered a digest file
to an account's Amazon S3 bucket.
$sel:latestNotificationAttemptSucceeded:GetTrailStatusResponse'
, getTrailStatusResponse_latestNotificationAttemptSucceeded
- This field is no longer in use.
$sel:startLoggingTime:GetTrailStatusResponse'
, getTrailStatusResponse_startLoggingTime
- Specifies the most recent date and time when CloudTrail started
recording API calls for an Amazon Web Services account.
$sel:latestNotificationError:GetTrailStatusResponse'
, getTrailStatusResponse_latestNotificationError
- Displays any Amazon SNS error that CloudTrail encountered when
attempting to send a notification. For more information about Amazon SNS
errors, see the
Amazon SNS Developer Guide.
$sel:latestDeliveryAttemptSucceeded:GetTrailStatusResponse'
, getTrailStatusResponse_latestDeliveryAttemptSucceeded
- This field is no longer in use.
$sel:isLogging:GetTrailStatusResponse'
, getTrailStatusResponse_isLogging
- Whether the CloudTrail trail is currently logging Amazon Web Services
API calls.
$sel:timeLoggingStarted:GetTrailStatusResponse'
, getTrailStatusResponse_timeLoggingStarted
- This field is no longer in use.
$sel:latestDigestDeliveryError:GetTrailStatusResponse'
, getTrailStatusResponse_latestDigestDeliveryError
- Displays any Amazon S3 error that CloudTrail encountered when attempting
to deliver a digest file to the designated bucket. For more information,
see
Error Responses
in the Amazon S3 API Reference.
This error occurs only when there is a problem with the destination S3
bucket, and does not occur for requests that time out. To resolve the
issue, create a new bucket, and then call UpdateTrail
to specify the
new bucket; or fix the existing objects so that CloudTrail can again
write to the bucket.
$sel:latestDeliveryAttemptTime:GetTrailStatusResponse'
, getTrailStatusResponse_latestDeliveryAttemptTime
- This field is no longer in use.
$sel:latestDeliveryTime:GetTrailStatusResponse'
, getTrailStatusResponse_latestDeliveryTime
- Specifies the date and time that CloudTrail last delivered log files to
an account's Amazon S3 bucket.
$sel:latestCloudWatchLogsDeliveryTime:GetTrailStatusResponse'
, getTrailStatusResponse_latestCloudWatchLogsDeliveryTime
- Displays the most recent date and time when CloudTrail delivered logs to
CloudWatch Logs.
$sel:latestCloudWatchLogsDeliveryError:GetTrailStatusResponse'
, getTrailStatusResponse_latestCloudWatchLogsDeliveryError
- Displays any CloudWatch Logs error that CloudTrail encountered when
attempting to deliver logs to CloudWatch Logs.
$sel:latestNotificationTime:GetTrailStatusResponse'
, getTrailStatusResponse_latestNotificationTime
- Specifies the date and time of the most recent Amazon SNS notification
that CloudTrail has written a new log file to an account's Amazon S3
bucket.
$sel:latestNotificationAttemptTime:GetTrailStatusResponse'
, getTrailStatusResponse_latestNotificationAttemptTime
- This field is no longer in use.
$sel:stopLoggingTime:GetTrailStatusResponse'
, getTrailStatusResponse_stopLoggingTime
- Specifies the most recent date and time when CloudTrail stopped
recording API calls for an Amazon Web Services account.
$sel:httpStatus:GetTrailStatusResponse'
, getTrailStatusResponse_httpStatus
- The response's http status code.
AddTags
Specifies the tags to add to a trail.
See: newAddTags
smart constructor.
Instances
Create a value of AddTags
with all optional fields omitted.
Use generic-lens or optics to modify other optional fields.
The following record fields are available, with the corresponding lenses provided for backwards compatibility:
$sel:tagsList:AddTags'
, addTags_tagsList
- Contains a list of tags, up to a limit of 50
$sel:resourceId:AddTags'
, addTags_resourceId
- Specifies the ARN of the trail to which one or more tags will be added.
The format of a trail ARN is:
arn:aws:cloudtrail:us-east-2:123456789012:trail/MyTrail
data AddTagsResponse Source #
Returns the objects or data if successful. Otherwise, returns an error.
See: newAddTagsResponse
smart constructor.
Instances
Create a value of AddTagsResponse
with all optional fields omitted.
Use generic-lens or optics to modify other optional fields.
The following record fields are available, with the corresponding lenses provided for backwards compatibility:
$sel:httpStatus:AddTagsResponse'
, addTagsResponse_httpStatus
- The response's http status code.
ListTags (Paginated)
Specifies a list of trail tags to return.
See: newListTags
smart constructor.
Instances
newListTags :: ListTags Source #
Create a value of ListTags
with all optional fields omitted.
Use generic-lens or optics to modify other optional fields.
The following record fields are available, with the corresponding lenses provided for backwards compatibility:
$sel:nextToken:ListTags'
, listTags_nextToken
- Reserved for future use.
$sel:resourceIdList:ListTags'
, listTags_resourceIdList
- Specifies a list of trail ARNs whose tags will be listed. The list has a
limit of 20 ARNs. The following is the format of a trail ARN.
arn:aws:cloudtrail:us-east-2:123456789012:trail/MyTrail
data ListTagsResponse Source #
Returns the objects or data listed below if successful. Otherwise, returns an error.
See: newListTagsResponse
smart constructor.
Instances
Create a value of ListTagsResponse
with all optional fields omitted.
Use generic-lens or optics to modify other optional fields.
The following record fields are available, with the corresponding lenses provided for backwards compatibility:
$sel:nextToken:ListTags'
, listTagsResponse_nextToken
- Reserved for future use.
$sel:resourceTagList:ListTagsResponse'
, listTagsResponse_resourceTagList
- A list of resource tags.
$sel:httpStatus:ListTagsResponse'
, listTagsResponse_httpStatus
- The response's http status code.
PutEventSelectors
data PutEventSelectors Source #
See: newPutEventSelectors
smart constructor.
Instances
Create a value of PutEventSelectors
with all optional fields omitted.
Use generic-lens or optics to modify other optional fields.
The following record fields are available, with the corresponding lenses provided for backwards compatibility:
$sel:eventSelectors:PutEventSelectors'
, putEventSelectors_eventSelectors
- Specifies the settings for your event selectors. You can configure up to
five event selectors for a trail. You can use either EventSelectors
or
AdvancedEventSelectors
in a PutEventSelectors
request, but not both.
If you apply EventSelectors
to a trail, any existing
AdvancedEventSelectors
are overwritten.
$sel:advancedEventSelectors:PutEventSelectors'
, putEventSelectors_advancedEventSelectors
- Specifies the settings for advanced event selectors. You can add
advanced event selectors, and conditions for your advanced event
selectors, up to a maximum of 500 values for all conditions and
selectors on a trail. You can use either AdvancedEventSelectors
or
EventSelectors
, but not both. If you apply AdvancedEventSelectors
to
a trail, any existing EventSelectors
are overwritten. For more
information about advanced event selectors, see
Logging data events for trails
in the CloudTrail User Guide.
$sel:trailName:PutEventSelectors'
, putEventSelectors_trailName
- Specifies the name of the trail or trail ARN. If you specify a trail
name, the string must meet the following requirements:
- Contain only ASCII letters (a-z, A-Z), numbers (0-9), periods (.), underscores (_), or dashes (-)
- Start with a letter or number, and end with a letter or number
- Be between 3 and 128 characters
- Have no adjacent periods, underscores or dashes. Names like
my-_namespace
andmy--namespace
are not valid. - Not be in IP address format (for example, 192.168.5.4)
If you specify a trail ARN, it must be in the following format.
arn:aws:cloudtrail:us-east-2:123456789012:trail/MyTrail
data PutEventSelectorsResponse Source #
See: newPutEventSelectorsResponse
smart constructor.
Instances
newPutEventSelectorsResponse Source #
Create a value of PutEventSelectorsResponse
with all optional fields omitted.
Use generic-lens or optics to modify other optional fields.
The following record fields are available, with the corresponding lenses provided for backwards compatibility:
$sel:trailARN:PutEventSelectorsResponse'
, putEventSelectorsResponse_trailARN
- Specifies the ARN of the trail that was updated with event selectors.
The following is the format of a trail ARN.
arn:aws:cloudtrail:us-east-2:123456789012:trail/MyTrail
$sel:eventSelectors:PutEventSelectors'
, putEventSelectorsResponse_eventSelectors
- Specifies the event selectors configured for your trail.
$sel:advancedEventSelectors:PutEventSelectors'
, putEventSelectorsResponse_advancedEventSelectors
- Specifies the advanced event selectors configured for your trail.
$sel:httpStatus:PutEventSelectorsResponse'
, putEventSelectorsResponse_httpStatus
- The response's http status code.
StartLogging
data StartLogging Source #
The request to CloudTrail to start logging Amazon Web Services API calls for an account.
See: newStartLogging
smart constructor.
Instances
Create a value of StartLogging
with all optional fields omitted.
Use generic-lens or optics to modify other optional fields.
The following record fields are available, with the corresponding lenses provided for backwards compatibility:
$sel:name:StartLogging'
, startLogging_name
- Specifies the name or the CloudTrail ARN of the trail for which
CloudTrail logs Amazon Web Services API calls. The following is the
format of a trail ARN.
arn:aws:cloudtrail:us-east-2:123456789012:trail/MyTrail
data StartLoggingResponse Source #
Returns the objects or data listed below if successful. Otherwise, returns an error.
See: newStartLoggingResponse
smart constructor.
Instances
newStartLoggingResponse Source #
Create a value of StartLoggingResponse
with all optional fields omitted.
Use generic-lens or optics to modify other optional fields.
The following record fields are available, with the corresponding lenses provided for backwards compatibility:
$sel:httpStatus:StartLoggingResponse'
, startLoggingResponse_httpStatus
- The response's http status code.
ListTrails (Paginated)
data ListTrails Source #
See: newListTrails
smart constructor.
Instances
newListTrails :: ListTrails Source #
Create a value of ListTrails
with all optional fields omitted.
Use generic-lens or optics to modify other optional fields.
The following record fields are available, with the corresponding lenses provided for backwards compatibility:
$sel:nextToken:ListTrails'
, listTrails_nextToken
- The token to use to get the next page of results after a previous API
call. This token must be passed in with the same parameters that were
specified in the the original call. For example, if the original call
specified an AttributeKey of 'Username' with a value of 'root', the
call with NextToken should include those same parameters.
data ListTrailsResponse Source #
See: newListTrailsResponse
smart constructor.
Instances
newListTrailsResponse Source #
Create a value of ListTrailsResponse
with all optional fields omitted.
Use generic-lens or optics to modify other optional fields.
The following record fields are available, with the corresponding lenses provided for backwards compatibility:
$sel:nextToken:ListTrails'
, listTrailsResponse_nextToken
- The token to use to get the next page of results after a previous API
call. If the token does not appear, there are no more results to return.
The token must be passed in with the same parameters as the previous
call. For example, if the original call specified an AttributeKey of
'Username' with a value of 'root', the call with NextToken should
include those same parameters.
$sel:trails:ListTrailsResponse'
, listTrailsResponse_trails
- Returns the name, ARN, and home region of trails in the current account.
$sel:httpStatus:ListTrailsResponse'
, listTrailsResponse_httpStatus
- The response's http status code.
GetInsightSelectors
data GetInsightSelectors Source #
See: newGetInsightSelectors
smart constructor.
Instances
newGetInsightSelectors Source #
Create a value of GetInsightSelectors
with all optional fields omitted.
Use generic-lens or optics to modify other optional fields.
The following record fields are available, with the corresponding lenses provided for backwards compatibility:
$sel:trailName:GetInsightSelectors'
, getInsightSelectors_trailName
- Specifies the name of the trail or trail ARN. If you specify a trail
name, the string must meet the following requirements:
- Contain only ASCII letters (a-z, A-Z), numbers (0-9), periods (.), underscores (_), or dashes (-)
- Start with a letter or number, and end with a letter or number
- Be between 3 and 128 characters
- Have no adjacent periods, underscores or dashes. Names like
my-_namespace
andmy--namespace
are not valid. - Not be in IP address format (for example, 192.168.5.4)
If you specify a trail ARN, it must be in the format:
arn:aws:cloudtrail:us-east-2:123456789012:trail/MyTrail
data GetInsightSelectorsResponse Source #
See: newGetInsightSelectorsResponse
smart constructor.
Instances
newGetInsightSelectorsResponse Source #
Create a value of GetInsightSelectorsResponse
with all optional fields omitted.
Use generic-lens or optics to modify other optional fields.
The following record fields are available, with the corresponding lenses provided for backwards compatibility:
$sel:trailARN:GetInsightSelectorsResponse'
, getInsightSelectorsResponse_trailARN
- The Amazon Resource Name (ARN) of a trail for which you want to get
Insights selectors.
$sel:insightSelectors:GetInsightSelectorsResponse'
, getInsightSelectorsResponse_insightSelectors
- A JSON string that contains the insight types you want to log on a
trail. In this release, only ApiCallRateInsight
is supported as an
insight type.
$sel:httpStatus:GetInsightSelectorsResponse'
, getInsightSelectorsResponse_httpStatus
- The response's http status code.
Types
EventCategory
newtype EventCategory Source #
pattern EventCategory_Insight :: EventCategory |
Instances
InsightType
newtype InsightType Source #
pattern InsightType_ApiCallRateInsight :: InsightType |
Instances
LookupAttributeKey
newtype LookupAttributeKey Source #
pattern LookupAttributeKey_AccessKeyId :: LookupAttributeKey | |
pattern LookupAttributeKey_EventId :: LookupAttributeKey | |
pattern LookupAttributeKey_EventName :: LookupAttributeKey | |
pattern LookupAttributeKey_EventSource :: LookupAttributeKey | |
pattern LookupAttributeKey_ReadOnly :: LookupAttributeKey | |
pattern LookupAttributeKey_ResourceName :: LookupAttributeKey | |
pattern LookupAttributeKey_ResourceType :: LookupAttributeKey | |
pattern LookupAttributeKey_Username :: LookupAttributeKey |
Instances
ReadWriteType
newtype ReadWriteType Source #
pattern ReadWriteType_All :: ReadWriteType | |
pattern ReadWriteType_ReadOnly :: ReadWriteType | |
pattern ReadWriteType_WriteOnly :: ReadWriteType |
Instances
AdvancedEventSelector
data AdvancedEventSelector Source #
Advanced event selectors let you create fine-grained selectors for the following CloudTrail event record fields. They help you control costs by logging only those events that are important to you. For more information about advanced event selectors, see Logging data events for trails in the CloudTrail User Guide.
readOnly
eventSource
eventName
eventCategory
resources.type
resources.ARN
You cannot apply both event selectors and advanced event selectors to a trail.
See: newAdvancedEventSelector
smart constructor.
Instances
newAdvancedEventSelector Source #
Create a value of AdvancedEventSelector
with all optional fields omitted.
Use generic-lens or optics to modify other optional fields.
The following record fields are available, with the corresponding lenses provided for backwards compatibility:
$sel:name:AdvancedEventSelector'
, advancedEventSelector_name
- An optional, descriptive name for an advanced event selector, such as
"Log data events for only two S3 buckets".
$sel:fieldSelectors:AdvancedEventSelector'
, advancedEventSelector_fieldSelectors
- Contains all selector statements in an advanced event selector.
AdvancedFieldSelector
data AdvancedFieldSelector Source #
A single selector statement in an advanced event selector.
See: newAdvancedFieldSelector
smart constructor.
AdvancedFieldSelector' (Maybe (NonEmpty Text)) (Maybe (NonEmpty Text)) (Maybe (NonEmpty Text)) (Maybe (NonEmpty Text)) (Maybe (NonEmpty Text)) (Maybe (NonEmpty Text)) Text |
Instances
newAdvancedFieldSelector Source #
Create a value of AdvancedFieldSelector
with all optional fields omitted.
Use generic-lens or optics to modify other optional fields.
The following record fields are available, with the corresponding lenses provided for backwards compatibility:
$sel:endsWith:AdvancedFieldSelector'
, advancedFieldSelector_endsWith
- An operator that includes events that match the last few characters of
the event record field specified as the value of Field
.
$sel:notStartsWith:AdvancedFieldSelector'
, advancedFieldSelector_notStartsWith
- An operator that excludes events that match the first few characters of
the event record field specified as the value of Field
.
$sel:equals:AdvancedFieldSelector'
, advancedFieldSelector_equals
- An operator that includes events that match the exact value of the event
record field specified as the value of Field
. This is the only valid
operator that you can use with the readOnly
, eventCategory
, and
resources.type
fields.
$sel:notEquals:AdvancedFieldSelector'
, advancedFieldSelector_notEquals
- An operator that excludes events that match the exact value of the event
record field specified as the value of Field
.
$sel:notEndsWith:AdvancedFieldSelector'
, advancedFieldSelector_notEndsWith
- An operator that excludes events that match the last few characters of
the event record field specified as the value of Field
.
$sel:startsWith:AdvancedFieldSelector'
, advancedFieldSelector_startsWith
- An operator that includes events that match the first few characters of
the event record field specified as the value of Field
.
$sel:field:AdvancedFieldSelector'
, advancedFieldSelector_field
- A field in an event record on which to filter events to be logged.
Supported fields include readOnly
, eventCategory
, eventSource
(for
management events), eventName
, resources.type
, and resources.ARN
.
readOnly
- Optional. Can be set toEquals
a value oftrue
orfalse
. A value offalse
logs bothread
andwrite
events.eventSource
- For filtering management events only. This can be set only toNotEquals
kms.amazonaws.com
.eventName
- Can use any operator. You can use it to filter in or filter out any data event logged to CloudTrail, such asPutBucket
orGetSnapshotBlock
. You can have multiple values for this field, separated by commas.eventCategory
- This is required. It must be set toEquals
, and the value must beManagement
orData
.resources.type
- This field is required.resources.type
can only use theEquals
operator, and the value can be one of the following:AWS::S3::Object
,AWS::S3::AccessPoint
,AWS::Lambda::Function
,AWS::DynamoDB::Table
,AWS::S3Outposts::Object
,AWS::ManagedBlockchain::Node
,AWS::S3ObjectLambda::AccessPoint
, orAWS::EC2::Snapshot
. You can have only oneresources.type
field per selector. To log data events on more than one resource type, add another selector.resources.ARN
- You can use any operator with resources.ARN, but if you useEquals
orNotEquals
, the value must exactly match the ARN of a valid resource of the type you've specified in the template as the value of resources.type. For example, if resources.type equalsAWS::S3::Object
, the ARN must be in one of the following formats. To log all data events for all objects in a specific S3 bucket, use theStartsWith
operator, and include only the bucket ARN as the matching value.The trailing slash is intentional; do not exclude it. Replace the text between less than and greater than symbols (<>) with resource-specific information.
arn:<partition>:s3:::<bucket_name>/
arn:<partition>:s3:::<bucket_name>/<object_path>/
When
resources.type
equalsAWS::S3::AccessPoint
, and the operator is set toEquals
orNotEquals
, the ARN must be in one of the following formats. To log events on all objects in an S3 access point, we recommend that you use only the access point ARN, don’t include the object path, and use theStartsWith
orNotStartsWith
operators.arn:<partition>:s3:<region>:<account_ID>:accesspoint/<access_point_name>
arn:<partition>:s3:<region>:<account_ID>:accesspoint/<access_point_name>/object/<object_path>
When resources.type equals
AWS::Lambda::Function
, and the operator is set toEquals
orNotEquals
, the ARN must be in the following format:arn:<partition>:lambda:<region>:<account_ID>:function:<function_name>
When resources.type equals
AWS::DynamoDB::Table
, and the operator is set toEquals
orNotEquals
, the ARN must be in the following format:arn:<partition>:dynamodb:<region>:<account_ID>:table:<table_name>
When
resources.type
equalsAWS::S3Outposts::Object
, and the operator is set toEquals
orNotEquals
, the ARN must be in the following format:arn:<partition>:s3-outposts:<region>:<account_ID>:<object_path>
When
resources.type
equalsAWS::ManagedBlockchain::Node
, and the operator is set toEquals
orNotEquals
, the ARN must be in the following format:arn:<partition>:managedblockchain:<region>:<account_ID>:nodes/<node_ID>
When
resources.type
equalsAWS::S3ObjectLambda::AccessPoint
, and the operator is set toEquals
orNotEquals
, the ARN must be in the following format:arn:<partition>:s3-object-lambda:<region>:<account_ID>:accesspoint/<access_point_name>
When
resources.type
equalsAWS::EC2::Snapshot
, and the operator is set toEquals
orNotEquals
, the ARN must be in the following format:arn:<partition>:ec2:<region>::snapshot/<snapshot_ID>
DataResource
data DataResource Source #
The Amazon S3 buckets, Lambda functions, or Amazon DynamoDB tables that you specify in your event selectors for your trail to log data events. Data events provide information about the resource operations performed on or within a resource itself. These are also known as data plane operations. You can specify up to 250 data resources for a trail.
The total number of allowed data resources is 250. This number can be distributed between 1 and 5 event selectors, but the total cannot exceed 250 across all selectors.
If you are using advanced event selectors, the maximum total number of values for all conditions, across all advanced event selectors for the trail, is 500.
The following example demonstrates how logging works when you configure
logging of all data events for an S3 bucket named bucket-1
. In this
example, the CloudTrail user specified an empty prefix, and the option
to log both Read
and Write
data events.
- A user uploads an image file to
bucket-1
. - The
PutObject
API operation is an Amazon S3 object-level API. It is recorded as a data event in CloudTrail. Because the CloudTrail user specified an S3 bucket with an empty prefix, events that occur on any object in that bucket are logged. The trail processes and logs the event. - A user uploads an object to an Amazon S3 bucket named
arn:aws:s3:::bucket-2
. - The
PutObject
API operation occurred for an object in an S3 bucket that the CloudTrail user didn't specify for the trail. The trail doesn’t log the event.
The following example demonstrates how logging works when you configure logging of Lambda data events for a Lambda function named MyLambdaFunction, but not for all Lambda functions.
- A user runs a script that includes a call to the MyLambdaFunction function and the MyOtherLambdaFunction function.
- The
Invoke
API operation on MyLambdaFunction is an Lambda API. It is recorded as a data event in CloudTrail. Because the CloudTrail user specified logging data events for MyLambdaFunction, any invocations of that function are logged. The trail processes and logs the event. - The
Invoke
API operation on MyOtherLambdaFunction is an Lambda API. Because the CloudTrail user did not specify logging data events for all Lambda functions, theInvoke
operation for MyOtherLambdaFunction does not match the function specified for the trail. The trail doesn’t log the event.
See: newDataResource
smart constructor.
DataResource' (Maybe [Text]) (Maybe Text) |
Instances
newDataResource :: DataResource Source #
Create a value of DataResource
with all optional fields omitted.
Use generic-lens or optics to modify other optional fields.
The following record fields are available, with the corresponding lenses provided for backwards compatibility:
$sel:values:DataResource'
, dataResource_values
- An array of Amazon Resource Name (ARN) strings or partial ARN strings
for the specified objects.
To log data events for all objects in all S3 buckets in your Amazon Web Services account, specify the prefix as
arn:aws:s3:::
.This also enables logging of data event activity performed by any user or role in your Amazon Web Services account, even if that activity is performed on a bucket that belongs to another Amazon Web Services account.
- To log data events for all objects in an S3 bucket, specify the
bucket and an empty object prefix such as
arn:aws:s3:::bucket-1/
. The trail logs data events for all objects in this S3 bucket. - To log data events for specific objects, specify the S3 bucket and
object prefix such as
arn:aws:s3:::bucket-1/example-images
. The trail logs data events for objects in this S3 bucket that match the prefix. To log data events for all Lambda functions in your Amazon Web Services account, specify the prefix as
arn:aws:lambda
.This also enables logging of
Invoke
activity performed by any user or role in your Amazon Web Services account, even if that activity is performed on a function that belongs to another Amazon Web Services account.To log data events for a specific Lambda function, specify the function ARN.
Lambda function ARNs are exact. For example, if you specify a function ARN arn:aws:lambda:us-west-2:111111111111:function:helloworld, data events will only be logged for arn:aws:lambda:us-west-2:111111111111:function:helloworld. They will not be logged for arn:aws:lambda:us-west-2:111111111111:function:helloworld2.
- To log data events for all DynamoDB tables in your Amazon Web
Services account, specify the prefix as
arn:aws:dynamodb
.
$sel:type':DataResource'
, dataResource_type
- The resource type in which you want to log data events. You can specify
AWS::S3::Object
, AWS::Lambda::Function
, or AWS::DynamoDB::Table
resources.
The AWS::S3Outposts::Object
, AWS::ManagedBlockchain::Node
,
AWS::S3ObjectLambda::AccessPoint
, and AWS::EC2::Snapshot
resource
types are not valid in basic event selectors. To log data events on
these resource types, use advanced event selectors.
Event
Contains information about an event that was returned by a lookup request. The result includes a representation of a CloudTrail event.
See: newEvent
smart constructor.
Event' (Maybe Text) (Maybe [Resource]) (Maybe POSIX) (Maybe Text) (Maybe Text) (Maybe Text) (Maybe Text) (Maybe Text) (Maybe Text) |
Instances
Create a value of Event
with all optional fields omitted.
Use generic-lens or optics to modify other optional fields.
The following record fields are available, with the corresponding lenses provided for backwards compatibility:
$sel:username:Event'
, event_username
- A user name or role name of the requester that called the API in the
event returned.
$sel:resources:Event'
, event_resources
- A list of resources referenced by the event returned.
$sel:eventTime:Event'
, event_eventTime
- The date and time of the event returned.
$sel:cloudTrailEvent:Event'
, event_cloudTrailEvent
- A JSON string that contains a representation of the event returned.
$sel:eventName:Event'
, event_eventName
- The name of the event returned.
$sel:readOnly:Event'
, event_readOnly
- Information about whether the event is a write event or a read event.
$sel:accessKeyId:Event'
, event_accessKeyId
- The Amazon Web Services access key ID that was used to sign the request.
If the request was made with temporary security credentials, this is the
access key ID of the temporary credentials.
$sel:eventSource:Event'
, event_eventSource
- The Amazon Web Services service to which the request was made.
$sel:eventId:Event'
, event_eventId
- The CloudTrail ID of the event returned.
EventSelector
data EventSelector Source #
Use event selectors to further specify the management and data event settings for your trail. By default, trails created without specific event selectors will be configured to log all read and write management events, and no data events. When an event occurs in your account, CloudTrail evaluates the event selector for all trails. For each trail, if the event matches any event selector, the trail processes and logs the event. If the event doesn't match any event selector, the trail doesn't log the event.
You can configure up to five event selectors for a trail.
You cannot apply both event selectors and advanced event selectors to a trail.
See: newEventSelector
smart constructor.
EventSelector' (Maybe [DataResource]) (Maybe ReadWriteType) (Maybe [Text]) (Maybe Bool) |
Instances
newEventSelector :: EventSelector Source #
Create a value of EventSelector
with all optional fields omitted.
Use generic-lens or optics to modify other optional fields.
The following record fields are available, with the corresponding lenses provided for backwards compatibility:
$sel:dataResources:EventSelector'
, eventSelector_dataResources
- CloudTrail supports data event logging for Amazon S3 objects, Lambda
functions, and Amazon DynamoDB tables with basic event selectors. You
can specify up to 250 resources for an individual event selector, but
the total number of data resources cannot exceed 250 across all event
selectors in a trail. This limit does not apply if you configure
resource logging for all data events.
For more information, see Data Events and Limits in CloudTrail in the CloudTrail User Guide.
$sel:readWriteType:EventSelector'
, eventSelector_readWriteType
- Specify if you want your trail to log read-only events, write-only
events, or all. For example, the EC2 GetConsoleOutput
is a read-only
API operation and RunInstances
is a write-only API operation.
By default, the value is All
.
$sel:excludeManagementEventSources:EventSelector'
, eventSelector_excludeManagementEventSources
- An optional list of service event sources from which you do not want
management events to be logged on your trail. In this release, the list
can be empty (disables the filter), or it can filter out Key Management
Service or Amazon RDS Data API events by containing kms.amazonaws.com
or rdsdata.amazonaws.com
. By default, ExcludeManagementEventSources
is empty, and KMS and Amazon RDS Data API events are logged to your
trail.
$sel:includeManagementEvents:EventSelector'
, eventSelector_includeManagementEvents
- Specify if you want your event selector to include management events for
your trail.
For more information, see Management Events in the CloudTrail User Guide.
By default, the value is true
.
The first copy of management events is free. You are charged for additional copies of management events that you are logging on any subsequent trail in the same region. For more information about CloudTrail pricing, see CloudTrail Pricing.
InsightSelector
data InsightSelector Source #
A JSON string that contains a list of insight types that are logged on a trail.
See: newInsightSelector
smart constructor.
Instances
newInsightSelector :: InsightSelector Source #
Create a value of InsightSelector
with all optional fields omitted.
Use generic-lens or optics to modify other optional fields.
The following record fields are available, with the corresponding lenses provided for backwards compatibility:
$sel:insightType:InsightSelector'
, insightSelector_insightType
- The type of Insights events to log on a trail. The valid Insights type
in this release is ApiCallRateInsight
.
LookupAttribute
data LookupAttribute Source #
Specifies an attribute and value that filter the events returned.
See: newLookupAttribute
smart constructor.
Instances
Create a value of LookupAttribute
with all optional fields omitted.
Use generic-lens or optics to modify other optional fields.
The following record fields are available, with the corresponding lenses provided for backwards compatibility:
$sel:attributeKey:LookupAttribute'
, lookupAttribute_attributeKey
- Specifies an attribute on which to filter the events returned.
$sel:attributeValue:LookupAttribute'
, lookupAttribute_attributeValue
- Specifies a value for the specified AttributeKey.
PublicKey
Contains information about a returned public key.
See: newPublicKey
smart constructor.
Instances
newPublicKey :: PublicKey Source #
Create a value of PublicKey
with all optional fields omitted.
Use generic-lens or optics to modify other optional fields.
The following record fields are available, with the corresponding lenses provided for backwards compatibility:
$sel:fingerprint:PublicKey'
, publicKey_fingerprint
- The fingerprint of the public key.
$sel:validityEndTime:PublicKey'
, publicKey_validityEndTime
- The ending time of validity of the public key.
$sel:value:PublicKey'
, publicKey_value
- The DER encoded public key value in PKCS#1 format.--
-- Note: This Lens
automatically encodes and decodes Base64 data.
-- The underlying isomorphism will encode to Base64 representation during
-- serialisation, and decode from Base64 representation during deserialisation.
-- This Lens
accepts and returns only raw unencoded data.
$sel:validityStartTime:PublicKey'
, publicKey_validityStartTime
- The starting time of validity of the public key.
Resource
Specifies the type and name of a resource referenced by an event.
See: newResource
smart constructor.
Instances
Eq Resource Source # | |
Read Resource Source # | |
Show Resource Source # | |
Generic Resource Source # | |
NFData Resource Source # | |
Defined in Amazonka.CloudTrail.Types.Resource | |
Hashable Resource Source # | |
Defined in Amazonka.CloudTrail.Types.Resource | |
FromJSON Resource Source # | |
type Rep Resource Source # | |
Defined in Amazonka.CloudTrail.Types.Resource type Rep Resource = D1 ('MetaData "Resource" "Amazonka.CloudTrail.Types.Resource" "libZSservicesZSamazonka-cloudtrailZSamazonka-cloudtrail" 'False) (C1 ('MetaCons "Resource'" 'PrefixI 'True) (S1 ('MetaSel ('Just "resourceType") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 (Maybe Text)) :*: S1 ('MetaSel ('Just "resourceName") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 (Maybe Text)))) |
newResource :: Resource Source #
Create a value of Resource
with all optional fields omitted.
Use generic-lens or optics to modify other optional fields.
The following record fields are available, with the corresponding lenses provided for backwards compatibility:
$sel:resourceType:Resource'
, resource_resourceType
- The type of a resource referenced by the event returned. When the
resource type cannot be determined, null is returned. Some examples of
resource types are: Instance for EC2, Trail for CloudTrail,
DBInstance for Amazon RDS, and AccessKey for IAM. To learn more
about how to look up and filter events by the resource types supported
for a service, see
Filtering CloudTrail Events.
$sel:resourceName:Resource'
, resource_resourceName
- The name of the resource referenced by the event returned. These are
user-created names whose values will depend on the environment. For
example, the resource name might be "auto-scaling-test-group" for an
Auto Scaling Group or "i-1234567" for an EC2 Instance.
ResourceTag
data ResourceTag Source #
A resource tag.
See: newResourceTag
smart constructor.
ResourceTag' (Maybe Text) (Maybe [Tag]) |
Instances
newResourceTag :: ResourceTag Source #
Create a value of ResourceTag
with all optional fields omitted.
Use generic-lens or optics to modify other optional fields.
The following record fields are available, with the corresponding lenses provided for backwards compatibility:
$sel:resourceId:ResourceTag'
, resourceTag_resourceId
- Specifies the ARN of the resource.
$sel:tagsList:ResourceTag'
, resourceTag_tagsList
- A list of tags.
Tag
A custom key-value pair associated with a resource such as a CloudTrail trail.
See: newTag
smart constructor.
Instances
Eq Tag Source # | |
Read Tag Source # | |
Show Tag Source # | |
Generic Tag Source # | |
NFData Tag Source # | |
Defined in Amazonka.CloudTrail.Types.Tag | |
Hashable Tag Source # | |
Defined in Amazonka.CloudTrail.Types.Tag | |
ToJSON Tag Source # | |
Defined in Amazonka.CloudTrail.Types.Tag | |
FromJSON Tag Source # | |
type Rep Tag Source # | |
Defined in Amazonka.CloudTrail.Types.Tag type Rep Tag = D1 ('MetaData "Tag" "Amazonka.CloudTrail.Types.Tag" "libZSservicesZSamazonka-cloudtrailZSamazonka-cloudtrail" 'False) (C1 ('MetaCons "Tag'" 'PrefixI 'True) (S1 ('MetaSel ('Just "value") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 (Maybe Text)) :*: S1 ('MetaSel ('Just "key") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 Text))) |
Create a value of Tag
with all optional fields omitted.
Use generic-lens or optics to modify other optional fields.
The following record fields are available, with the corresponding lenses provided for backwards compatibility:
$sel:value:Tag'
, tag_value
- The value in a key-value pair of a tag. The value must be no longer than
256 Unicode characters.
$sel:key:Tag'
, tag_key
- The key in a key-value pair. The key must be must be no longer than 128
Unicode characters. The key must be unique for the resource to which it
applies.
Trail
The settings for a trail.
See: newTrail
smart constructor.
Trail' (Maybe Bool) (Maybe Text) (Maybe Text) (Maybe Bool) (Maybe Text) (Maybe Text) (Maybe Text) (Maybe Text) (Maybe Text) (Maybe Text) (Maybe Bool) (Maybe Bool) (Maybe Bool) (Maybe Text) (Maybe Text) (Maybe Bool) |
Instances
Create a value of Trail
with all optional fields omitted.
Use generic-lens or optics to modify other optional fields.
The following record fields are available, with the corresponding lenses provided for backwards compatibility:
$sel:logFileValidationEnabled:Trail'
, trail_logFileValidationEnabled
- Specifies whether log file validation is enabled.
$sel:trailARN:Trail'
, trail_trailARN
- Specifies the ARN of the trail. The following is the format of a trail
ARN.
arn:aws:cloudtrail:us-east-2:123456789012:trail/MyTrail
$sel:s3KeyPrefix:Trail'
, trail_s3KeyPrefix
- Specifies the Amazon S3 key prefix that comes after the name of the
bucket you have designated for log file delivery. For more information,
see
Finding Your CloudTrail Log Files.
The maximum length is 200 characters.
$sel:hasInsightSelectors:Trail'
, trail_hasInsightSelectors
- Specifies whether a trail has insight types specified in an
InsightSelector
list.
$sel:snsTopicARN:Trail'
, trail_snsTopicARN
- Specifies the ARN of the Amazon SNS topic that CloudTrail uses to send
notifications when log files are delivered. The following is the format
of a topic ARN.
arn:aws:sns:us-east-2:123456789012:MyTopic
$sel:snsTopicName:Trail'
, trail_snsTopicName
- This field is no longer in use. Use SnsTopicARN.
$sel:cloudWatchLogsLogGroupArn:Trail'
, trail_cloudWatchLogsLogGroupArn
- Specifies an Amazon Resource Name (ARN), a unique identifier that
represents the log group to which CloudTrail logs will be delivered.
$sel:kmsKeyId:Trail'
, trail_kmsKeyId
- Specifies the KMS key ID that encrypts the logs delivered by CloudTrail.
The value is a fully specified ARN to a KMS key in the following format.
arn:aws:kms:us-east-2:123456789012:key/12345678-1234-1234-1234-123456789012
$sel:homeRegion:Trail'
, trail_homeRegion
- The region in which the trail was created.
$sel:name:Trail'
, trail_name
- Name of the trail set by calling CreateTrail. The maximum length is 128
characters.
$sel:includeGlobalServiceEvents:Trail'
, trail_includeGlobalServiceEvents
- Set to True to include Amazon Web Services API calls from Amazon Web
Services global services such as IAM. Otherwise, False.
$sel:hasCustomEventSelectors:Trail'
, trail_hasCustomEventSelectors
- Specifies if the trail has custom event selectors.
$sel:isOrganizationTrail:Trail'
, trail_isOrganizationTrail
- Specifies whether the trail is an organization trail.
$sel:cloudWatchLogsRoleArn:Trail'
, trail_cloudWatchLogsRoleArn
- Specifies the role for the CloudWatch Logs endpoint to assume to write
to a user's log group.
$sel:s3BucketName:Trail'
, trail_s3BucketName
- Name of the Amazon S3 bucket into which CloudTrail delivers your trail
files. See
Amazon S3 Bucket Naming Requirements.
$sel:isMultiRegionTrail:Trail'
, trail_isMultiRegionTrail
- Specifies whether the trail exists only in one region or exists in all
regions.
TrailInfo
Information about a CloudTrail trail, including the trail's name, home region, and Amazon Resource Name (ARN).
See: newTrailInfo
smart constructor.
Instances
Eq TrailInfo Source # | |
Read TrailInfo Source # | |
Show TrailInfo Source # | |
Generic TrailInfo Source # | |
NFData TrailInfo Source # | |
Defined in Amazonka.CloudTrail.Types.TrailInfo | |
Hashable TrailInfo Source # | |
Defined in Amazonka.CloudTrail.Types.TrailInfo | |
FromJSON TrailInfo Source # | |
type Rep TrailInfo Source # | |
Defined in Amazonka.CloudTrail.Types.TrailInfo type Rep TrailInfo = D1 ('MetaData "TrailInfo" "Amazonka.CloudTrail.Types.TrailInfo" "libZSservicesZSamazonka-cloudtrailZSamazonka-cloudtrail" 'False) (C1 ('MetaCons "TrailInfo'" 'PrefixI 'True) (S1 ('MetaSel ('Just "trailARN") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 (Maybe Text)) :*: (S1 ('MetaSel ('Just "homeRegion") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 (Maybe Text)) :*: S1 ('MetaSel ('Just "name") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 (Maybe Text))))) |
newTrailInfo :: TrailInfo Source #
Create a value of TrailInfo
with all optional fields omitted.
Use generic-lens or optics to modify other optional fields.
The following record fields are available, with the corresponding lenses provided for backwards compatibility:
$sel:trailARN:TrailInfo'
, trailInfo_trailARN
- The ARN of a trail.
$sel:homeRegion:TrailInfo'
, trailInfo_homeRegion
- The Amazon Web Services Region in which a trail was created.
$sel:name:TrailInfo'
, trailInfo_name
- The name of a trail.