Skip to content

Resource: awsCloudtrailEventDataStore

Provides a CloudTrail Event Data Store.

More information about event data stores can be found in the Event Data Store User Guide.

-> Tip: For an organization event data store you must create this resource in the management account.

Example Usage

Basic

The most simple event data store configuration requires us to only set the name attribute. The event data store will automatically capture all management events. To capture management events from all the regions, multiRegionEnabled must be true.

/*Provider bindings are generated by running cdktf get.
See https://cdk.tf/provider-generation for more details.*/
import * as aws from "./.gen/providers/aws";
new aws.cloudtrailEventDataStore.CloudtrailEventDataStore(this, "example", {
  name: "example-event-data-store",
});

Data Event Logging

CloudTrail can log Data Events for certain services such as S3 bucket objects and Lambda function invocations. Additional information about data event configuration can be found in the following links:

Log all DynamoDB PutEvent actions for a specific DynamoDB table

/*Provider bindings are generated by running cdktf get.
See https://cdk.tf/provider-generation for more details.*/
import * as aws from "./.gen/providers/aws";
const dataAwsDynamodbTableTable =
  new aws.dataAwsDynamodbTable.DataAwsDynamodbTable(this, "table", {
    name: "not-important-dynamodb-table",
  });
new aws.cloudtrailEventDataStore.CloudtrailEventDataStore(this, "example", {
  advancedEventSelector: [
    {
      fieldSelector: [
        {
          equalTo: ["Data"],
          field: "eventCategory",
        },
        {
          equalTo: ["AWS::DynamoDB::Table"],
          field: "resources.type",
        },
        {
          equalTo: ["PutItem"],
          field: "eventName",
        },
        {
          equalTo: [dataAwsDynamodbTableTable.arn],
          field: "resources.ARN",
        },
      ],
      name: "Log all DynamoDB PutEvent actions for a specific DynamoDB table",
    },
  ],
});

Argument Reference

The following arguments are supported:

  • name - (Required) The name of the event data store.
  • advancedEventSelector - (Optional) The advanced event selectors to use to select the events for the data store. For more information about how to use advanced event selectors, see Log events by using advanced event selectors in the CloudTrail User Guide.
  • multiRegionEnabled - (Optional) Specifies whether the event data store includes events from all regions, or only from the region in which the event data store is created. Default: true.
  • organizationEnabled - (Optional) Specifies whether an event data store collects events logged for an organization in AWS Organizations. Default: false.
  • retentionPeriod - (Optional) The retention period of the event data store, in days. You can set a retention period of up to 2555 days, the equivalent of seven years. Default: 2555.
  • kmsKeyId - Specifies the AWS KMS key ID to use to encrypt the events delivered by CloudTrail. The value can be an alias name prefixed by alias/, a fully specified ARN to an alias, a fully specified ARN to a key, or a globally unique identifier.
  • tags - (Optional) A map of tags to assign to the resource. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
  • terminationProtectionEnabled - (Optional) Specifies whether termination protection is enabled for the event data store. If termination protection is enabled, you cannot delete the event data store until termination protection is disabled. Default: true.

Advanced Event Selector Arguments

For advanced_event_selector the following attributes are supported.

  • name (Optional) - Specifies the name of the advanced event selector.
  • fieldSelector (Required) - Specifies the selector statements in an advanced event selector. Fields documented below.

Field Selector Arguments

For field_selector the following attributes are supported.

  • field (Required) - Specifies a field in an event record on which to filter events to be logged. You can specify only the following values: readOnly, eventSource, eventName, eventCategory, resourcesType, resourcesArn.
  • equals (Optional) - A list of values that includes events that match the exact value of the event record field specified as the value of field. This is the only valid operator that you can use with the readOnly, eventCategory, and resourcesType fields.
  • notEquals (Optional) - A list of values that excludes events that match the exact value of the event record field specified as the value of field.
  • startsWith (Optional) - A list of values that includes events that match the first few characters of the event record field specified as the value of field.
  • notStartsWith (Optional) - A list of values that excludes events that match the first few characters of the event record field specified as the value of field.
  • endsWith (Optional) - A list of values that includes events that match the last few characters of the event record field specified as the value of field.
  • notEndsWith (Optional) - A list of values that excludes events that match the last few characters of the event record field specified as the value of field.

Attributes Reference

In addition to all arguments above, the following attributes are exported:

  • arn - ARN of the event data store.
  • id - Name of the event data store.
  • tagsAll - Map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.

Import

Event data stores can be imported using their arn, e.g.,

$ terraform import aws_cloudtrail_event_data_store.example arn:aws:cloudtrail:us-east-1:123456789123:eventdatastore/22333815-4414-412c-b155-dd254033gfhf