audit_events

Creates, updates, deletes, gets or lists an audit_events resource.

Overview

Name	audit_events
Type	Resource
Id	aws.cloudtrail_data.audit_events

Fields

The following fields are returned by SELECT queries:

SELECT not supported for this resource, use SHOW METHODS to view available operations for the resource.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
put_audit_events	replace	channelArn, region, auditEvents	externalId	Ingests your application events into CloudTrail Lake. A required parameter, auditEvents, accepts the JSON records (also called payload) of events that you want CloudTrail to ingest. You can add up to 100 of these events (or up to 1 MB) per PutAuditEvents request.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
channelArn	string	The ARN or ID (the ARN suffix) of a channel.
region	string	AWS region (default: us-east-1)
externalId	string	A unique identifier that is conditionally required when the channel's resource policy includes an external ID. This value can be any string, such as a passphrase or account number.

REPLACE examples

put_audit_events

Ingests your application events into CloudTrail Lake. A required parameter, auditEvents, accepts the JSON records (also called payload) of events that you want CloudTrail to ingest. You can add up to 100 of these events (or up to 1 MB) per PutAuditEvents request.

REPLACE aws.cloudtrail_data.audit_events
SET 
auditEvents = '{{ auditEvents }}'
WHERE 
channelArn = '{{ channelArn }}' --required
AND region = '{{ region }}' --required
AND auditEvents = '{{ auditEvents }}' --required
AND externalId = '{{ externalId}}'
RETURNING
failed,
successful;