EventDataStore

cloudtrail.services.k8s.aws/v1alpha1

Metadata#

A storage lake of event data against which you can run complex SQL-based queries. An event data store can include events that you have logged on your account. To select events for an event data store, use advanced event selectors (https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-lake-concepts.html#adv-event-selectors).

Spec#

advancedEventSelectors:
  fieldSelectors:
    endsWith:
    - string
    equals:
    - string
    field: string
    notEndsWith:
    - string
    notEquals:
    - string
    notStartsWith:
    - string
    startsWith:
    - string
  name: string
multiRegionEnabled: boolean
name: string
organizationEnabled: boolean
retentionPeriod: integer
tags:
- key: string
  value: string
terminationProtectionEnabled: boolean

You cannot apply both event selectors and advanced event selectors to a trail.

Supported CloudTrail event record fields for management events

• eventCategory (required)

• eventSource

• readOnly

The following additional fields are available for event data stores:

• eventName

• eventType

• sessionCredentialFromConsole

• userIdentity.arn

Supported CloudTrail event record fields for data events

• eventCategory (required)

• resources.type (required)

• readOnly

• eventName

• resources.ARN

The following additional fields are available for event data stores:

• eventSource

• eventType

• sessionCredentialFromConsole

• userIdentity.arn

Supported CloudTrail event record fields for network activity events

Network activity events is in preview release for CloudTrail and is subject to change.

• eventCategory (required)

• eventSource (required)

• eventName

• errorCode - The only valid value for errorCode is VpceAccessDenied.

• vpcEndpointId

For event data stores for CloudTrail Insights events, Config configuration items, Audit Manager evidence, or events outside of Amazon Web Services, the only supported field is eventCategory. || advancedEventSelectors.[].fieldSelectors
Optional | array
| | advancedEventSelectors.[].fieldSelectors.[]
Required | object
A single selector statement in an advanced event selector. || advancedEventSelectors.[].fieldSelectors.[].endsWith
Optional | array
| | advancedEventSelectors.[].fieldSelectors.[].endsWith.[]
Required | string
|| advancedEventSelectors.[].fieldSelectors.[].equals
Optional | array
| | advancedEventSelectors.[].fieldSelectors.[].equals.[]
Required | string
|| advancedEventSelectors.[].fieldSelectors.[].field
Optional | string
| | advancedEventSelectors.[].fieldSelectors.[].notEndsWith
Optional | array
| | advancedEventSelectors.[].fieldSelectors.[].notEndsWith.[]
Required | string
|| advancedEventSelectors.[].fieldSelectors.[].notEquals
Optional | array
| | advancedEventSelectors.[].fieldSelectors.[].notEquals.[]
Required | string
|| advancedEventSelectors.[].fieldSelectors.[].notStartsWith
Optional | array
| | advancedEventSelectors.[].fieldSelectors.[].notStartsWith.[]
Required | string
|| advancedEventSelectors.[].fieldSelectors.[].startsWith
Optional | array
| | advancedEventSelectors.[].fieldSelectors.[].startsWith.[]
Required | string
|| advancedEventSelectors.[].name
Optional | string
| | multiRegionEnabled
Optional | boolean
Specifies whether the event data store includes events from all Regions,
or only from the Region in which the event data store is created. | | name
Required | string
The name of the event data store. | | organizationEnabled
Optional | boolean
Specifies whether an event data store collects events logged for an organization
in Organizations. | | retentionPeriod
Optional | integer
The retention period of the event data store, in days. If BillingMode is
set to EXTENDABLE_RETENTION_PRICING, you can set a retention period of up
to 3653 days, the equivalent of 10 years. If BillingMode is set to FIXED_RETENTION_PRICING,
you can set a retention period of up to 2557 days, the equivalent of seven
years.

CloudTrail Lake determines whether to retain an event by checking if the
eventTime of the event is within the specified retention period. For example,
if you set a retention period of 90 days, CloudTrail will remove events when
the eventTime is older than 90 days.

If you plan to copy trail events to this event data store, we recommend that
you consider both the age of the events that you want to copy as well as
how long you want to keep the copied events in your event data store. For
example, if you copy trail events that are 5 years old and specify a retention
period of 7 years, the event data store will retain those events for two
years. | | tags
Optional | array
| | tags.[]
Required | object
A custom key-value pair associated with a resource such as a CloudTrail trail, event data store, dashboard, or channel. || tags.[].key
Optional | string
| | tags.[].value
Optional | string
| | terminationProtectionEnabled
Optional | boolean
Specifies whether termination protection is enabled for the event data store.
If termination protection is enabled, you cannot delete the event data store
until termination protection is disabled. |

Status#

ackResourceMetadata: 
  arn: string
  ownerAccountID: string
  region: string
conditions:
- lastTransitionTime: string
  message: string
  reason: string
  status: string
  type: string
createdTimestamp: string
status: string
updatedTimestamp: string