destinations

Creates, updates, deletes, gets or lists a destinations resource.

Overview

Name	destinations
Type	Resource
Id	aws.logs.destinations

Fields

The following fields are returned by SELECT queries:

describe_destinations

Name	Datatype	Description
access_policy	string	An IAM policy document that governs which Amazon Web Services accounts can create subscription filters against this destination.
arn	string	The ARN of this destination.
creation_time	integer (int64)	The creation time of the destination, expressed as the number of milliseconds after Jan 1, 1970 00:00:00 UTC.
destination_name	string	The name of the destination. (pattern: <code>[^:]</code>)
role_arn	string	A role for impersonation, used when delivering log events to the target.
target_arn	string	The Amazon Resource Name (ARN) of the physical target where the log events are delivered (for example, a Kinesis stream).

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
describe_destinations	select	region		Lists all your destinations. The results are ASCII-sorted by destination name.
put_destination	replace	region, destinationName, targetArn, roleArn		Creates or updates a destination. This operation is used only to create destinations for cross-account subscriptions. A destination encapsulates a physical resource (such as an Amazon Kinesis stream). With a destination, you can subscribe to a real-time stream of log events for a different account, ingested using PutLogEvents. Through an access policy, a destination controls what is written to it. By default, PutDestination does not set any access policy with the destination, which means a cross-account user cannot call PutSubscriptionFilter against this destination. To enable this, the destination owner must call PutDestinationPolicy after PutDestination. To perform a PutDestination operation, you must also have the iam:PassRole permission.
put_destination_policy	replace	region, destinationName, accessPolicy		Creates or updates an access policy associated with an existing destination. An access policy is an IAM policy document that is used to authorize claims to register a subscription filter against a given destination.
delete_destination	delete	region		Deletes the specified destination, and eventually disables all the subscription filters that publish to it. This operation does not delete the physical resource encapsulated by the destination.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
region	string	AWS region (default: us-east-1)

SELECT examples

describe_destinations

Lists all your destinations. The results are ASCII-sorted by destination name.

SELECT
access_policy,
arn,
creation_time,
destination_name,
role_arn,
target_arn
FROM aws.logs.destinations
WHERE region = '{{ region }}' -- required
;

REPLACE examples

put_destination

Creates or updates a destination. This operation is used only to create destinations for cross-account subscriptions. A destination encapsulates a physical resource (such as an Amazon Kinesis stream). With a destination, you can subscribe to a real-time stream of log events for a different account, ingested using PutLogEvents. Through an access policy, a destination controls what is written to it. By default, PutDestination does not set any access policy with the destination, which means a cross-account user cannot call PutSubscriptionFilter against this destination. To enable this, the destination owner must call PutDestinationPolicy after PutDestination. To perform a PutDestination operation, you must also have the iam:PassRole permission.

REPLACE aws.logs.destinations
SET 
destinationName = '{{ destinationName }}',
targetArn = '{{ targetArn }}',
roleArn = '{{ roleArn }}',
tags = '{{ tags }}'
WHERE 
region = '{{ region }}' --required
AND destinationName = '{{ destinationName }}' --required
AND targetArn = '{{ targetArn }}' --required
AND roleArn = '{{ roleArn }}' --required
RETURNING
destination;

put_destination_policy

Creates or updates an access policy associated with an existing destination. An access policy is an IAM policy document that is used to authorize claims to register a subscription filter against a given destination.

REPLACE aws.logs.destinations
SET 
destinationName = '{{ destinationName }}',
accessPolicy = '{{ accessPolicy }}',
forceUpdate = {{ forceUpdate }}
WHERE 
region = '{{ region }}' --required
AND destinationName = '{{ destinationName }}' --required
AND accessPolicy = '{{ accessPolicy }}' --required;

DELETE examples

delete_destination

Deletes the specified destination, and eventually disables all the subscription filters that publish to it. This operation does not delete the physical resource encapsulated by the destination.

DELETE FROM aws.logs.destinations
WHERE region = '{{ region }}' --required
;