TrailProps Struct
Properties for an AWS CloudTrail trail.
Example
const trail = new cloudtrail.Trail(this, 'CloudTrail', {
// ...
managementEvents: cloudtrail.ReadWriteType.READ_ONLY,
});
Properties
bucketoptionalIBucketbucketoptionalIBucketbucketoptionalIBucketBucketoptionalIBucketBucketoptionalIBucket#Default: if not supplied a bucket will be created with all the correct permissions
cloudWatchLogGroupoptionalILogGroupRefcloud_watch_log_groupoptionalILogGroupRefcloudWatchLogGroupoptionalILogGroupRefCloudWatchLogGroupoptionalILogGroupRefCloudWatchLogGroupoptionalILogGroupRef#Default: a new log group is created and used.
Ignored if sendToCloudWatchLogs is set to false.
cloudWatchLogsRetentionoptionalRetentionDayscloud_watch_logs_retentionoptionalRetentionDayscloudWatchLogsRetentionoptionalRetentionDaysCloudWatchLogsRetentionoptionalRetentionDaysCloudWatchLogsRetentionoptionalRetentionDays= logs.RetentionDays.ONE_YEAR#Ignored if sendToCloudWatchLogs is false or if cloudWatchLogGroup is set.
enableFileValidationoptionalbooleanenable_file_validationoptionalboolenableFileValidationoptionalBooleanEnableFileValidationoptionalboolEnableFileValidationoptional*bool= true#notes
This feature is built using industry standard algorithms: SHA-256 for hashing and SHA-256 with RSA for digital signing. This makes it computationally infeasible to modify, delete or forge CloudTrail log files without detection. You can use the AWS CLI to validate the files in the location where CloudTrail delivered them.
encryptionKeyoptionalIKeyencryption_keyoptionalIKeyencryptionKeyoptionalIKeyEncryptionKeyoptionalIKeyEncryptionKeyoptionalIKey#Default: No encryption.
includeGlobalServiceEventsoptionalbooleaninclude_global_service_eventsoptionalboolincludeGlobalServiceEventsoptionalBooleanIncludeGlobalServiceEventsoptionalboolIncludeGlobalServiceEventsoptional*bool= true#For global services such as AWS Identity and Access Management (IAM), AWS STS, Amazon CloudFront, and Route 53, events are delivered to any trail that includes global services, and are logged as occurring in US East (N. Virginia) Region.
insightTypesoptionalInsightType[]insight_typesoptionaltyping.List[InsightType]insightTypesoptionalList<InsightType>InsightTypesoptionalInsightType[]InsightTypesoptional*[]InsightType#Default: No Value.
isMultiRegionTrailoptionalbooleanis_multi_region_trailoptionalboolisMultiRegionTrailoptionalBooleanIsMultiRegionTrailoptionalboolIsMultiRegionTrailoptional*bool= true#isOrganizationTrailoptionalbooleanis_organization_trailoptionalboolisOrganizationTrailoptionalBooleanIsOrganizationTrailoptionalboolIsOrganizationTrailoptional*bool= false#notes
If this is set to true then the current account must be the management account. If it is not, then CloudFormation will throw an error.
If this is set to true and the current account is a management account for an organization in AWS Organizations, the trail will be created in all AWS accounts that belong to the organization. If this is set to false, the trail will remain in the current AWS account but be deleted from all member accounts in the organization.
managementEventsoptionalReadWriteTypemanagement_eventsoptionalReadWriteTypemanagementEventsoptionalReadWriteTypeManagementEventsoptionalReadWriteTypeManagementEventsoptionalReadWriteType= ReadWriteType.ALL#notes
Only events that match your trail settings are delivered to your Amazon S3 bucket and Amazon CloudWatch Logs log group.
This method sets the management configuration for this trail.
Management events provide insight into management operations that are performed on resources in your AWS account. These are also known as control plane operations. Management events can also include non-API events that occur in your account. For example, when a user logs in to your account, CloudTrail logs the ConsoleLogin event.
Default: No orgId
Required when isOrganizationTrail is set to true to attach the necessary permissions.
s3KeyPrefixoptionalstrings3_key_prefixoptionalstrs3KeyPrefixoptionalStringS3KeyPrefixoptionalstringS3KeyPrefixoptional*string#Default: No prefix.
sendToCloudWatchLogsoptionalbooleansend_to_cloud_watch_logsoptionalboolsendToCloudWatchLogsoptionalBooleanSendToCloudWatchLogsoptionalboolSendToCloudWatchLogsoptional*bool= false#Disabled for cost out of the box.
snsTopicoptionalITopicsns_topicoptionalITopicsnsTopicoptionalITopicSnsTopicoptionalITopicSnsTopicoptionalITopic#Default: No notifications.
trailNameoptionalstringtrail_nameoptionalstrtrailNameoptionalStringTrailNameoptionalstringTrailNameoptional*string#Default: AWS CloudFormation generated name.
Required when isOrganizationTrail is set to true to attach the necessary permissions.
Otherwise, we recommend customers do not set an explicit name.