Skip to main content

event_data_stores

Creates, updates, deletes, gets or lists an event_data_stores resource.

Overview​

Nameevent_data_stores
TypeResource
Idaws.cloudtrail.event_data_stores

Fields​

The following fields are returned by SELECT queries:

NameDatatypeDescription
advanced_event_selectorsarrayThe advanced event selectors used to select events for the data store.
billing_modestringThe billing mode for the event data store. (EXTENDABLE_RETENTION_PRICING, FIXED_RETENTION_PRICING)
created_timestampstring (date-time)The timestamp of the event data store's creation.
event_data_store_arnstringThe event data store Amazon Resource Number (ARN). (pattern: <code>^[a-zA-Z0-9._/-:]+$</code>)
federation_role_arnstringIf Lake query federation is enabled, provides the ARN of the federation role used to access the resources for the federated event data store. (pattern: <code>^[a-zA-Z0-9._/-:@=+,.]+$</code>)
federation_statusstringIndicates the Lake query federation status. The status is ENABLED if Lake query federation is enabled, or DISABLED if Lake query federation is disabled. You cannot delete an event data store if the FederationStatus is ENABLED. (ENABLING, ENABLED, DISABLING, DISABLED)
kms_key_idstringSpecifies the KMS key ID that encrypts the events delivered by CloudTrail. The value is a fully specified ARN to a KMS key in the following format. arn:aws:kms:us-east-2:123456789012:key/12345678-1234-1234-1234-123456789012 (pattern: <code>^[a-zA-Z0-9._/-:]+$</code>)
multi_region_enabledbooleanIndicates whether the event data store includes events from all Regions, or only from the Region in which it was created.
namestringThe name of the event data store. (pattern: <code>^[a-zA-Z0-9._-]+$</code>)
organization_enabledbooleanIndicates whether an event data store is collecting logged events for an organization in Organizations.
partition_keysarrayThe partition keys for the event data store. To improve query performance and efficiency, CloudTrail Lake organizes event data into partitions based on values derived from partition keys.
retention_periodintegerThe retention period of the event data store, in days.
statusstringThe status of an event data store. (CREATED, ENABLED, PENDING_DELETION, STARTING_INGESTION, STOPPING_INGESTION, STOPPED_INGESTION)
termination_protection_enabledbooleanIndicates that termination protection is enabled.
updated_timestampstring (date-time)Shows the time that an event data store was updated, if applicable. UpdatedTimestamp is always either the same or newer than the time shown in CreatedTimestamp.

Methods​

The following methods are available for this resource:

NameAccessible byRequired ParamsOptional ParamsDescription
get_event_data_storeselectregionReturns information about an event data store specified as either an ARN or the ID portion of the ARN.
list_event_data_storesselectregionReturns information about all event data stores in the account, in the current Region.
create_event_data_storeinsertregionCreates a new event data store.
update_event_data_storeupdateregion, EventDataStoreUpdates an event data store. The required EventDataStore value is an ARN or the ID portion of the ARN. Other parameters are optional, but at least one optional parameter must be specified, or CloudTrail throws an error. RetentionPeriod is in days, and valid values are integers between 7 and 3653 if the BillingMode is set to EXTENDABLE_RETENTION_PRICING, or between 7 and 2557 if BillingMode is set to FIXED_RETENTION_PRICING. By default, TerminationProtection is enabled. For event data stores for CloudTrail events, AdvancedEventSelectors includes or excludes management, data, or network activity events in your event data store. For more information about AdvancedEventSelectors, see AdvancedEventSelectors. For event data stores for CloudTrail Insights events, Config configuration items, Audit Manager evidence, or non-Amazon Web Services events, AdvancedEventSelectors includes events of that type in your event data store.
delete_event_data_storedeleteregionDisables the event data store specified by EventDataStore, which accepts an event data store ARN. After you run DeleteEventDataStore, the event data store enters a PENDING_DELETION state, and is automatically deleted after a wait period of seven days. TerminationProtectionEnabled must be set to False on the event data store and the FederationStatus must be DISABLED. You cannot delete an event data store if TerminationProtectionEnabled is True or the FederationStatus is ENABLED. After you run DeleteEventDataStore on an event data store, you cannot run ListQueries, DescribeQuery, or GetQueryResults on queries that are using an event data store in a PENDING_DELETION state. An event data store in the PENDING_DELETION state does not incur costs.
start_event_data_store_ingestionexecregion, EventDataStoreStarts the ingestion of live events on an event data store specified as either an ARN or the ID portion of the ARN. To start ingestion, the event data store Status must be STOPPED_INGESTION and the eventCategory must be Management, Data, NetworkActivity, or ConfigurationItem.
stop_event_data_store_ingestionexecregion, EventDataStoreStops the ingestion of live events on an event data store specified as either an ARN or the ID portion of the ARN. To stop ingestion, the event data store Status must be ENABLED and the eventCategory must be Management, Data, NetworkActivity, or ConfigurationItem.

Parameters​

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

NameDatatypeDescription
regionstringAWS region (default: us-east-1)

SELECT examples​

Returns information about an event data store specified as either an ARN or the ID portion of the ARN.

SELECT
advanced_event_selectors,
billing_mode,
created_timestamp,
event_data_store_arn,
federation_role_arn,
federation_status,
kms_key_id,
multi_region_enabled,
name,
organization_enabled,
partition_keys,
retention_period,
status,
termination_protection_enabled,
updated_timestamp
FROM aws.cloudtrail.event_data_stores
WHERE region = '{{ region }}' -- required
;

INSERT examples​

Creates a new event data store.

INSERT INTO aws.cloudtrail.event_data_stores (
Name,
AdvancedEventSelectors,
MultiRegionEnabled,
OrganizationEnabled,
RetentionPeriod,
TerminationProtectionEnabled,
TagsList,
KmsKeyId,
StartIngestion,
BillingMode,
region
)
SELECT 
'{{ Name }}',
'{{ AdvancedEventSelectors }}',
{{ MultiRegionEnabled }},
{{ OrganizationEnabled }},
{{ RetentionPeriod }},
{{ TerminationProtectionEnabled }},
'{{ TagsList }}',
'{{ KmsKeyId }}',
{{ StartIngestion }},
'{{ BillingMode }}',
'{{ region }}'
RETURNING
advanced_event_selectors,
billing_mode,
created_timestamp,
event_data_store_arn,
kms_key_id,
multi_region_enabled,
name,
organization_enabled,
retention_period,
status,
tags_list,
termination_protection_enabled,
updated_timestamp
;

UPDATE examples​

Updates an event data store. The required EventDataStore value is an ARN or the ID portion of the ARN. Other parameters are optional, but at least one optional parameter must be specified, or CloudTrail throws an error. RetentionPeriod is in days, and valid values are integers between 7 and 3653 if the BillingMode is set to EXTENDABLE_RETENTION_PRICING, or between 7 and 2557 if BillingMode is set to FIXED_RETENTION_PRICING. By default, TerminationProtection is enabled. For event data stores for CloudTrail events, AdvancedEventSelectors includes or excludes management, data, or network activity events in your event data store. For more information about AdvancedEventSelectors, see AdvancedEventSelectors. For event data stores for CloudTrail Insights events, Config configuration items, Audit Manager evidence, or non-Amazon Web Services events, AdvancedEventSelectors includes events of that type in your event data store.

UPDATE aws.cloudtrail.event_data_stores
SET 
EventDataStore = '{{ EventDataStore }}',
Name = '{{ Name }}',
AdvancedEventSelectors = '{{ AdvancedEventSelectors }}',
MultiRegionEnabled = {{ MultiRegionEnabled }},
OrganizationEnabled = {{ OrganizationEnabled }},
RetentionPeriod = {{ RetentionPeriod }},
TerminationProtectionEnabled = {{ TerminationProtectionEnabled }},
KmsKeyId = '{{ KmsKeyId }}',
BillingMode = '{{ BillingMode }}'
WHERE 
region = '{{ region }}' --required
AND EventDataStore = '{{ EventDataStore }}' --required
RETURNING
advanced_event_selectors,
billing_mode,
created_timestamp,
event_data_store_arn,
federation_role_arn,
federation_status,
kms_key_id,
multi_region_enabled,
name,
organization_enabled,
retention_period,
status,
termination_protection_enabled,
updated_timestamp;

DELETE examples​

Disables the event data store specified by EventDataStore, which accepts an event data store ARN. After you run DeleteEventDataStore, the event data store enters a PENDING_DELETION state, and is automatically deleted after a wait period of seven days. TerminationProtectionEnabled must be set to False on the event data store and the FederationStatus must be DISABLED. You cannot delete an event data store if TerminationProtectionEnabled is True or the FederationStatus is ENABLED. After you run DeleteEventDataStore on an event data store, you cannot run ListQueries, DescribeQuery, or GetQueryResults on queries that are using an event data store in a PENDING_DELETION state. An event data store in the PENDING_DELETION state does not incur costs.

DELETE FROM aws.cloudtrail.event_data_stores
WHERE region = '{{ region }}' --required
;

Lifecycle Methods​

Starts the ingestion of live events on an event data store specified as either an ARN or the ID portion of the ARN. To start ingestion, the event data store Status must be STOPPED_INGESTION and the eventCategory must be Management, Data, NetworkActivity, or ConfigurationItem.

EXEC aws.cloudtrail.event_data_stores.start_event_data_store_ingestion 
@region='{{ region }}' --required 
@@json=
'{
"EventDataStore": "{{ EventDataStore }}"
}'
;
Last updated on