Interface CfnTrail.IEventSelectorProperty
Use event selectors to further specify the management and data event settings for your trail.
Namespace: Amazon.CDK.AWS.CloudTrail
Assembly: Amazon.CDK.AWS.CloudTrail.dll
Syntax (csharp)
public interface IEventSelectorProperty
Syntax (vb)
Public Interface IEventSelectorProperty
Remarks
By default, trails created without specific event selectors will be configured to log all read and write management events, and no data events. When an event occurs in your account, CloudTrail evaluates the event selector for all trails. For each trail, if the event matches any event selector, the trail processes and logs the event. If the event doesn't match any event selector, the trail doesn't log the event.
You can configure up to five event selectors for a trail.
You cannot apply both event selectors and advanced event selectors to a trail.
ExampleMetadata: fixture=_generated
Examples
// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
using Amazon.CDK.AWS.CloudTrail;
var eventSelectorProperty = new EventSelectorProperty {
DataResources = new [] { new DataResourceProperty {
Type = "type",
// the properties below are optional
Values = new [] { "values" }
} },
ExcludeManagementEventSources = new [] { "excludeManagementEventSources" },
IncludeManagementEvents = false,
ReadWriteType = "readWriteType"
};
Synopsis
Properties
DataResources | In AWS CloudFormation , CloudTrail supports data event logging for Amazon S3 objects, Amazon DynamoDB tables, and AWS Lambda functions. |
ExcludeManagementEventSources | An optional list of service event sources from which you do not want management events to be logged on your trail. |
IncludeManagementEvents | Specify if you want your event selector to include management events for your trail. |
ReadWriteType | Specify if you want your trail to log read-only events, write-only events, or all. |
Properties
DataResources
In AWS CloudFormation , CloudTrail supports data event logging for Amazon S3 objects, Amazon DynamoDB tables, and AWS Lambda functions.
virtual object DataResources { get; }
Property Value
System.Object
Remarks
Currently, advanced event selectors for data events are not supported in AWS CloudFormation templates. You can specify up to 250 resources for an individual event selector, but the total number of data resources cannot exceed 250 across all event selectors in a trail. This limit does not apply if you configure resource logging for all data events.
For more information, see Logging data events and Limits in AWS CloudTrail in the AWS CloudTrail User Guide .
ExcludeManagementEventSources
An optional list of service event sources from which you do not want management events to be logged on your trail.
virtual string[] ExcludeManagementEventSources { get; }
Property Value
System.String[]
Remarks
In this release, the list can be empty (disables the filter), or it can filter out AWS Key Management Service or Amazon RDS Data API events by containing kms.amazonaws.com
or rdsdata.amazonaws.com
. By default, ExcludeManagementEventSources
is empty, and AWS KMS and Amazon RDS Data API events are logged to your trail. You can exclude management event sources only in Regions that support the event source.
IncludeManagementEvents
Specify if you want your event selector to include management events for your trail.
virtual object IncludeManagementEvents { get; }
Property Value
System.Object
Remarks
For more information, see Management Events in the AWS CloudTrail User Guide .
By default, the value is true
.
The first copy of management events is free. You are charged for additional copies of management events that you are logging on any subsequent trail in the same Region. For more information about CloudTrail pricing, see AWS CloudTrail Pricing .
ReadWriteType
Specify if you want your trail to log read-only events, write-only events, or all.
virtual string ReadWriteType { get; }
Property Value
System.String
Remarks
For example, the EC2 GetConsoleOutput
is a read-only API operation and RunInstances
is a write-only API operation.
By default, the value is All
.