AWS services or capabilities described in AWS Documentation may vary by region/location. Click Getting Started with Amazon AWS to see specific differences applicable to the China (Beijing) Region.
Update-CTEventDataStore-Name <String>-AdvancedEventSelector <AdvancedEventSelector[]>-BillingMode <BillingMode>-EventDataStore <String>-KmsKeyId <String>-MultiRegionEnabled <Boolean>-OrganizationEnabled <Boolean>-RetentionPeriod <Int32>-TerminationProtectionEnabled <Boolean>-Select <String>-PassThru <SwitchParameter>-Force <SwitchParameter>-ClientConfig <AmazonCloudTrailConfig>
EventDataStore
value is an ARN or the ID portion of the ARN. Other parameters are optional, but at least one optional parameter must be specified, or CloudTrail throws an error. RetentionPeriod
is in days, and valid values are integers between 7 and 3653 if the BillingMode
is set to EXTENDABLE_RETENTION_PRICING
, or between 7 and 2557 if BillingMode
is set to FIXED_RETENTION_PRICING
. By default, TerminationProtection
is enabled.
For event data stores for CloudTrail events, AdvancedEventSelectors
includes or excludes management, data, or Insights events in your event data store. For more information about AdvancedEventSelectors
, see AdvancedEventSelectors.
For event data stores for Config configuration items, Audit Manager evidence, or non-Amazon Web Services events, AdvancedEventSelectors
includes events of that type in your event data store. Required? | False |
Position? | Named |
Accept pipeline input? | True (ByPropertyName) |
Aliases | AdvancedEventSelectors |
EXTENDABLE_RETENTION_PRICING
to FIXED_RETENTION_PRICING
. If BillingMode
is set to EXTENDABLE_RETENTION_PRICING
and you want to use FIXED_RETENTION_PRICING
instead, you'll need to stop ingestion on the event data store and create a new event data store that uses FIXED_RETENTION_PRICING
.The billing mode for the event data store determines the cost for ingesting events and the default and maximum retention period for the event data store.The following are the possible values:EXTENDABLE_RETENTION_PRICING
- This billing mode is generally recommended if you want a flexible retention period of up to 3653 days (about 10 years). The default retention period for this billing mode is 366 days.FIXED_RETENTION_PRICING
- This billing mode is recommended if you expect to ingest more than 25 TB of event data per month and need a retention period of up to 2557 days (about 7 years). The default retention period for this billing mode is 2557 days.Required? | False |
Position? | Named |
Accept pipeline input? | True (ByPropertyName) |
Required? | False |
Position? | Named |
Accept pipeline input? | True (ByPropertyName) |
Required? | True |
Position? | Named |
Accept pipeline input? | True (ByPropertyName) |
Required? | False |
Position? | Named |
Accept pipeline input? | True (ByPropertyName) |
alias/
, a fully specified ARN to an alias, a fully specified ARN to a key, or a globally unique identifier.alias/MyAliasName
arn:aws:kms:us-east-2:123456789012:alias/MyAliasName
arn:aws:kms:us-east-2:123456789012:key/12345678-1234-1234-1234-123456789012
12345678-1234-1234-1234-123456789012
Required? | False |
Position? | Named |
Accept pipeline input? | True (ByPropertyName) |
Required? | False |
Position? | Named |
Accept pipeline input? | True (ByPropertyName) |
Required? | False |
Position? | 1 |
Accept pipeline input? | True (ByValue, ByPropertyName) |
Required? | False |
Position? | Named |
Accept pipeline input? | True (ByPropertyName) |
Required? | False |
Position? | Named |
Accept pipeline input? | True (ByPropertyName) |
BillingMode
is set to EXTENDABLE_RETENTION_PRICING
, you can set a retention period of up to 3653 days, the equivalent of 10 years. If BillingMode
is set to FIXED_RETENTION_PRICING
, you can set a retention period of up to 2557 days, the equivalent of seven years.CloudTrail Lake determines whether to retain an event by checking if the eventTime
of the event is within the specified retention period. For example, if you set a retention period of 90 days, CloudTrail will remove events when the eventTime
is older than 90 days.If you decrease the retention period of an event data store, CloudTrail will remove any events with an eventTime
older than the new retention period. For example, if the previous retention period was 365 days and you decrease it to 100 days, CloudTrail will remove events with an eventTime
older than 100 days. Required? | False |
Position? | Named |
Accept pipeline input? | True (ByPropertyName) |
Required? | False |
Position? | Named |
Accept pipeline input? | True (ByPropertyName) |
Required? | False |
Position? | Named |
Accept pipeline input? | True (ByPropertyName) |
Required? | False |
Position? | Named |
Accept pipeline input? | True (ByPropertyName) |
Aliases | AK |
Required? | False |
Position? | Named |
Accept pipeline input? | True (ByValue, ByPropertyName) |
Required? | False |
Position? | Named |
Accept pipeline input? | True (ByPropertyName) |
Required? | False |
Position? | Named |
Accept pipeline input? | True (ByValue, ByPropertyName) |
Required? | False |
Position? | Named |
Accept pipeline input? | True (ByPropertyName) |
Aliases | AWSProfilesLocation, ProfilesLocation |
Required? | False |
Position? | Named |
Accept pipeline input? | True (ByPropertyName) |
Aliases | StoredCredentials, AWSProfileName |
Required? | False |
Position? | Named |
Accept pipeline input? | True (ByPropertyName) |
Aliases | RegionToCall |
Required? | False |
Position? | Named |
Accept pipeline input? | True (ByPropertyName) |
Aliases | SK, SecretAccessKey |
Required? | False |
Position? | Named |
Accept pipeline input? | True (ByPropertyName) |
Aliases | ST |
AWS Tools for PowerShell: 2.x.y.z