sink_policies

Creates, updates, deletes, gets or lists a sink_policies resource.

Overview

Name	sink_policies
Type	Resource
Id	aws.oam.sink_policies

Fields

The following fields are returned by SELECT queries:

get_sink_policy

Name	Datatype	Description
policy	string	The policy that you specified, in JSON format.
sink_arn	string	The ARN of the sink.
sink_id	string	The random ID string that Amazon Web Services generated as part of the sink ARN.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_sink_policy	select	region		Returns the current sink policy attached to this sink. The sink policy specifies what accounts can attach to this sink as source accounts, and what types of data they can share.
put_sink_policy	replace	region, SinkIdentifier		Creates or updates the resource policy that grants permissions to source accounts to link to the monitoring account sink. When you create a sink policy, you can grant permissions to all accounts in an organization or to individual accounts. You can also use a sink policy to limit the types of data that is shared. The six types of services with their respective resource types that you can allow or deny are: Metrics - Specify with AWS::CloudWatch::Metric Log groups - Specify with AWS::Logs::LogGroup Traces - Specify with AWS::XRay::Trace Application Insights - Applications - Specify with AWS::ApplicationInsights::Application Internet Monitor - Specify with AWS::InternetMonitor::Monitor Application Signals - Specify with AWS::ApplicationSignals::Service and AWS::ApplicationSignals::ServiceLevelObjective See the examples in this section to see how to specify permitted source accounts and data types.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
region	string	AWS region (default: us-east-1)

SELECT examples

get_sink_policy

Returns the current sink policy attached to this sink. The sink policy specifies what accounts can attach to this sink as source accounts, and what types of data they can share.

SELECT
policy,
sink_arn,
sink_id
FROM aws.oam.sink_policies
WHERE region = '{{ region }}' -- required
;

REPLACE examples

put_sink_policy

Creates or updates the resource policy that grants permissions to source accounts to link to the monitoring account sink. When you create a sink policy, you can grant permissions to all accounts in an organization or to individual accounts. You can also use a sink policy to limit the types of data that is shared. The six types of services with their respective resource types that you can allow or deny are: Metrics - Specify with AWS::CloudWatch::Metric Log groups - Specify with AWS::Logs::LogGroup Traces - Specify with AWS::XRay::Trace Application Insights - Applications - Specify with AWS::ApplicationInsights::Application Internet Monitor - Specify with AWS::InternetMonitor::Monitor Application Signals - Specify with AWS::ApplicationSignals::Service and AWS::ApplicationSignals::ServiceLevelObjective See the examples in this section to see how to specify permitted source accounts and data types.

REPLACE aws.oam.sink_policies
SET 
Policy = '{{ Policy }}',
SinkIdentifier = '{{ SinkIdentifier }}'
WHERE 
region = '{{ region }}' --required
AND SinkIdentifier = '{{ SinkIdentifier }}' --required
RETURNING
policy,
sink_arn,
sink_id;