resource_policies

Creates, updates, deletes, gets or lists a resource_policies resource.

Overview

Name	resource_policies
Type	Resource
Id	aws.logs.resource_policies

Fields

The following fields are returned by SELECT queries:

describe_resource_policies

Name	Datatype	Description
last_updated_time	integer (int64)	Timestamp showing when this policy was last updated, expressed as the number of milliseconds after Jan 1, 1970 00:00:00 UTC.
policy_document	string	The details of the policy.
policy_name	string	The name of the resource policy.
policy_scope	string	Specifies scope of the resource policy. Valid values are ACCOUNT or RESOURCE. (ACCOUNT, RESOURCE)
resource_arn	string	The ARN of the CloudWatch Logs resource to which the resource policy is attached. Only populated for resource-scoped policies.
revision_id	string	The revision ID of the resource policy. Only populated for resource-scoped policies.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
describe_resource_policies	select	region		Lists the resource policies in this account.
put_resource_policy	replace	region		Creates or updates a resource policy allowing other Amazon Web Services services to put log events to this account, such as Amazon Route 53. This API has the following restrictions: Supported actions - Policy only supports logs:PutLogEvents and logs:CreateLogStream actions Supported principals - Policy only applies when operations are invoked by Amazon Web Services service principals (not IAM users, roles, or cross-account principals Policy limits - An account can have a maximum of 10 policies without resourceARN and one per LogGroup resourceARN Resource policies with actions invoked by non-Amazon Web Services service principals (such as IAM users, roles, or other Amazon Web Services accounts) will not be enforced. For access control involving these principals, use the IAM policies.
delete_resource_policy	delete	region		Deletes a resource policy from this account. This revokes the access of the identities in that policy to put log events to this account.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
region	string	AWS region (default: us-east-1)

SELECT examples

describe_resource_policies

Lists the resource policies in this account.

SELECT
last_updated_time,
policy_document,
policy_name,
policy_scope,
resource_arn,
revision_id
FROM aws.logs.resource_policies
WHERE region = '{{ region }}' -- required
;

REPLACE examples

put_resource_policy

Creates or updates a resource policy allowing other Amazon Web Services services to put log events to this account, such as Amazon Route 53. This API has the following restrictions: Supported actions - Policy only supports logs:PutLogEvents and logs:CreateLogStream actions Supported principals - Policy only applies when operations are invoked by Amazon Web Services service principals (not IAM users, roles, or cross-account principals Policy limits - An account can have a maximum of 10 policies without resourceARN and one per LogGroup resourceARN Resource policies with actions invoked by non-Amazon Web Services service principals (such as IAM users, roles, or other Amazon Web Services accounts) will not be enforced. For access control involving these principals, use the IAM policies.

REPLACE aws.logs.resource_policies
SET 
policyName = '{{ policyName }}',
policyDocument = '{{ policyDocument }}',
resourceArn = '{{ resourceArn }}',
expectedRevisionId = '{{ expectedRevisionId }}'
WHERE 
region = '{{ region }}' --required
RETURNING
resource_policy,
revision_id;

DELETE examples

delete_resource_policy

Deletes a resource policy from this account. This revokes the access of the identities in that policy to put log events to this account.

DELETE FROM aws.logs.resource_policies
WHERE region = '{{ region }}' --required
;