event_data_stores

Creates, updates, deletes or gets an event_data_store resource or lists event_data_stores in a region

Overview

Name	event_data_stores
Type	Resource
Description	A storage lake of event data against which you can run complex SQL-based queries. An event data store can include events that you have logged on your account from the last 7 to 2557 or 3653 days (about seven or ten years) depending on the selected BillingMode.
Id	awscc.cloudtrail.event_data_stores

Fields

get (all properties)

Name	Datatype	Description
▶advanced_event_selectors	array	The advanced event selectors that were used to select events for the data store.
created_timestamp	string	The timestamp of the event data store's creation.
event_data_store_arn	string	The ARN of the event data store.
federation_enabled	boolean	Indicates whether federation is enabled on an event data store.
federation_role_arn	string	The ARN of the role used for event data store federation.
multi_region_enabled	boolean	Indicates whether the event data store includes events from all regions, or only from the region in which it was created.
name	string	The name of the event data store.
organization_enabled	boolean	Indicates that an event data store is collecting logged events for an organization.
billing_mode	string	The mode that the event data store will use to charge for event storage.
retention_period	integer	The retention period, in days.
status	string	The status of an event data store. Values are STARTING_INGESTION, ENABLED, STOPPING_INGESTION, STOPPED_INGESTION and PENDING_DELETION.
termination_protection_enabled	boolean	Indicates whether the event data store is protected from termination.
kms_key_id	string	Specifies the KMS key ID to use to encrypt the events delivered by CloudTrail. The value can be an alias name prefixed by 'alias/', a fully specified ARN to an alias, a fully specified ARN to a key, or a globally unique identifier.
▶tags	array
▶insight_selectors	array	Lets you enable Insights event logging by specifying the Insights selectors that you want to enable on an existing event data store. Both InsightSelectors and InsightsDestination need to have a value in order to enable Insights events on an event data store.
insights_destination	string	Specifies the ARN of the event data store that will collect Insights events. Both InsightSelectors and InsightsDestination need to have a value in order to enable Insights events on an event data store
max_event_size	string	Specifies the maximum size allowed for the event. Valid values are Standard and Large. If you add ContextKeySelectors, this value must be set to Large.
▶context_key_selectors	array	An array that enriches event records in an existing event data store by including additional information specified in individual ContexKeySelector entries. If you add ContextKeySelectors, you must set MaxEventSize to Large.
ingestion_enabled	boolean	Indicates whether the event data store is ingesting events.
region	string	AWS region.

list (identifiers only)

Name	Datatype	Description
event_data_store_arn	string	The ARN of the event data store.
region	string	AWS region.

For more information, see AWS::CloudTrail::EventDataStore.

Methods

Name	Resource	Accessible by	Required Params
create_resource	event_data_stores	INSERT	, region
delete_resource	event_data_stores	DELETE	Identifier, region
update_resource	event_data_stores	UPDATE	Identifier, PatchDocument, region
list_resources	event_data_stores_list_only	SELECT	region
get_resource	event_data_stores	SELECT	Identifier, region

SELECT examples

get (all properties)

Gets all properties from an individual event_data_store.

SELECT
  region,
  advanced_event_selectors,
  created_timestamp,
  event_data_store_arn,
  federation_enabled,
  federation_role_arn,
  multi_region_enabled,
  name,
  organization_enabled,
  billing_mode,
  retention_period,
  status,
  termination_protection_enabled,
  updated_timestamp,
  kms_key_id,
  tags,
  insight_selectors,
  insights_destination,
  max_event_size,
  context_key_selectors,
  ingestion_enabled
FROM awscc.cloudtrail.event_data_stores
WHERE
  region = 'us-east-1' AND
  Identifier = '{{ event_data_store_arn }}';

list (identifiers only)

Lists all event_data_stores in a region.

SELECT
  region,
  event_data_store_arn
FROM awscc.cloudtrail.event_data_stores_list_only
WHERE
  region = 'us-east-1';

INSERT example

Use the following StackQL query and manifest file to create a new event_data_store resource, using stack-deploy.

Required Properties

/*+ create */
INSERT INTO awscc.cloudtrail.event_data_stores (
  ,
  region
)
SELECT
  '{{  }}',
  '{{ region }}';

All Properties

/*+ create */
INSERT INTO awscc.cloudtrail.event_data_stores (
  AdvancedEventSelectors,
  FederationEnabled,
  FederationRoleArn,
  MultiRegionEnabled,
  Name,
  OrganizationEnabled,
  BillingMode,
  RetentionPeriod,
  TerminationProtectionEnabled,
  KmsKeyId,
  Tags,
  InsightSelectors,
  InsightsDestination,
  MaxEventSize,
  ContextKeySelectors,
  IngestionEnabled,
  region
)
SELECT
  '{{ advanced_event_selectors }}',
  '{{ federation_enabled }}',
  '{{ federation_role_arn }}',
  '{{ multi_region_enabled }}',
  '{{ name }}',
  '{{ organization_enabled }}',
  '{{ billing_mode }}',
  '{{ retention_period }}',
  '{{ termination_protection_enabled }}',
  '{{ kms_key_id }}',
  '{{ tags }}',
  '{{ insight_selectors }}',
  '{{ insights_destination }}',
  '{{ max_event_size }}',
  '{{ context_key_selectors }}',
  '{{ ingestion_enabled }}',
  '{{ region }}';

Manifest

version: 1
name: stack name
description: stack description
providers:
  - aws
globals:
  - name: region
    value: '{{ vars.AWS_REGION }}'
resources:
  - name: event_data_store
    props:
      - name: advanced_event_selectors
        value:
          - field_selectors:
              - field: '{{ field }}'
                equals:
                  - '{{ equals[0] }}'
                not_starts_with:
                  - '{{ not_starts_with[0] }}'
                not_ends_with:
                  - '{{ not_ends_with[0] }}'
                starts_with:
                  - '{{ starts_with[0] }}'
                ends_with:
                  - '{{ ends_with[0] }}'
                not_equals:
                  - '{{ not_equals[0] }}'
            name: '{{ name }}'
      - name: federation_enabled
        value: '{{ federation_enabled }}'
      - name: federation_role_arn
        value: '{{ federation_role_arn }}'
      - name: multi_region_enabled
        value: '{{ multi_region_enabled }}'
      - name: name
        value: '{{ name }}'
      - name: organization_enabled
        value: '{{ organization_enabled }}'
      - name: billing_mode
        value: '{{ billing_mode }}'
      - name: retention_period
        value: '{{ retention_period }}'
      - name: termination_protection_enabled
        value: '{{ termination_protection_enabled }}'
      - name: kms_key_id
        value: '{{ kms_key_id }}'
      - name: tags
        value:
          - value: '{{ value }}'
            key: '{{ key }}'
      - name: insight_selectors
        value:
          - insight_type: '{{ insight_type }}'
      - name: insights_destination
        value: '{{ insights_destination }}'
      - name: max_event_size
        value: '{{ max_event_size }}'
      - name: context_key_selectors
        value:
          - type: '{{ type }}'
            equals:
              - '{{ equals[0] }}'
      - name: ingestion_enabled
        value: '{{ ingestion_enabled }}'

UPDATE example

Use the following StackQL query and manifest file to update a event_data_store resource, using stack-deploy.

/*+ update */
UPDATE awscc.cloudtrail.event_data_stores
SET PatchDocument = string('{{ {
    "AdvancedEventSelectors": advanced_event_selectors,
    "FederationEnabled": federation_enabled,
    "FederationRoleArn": federation_role_arn,
    "MultiRegionEnabled": multi_region_enabled,
    "Name": name,
    "OrganizationEnabled": organization_enabled,
    "BillingMode": billing_mode,
    "RetentionPeriod": retention_period,
    "TerminationProtectionEnabled": termination_protection_enabled,
    "KmsKeyId": kms_key_id,
    "Tags": tags,
    "InsightSelectors": insight_selectors,
    "InsightsDestination": insights_destination,
    "MaxEventSize": max_event_size,
    "ContextKeySelectors": context_key_selectors,
    "IngestionEnabled": ingestion_enabled
} | generate_patch_document }}')
WHERE
  region = '{{ region }}' AND
  Identifier = '{{ event_data_store_arn }}';

DELETE example

/*+ delete */
DELETE FROM awscc.cloudtrail.event_data_stores
WHERE
  Identifier = '{{ event_data_store_arn }}' AND
  region = 'us-east-1';

Permissions

To operate on the event_data_stores resource, the following permissions are required:

Create

CloudTrail:CreateEventDataStore,
CloudTrail:AddTags,
CloudTrail:PutInsightSelectors,
CloudTrail:EnableFederation,
CloudTrail:GetEventDataStore,
CloudTrail:PutEventConfiguration,
iam:PassRole,
iam:GetRole,
iam:CreateServiceLinkedRole,
organizations:DescribeOrganization,
organizations:ListAWSServiceAccessForOrganization,
kms:GenerateDataKey,
kms:Decrypt,
glue:CreateDatabase,
glue:CreateTable,
glue:PassConnection,
lakeformation:RegisterResource

Read

CloudTrail:GetEventDataStore,
CloudTrail:ListEventDataStores,
CloudTrail:GetInsightSelectors,
CloudTrail:GetEventConfiguration,
CloudTrail:ListTags

Update

CloudTrail:UpdateEventDataStore,
CloudTrail:RestoreEventDataStore,
CloudTrail:AddTags,
CloudTrail:RemoveTags,
CloudTrail:StartEventDataStoreIngestion,
CloudTrail:StopEventDataStoreIngestion,
CloudTrail:GetEventDataStore,
CloudTrail:PutInsightSelectors,
CloudTrail:GetInsightSelectors,
CloudTrail:EnableFederation,
CloudTrail:DisableFederation,
CloudTrail:PutEventConfiguration,
iam:PassRole,
iam:GetRole,
iam:CreateServiceLinkedRole,
organizations:DescribeOrganization,
organizations:ListAWSServiceAccessForOrganization,
glue:CreateDatabase,
glue:CreateTable,
glue:PassConnection,
lakeformation:RegisterResource,
glue:DeleteTable,
lakeformation:DeregisterResource,
kms:DescribeKey

Delete

CloudTrail:DeleteEventDataStore,
CloudTrail:GetEventDataStore,
CloudTrail:DisableFederation,
glue:DeleteTable,
lakeformation:DeregisterResource

List

CloudTrail:ListEventDataStores,
CloudTrail:GetEventDataStore,
CloudTrail:GetInsightSelectors,
CloudTrail:ListTags