Skip to main content

import_tasks

Creates, updates, deletes, gets or lists an import_tasks resource.

Overview​

Nameimport_tasks
TypeResource
Idaws.logs.import_tasks

Fields​

The following fields are returned by SELECT queries:

NameDatatypeDescription
importsarrayThe list of import tasks that match the request filters.
next_tokenstringThe token for the next set of items to return. The token expires after 24 hours.

Methods​

The following methods are available for this resource:

NameAccessible byRequired ParamsOptional ParamsDescription
describe_import_tasksselectregionLists and describes import tasks, with optional filtering by import status and source ARN.
create_import_taskinsertregion, importSourceArn, importRoleArnStarts an import from a data source to CloudWatch Log and creates a managed log group as the destination for the imported data. Currently, CloudTrail Event Data Store is the only supported data source. The import task must satisfy the following constraints: The specified source must be in an ACTIVE state. The API caller must have permissions to access the data in the provided source and to perform iam:PassRole on the provided import role which has the same permissions, as described below. The provided IAM role must trust the "cloudtrail.amazonaws.com" principal and have the following permissions: cloudtrail:GetEventDataStoreData logs:CreateLogGroup logs:CreateLogStream logs:PutResourcePolicy (If source has an associated Amazon Web Services KMS Key) kms:Decrypt (If source has an associated Amazon Web Services KMS Key) kms:GenerateDataKey Example IAM policy for provided import role: [ { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::123456789012:role/apiCallerCredentials", "Condition": { "StringLike": { "iam:AssociatedResourceARN": "arn:aws:logs:us-east-1:123456789012:log-group:aws/cloudtrail/f1d45bff-d0e3-4868-b5d9-2eb678aa32fb:" } } }, { "Effect": "Allow", "Action": [ "cloudtrail:GetEventDataStoreData" ], "Resource": [ "arn:aws:cloudtrail:us-east-1:123456789012:eventdatastore/f1d45bff-d0e3-4868-b5d9-2eb678aa32fb" ] }, { "Effect": "Allow", "Action": [ "logs:CreateImportTask", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutResourcePolicy" ], "Resource": [ "arn:aws:logs:us-east-1:123456789012:log-group:/aws/cloudtrail/" ] }, { "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:GenerateDataKey" ], "Resource": [ "arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012" ] } ] If the import source has a customer managed key, the "cloudtrail.amazonaws.com" principal needs permissions to perform kms:Decrypt and kms:GenerateDataKey. There can be no more than 3 active imports per account at a given time. The startEventTime must be less than or equal to endEventTime. The data being imported must be within the specified source's retention period.

Parameters​

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

NameDatatypeDescription
regionstringAWS region (default: us-east-1)

SELECT examples​

Lists and describes import tasks, with optional filtering by import status and source ARN.

SELECT
imports,
next_token
FROM aws.logs.import_tasks
WHERE region = '{{ region }}' -- required
;

INSERT examples​

Starts an import from a data source to CloudWatch Log and creates a managed log group as the destination for the imported data. Currently, CloudTrail Event Data Store is the only supported data source. The import task must satisfy the following constraints: The specified source must be in an ACTIVE state. The API caller must have permissions to access the data in the provided source and to perform iam:PassRole on the provided import role which has the same permissions, as described below. The provided IAM role must trust the "cloudtrail.amazonaws.com" principal and have the following permissions: cloudtrail:GetEventDataStoreData logs:CreateLogGroup logs:CreateLogStream logs:PutResourcePolicy (If source has an associated Amazon Web Services KMS Key) kms:Decrypt (If source has an associated Amazon Web Services KMS Key) kms:GenerateDataKey Example IAM policy for provided import role: [ { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::123456789012:role/apiCallerCredentials", "Condition": { "StringLike": { "iam:AssociatedResourceARN": "arn:aws:logs:us-east-1:123456789012:log-group:aws/cloudtrail/f1d45bff-d0e3-4868-b5d9-2eb678aa32fb:" } } }, { "Effect": "Allow", "Action": [ "cloudtrail:GetEventDataStoreData" ], "Resource": [ "arn:aws:cloudtrail:us-east-1:123456789012:eventdatastore/f1d45bff-d0e3-4868-b5d9-2eb678aa32fb" ] }, { "Effect": "Allow", "Action": [ "logs:CreateImportTask", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutResourcePolicy" ], "Resource": [ "arn:aws:logs:us-east-1:123456789012:log-group:/aws/cloudtrail/" ] }, { "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:GenerateDataKey" ], "Resource": [ "arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012" ] } ] If the import source has a customer managed key, the "cloudtrail.amazonaws.com" principal needs permissions to perform kms:Decrypt and kms:GenerateDataKey. There can be no more than 3 active imports per account at a given time. The startEventTime must be less than or equal to endEventTime. The data being imported must be within the specified source's retention period.

INSERT INTO aws.logs.import_tasks (
importSourceArn,
importRoleArn,
importFilter,
region
)
SELECT 
'{{ importSourceArn }}' /* required */,
'{{ importRoleArn }}' /* required */,
'{{ importFilter }}',
'{{ region }}'
RETURNING
creation_time,
import_destination_arn,
import_id
;
Last updated on