Class: Aws::CloudTrail::Types::EventSelector

Inherits:
Struct
  • Object
show all
Includes:
Structure
Defined in:
lib/aws-sdk-cloudtrail/types.rb

Overview

Use event selectors to further specify the management and data event settings for your trail. By default, trails created without specific event selectors will be configured to log all read and write management events, and no data events. When an event occurs in your account, CloudTrail evaluates the event selector for all trails. For each trail, if the event matches any event selector, the trail processes and logs the event. If the event doesn’t match any event selector, the trail doesn’t log the event.

You can configure up to five event selectors for a trail.

You cannot apply both event selectors and advanced event selectors to a trail.

See Also:

Constant Summary collapse

SENSITIVE = 
[]

Instance Attribute Summary collapse

Instance Attribute Details

#data_resources ⇒ Array<Types::DataResource>

CloudTrail supports data event logging for Amazon S3 objects in standard S3 buckets, Lambda functions, and Amazon DynamoDB tables with basic event selectors. You can specify up to 250 resources for an individual event selector, but the total number of data resources cannot exceed 250 across all event selectors in a trail. This limit does not apply if you configure resource logging for all data events.

For more information, see [Data Events] and [Limits in CloudTrail] in the *CloudTrail User Guide*.

<note markdown=“1”> To log data events for all other resource types including objects stored in [directory buckets], you must use [AdvancedEventSelectors]. You must also use ‘AdvancedEventSelectors` if you want to filter on the `eventName` field.

</note>

[1]: docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html [2]: docs.aws.amazon.com/awscloudtrail/latest/userguide/WhatIsCloudTrail-Limits.html [3]: docs.aws.amazon.com/AmazonS3/latest/userguide/directory-buckets-overview.html [4]: docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_AdvancedEventSelector.html

Returns:



2038
2039
2040
2041
2042
2043
2044
2045
 
# File 'lib/aws-sdk-cloudtrail/types.rb', line 2038

class EventSelector < Struct.new(
  :read_write_type,
  :include_management_events,
  :data_resources,
  :exclude_management_event_sources)
  SENSITIVE = []
  include Aws::Structure
end

#exclude_management_event_sources ⇒ Array<String>

An optional list of service event sources from which you do not want management events to be logged on your trail. In this release, the list can be empty (disables the filter), or it can filter out Key Management Service or Amazon RDS Data API events by containing ‘kms.amazonaws.com` or `rdsdata.amazonaws.com`. By default, `ExcludeManagementEventSources` is empty, and KMS and Amazon RDS Data API events are logged to your trail. You can exclude management event sources only in Regions that support the event source.

Returns:

  • (Array<String>) 


2038
2039
2040
2041
2042
2043
2044
2045
 
# File 'lib/aws-sdk-cloudtrail/types.rb', line 2038

class EventSelector < Struct.new(
  :read_write_type,
  :include_management_events,
  :data_resources,
  :exclude_management_event_sources)
  SENSITIVE = []
  include Aws::Structure
end

#include_management_events ⇒ Boolean

Specify if you want your event selector to include management events for your trail.

For more information, see [Management Events] in the *CloudTrail User Guide*.

By default, the value is ‘true`.

The first copy of management events is free. You are charged for additional copies of management events that you are logging on any subsequent trail in the same Region. For more information about CloudTrail pricing, see [CloudTrail Pricing].

[1]: docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-management-events-with-cloudtrail.html [2]: aws.amazon.com/cloudtrail/pricing/

Returns:

  • (Boolean) 


2038
2039
2040
2041
2042
2043
2044
2045
 
# File 'lib/aws-sdk-cloudtrail/types.rb', line 2038

class EventSelector < Struct.new(
  :read_write_type,
  :include_management_events,
  :data_resources,
  :exclude_management_event_sources)
  SENSITIVE = []
  include Aws::Structure
end

#read_write_type ⇒ String

Specify if you want your trail to log read-only events, write-only events, or all. For example, the EC2 ‘GetConsoleOutput` is a read-only API operation and `RunInstances` is a write-only API operation.

By default, the value is ‘All`.

Returns:

  • (String) 


2038
2039
2040
2041
2042
2043
2044
2045
 
# File 'lib/aws-sdk-cloudtrail/types.rb', line 2038

class EventSelector < Struct.new(
  :read_write_type,
  :include_management_events,
  :data_resources,
  :exclude_management_event_sources)
  SENSITIVE = []
  include Aws::Structure
end