From 3bf5ed50c54615c0e8dfa345234981eb4a96f7c4 Mon Sep 17 00:00:00 2001 From: awstools Date: Wed, 10 Jan 2024 19:15:57 +0000 Subject: [PATCH] feat(client-cloudwatch-logs): Add support for account level subscription filter policies to PutAccountPolicy, DescribeAccountPolicies, and DeleteAccountPolicy APIs. Additionally, PutAccountPolicy has been modified with new optional "selectionCriteria" parameter for resource selection. --- .../commands/DeleteAccountPolicyCommand.ts | 19 ++++- .../DescribeAccountPoliciesCommand.ts | 5 +- .../src/commands/PutAccountPolicyCommand.ts | 50 +++++++++-- .../src/commands/StartLiveTailCommand.ts | 3 + .../src/models/models_0.ts | 82 +++++++++++++++++-- .../aws-models/cloudwatch-logs.json | 41 +++++++--- 6 files changed, 170 insertions(+), 30 deletions(-) diff --git a/clients/client-cloudwatch-logs/src/commands/DeleteAccountPolicyCommand.ts b/clients/client-cloudwatch-logs/src/commands/DeleteAccountPolicyCommand.ts index 9add49ec8baed..80d77f2dd6eb4 100644 --- a/clients/client-cloudwatch-logs/src/commands/DeleteAccountPolicyCommand.ts +++ b/clients/client-cloudwatch-logs/src/commands/DeleteAccountPolicyCommand.ts @@ -28,9 +28,20 @@ export interface DeleteAccountPolicyCommandOutput extends __MetadataBearer {} /** * @public - *

Deletes a CloudWatch Logs account policy.

- *

To use this operation, you must be signed on with the logs:DeleteDataProtectionPolicy and - * logs:DeleteAccountPolicy permissions.

+ *

Deletes a CloudWatch Logs account policy. This stops the policy from applying to all log groups + * or a subset of log groups in the account. Log-group level policies will still be in effect.

+ *

To use this operation, you must be signed on with the correct permissions depending on the type of policy + * that you are deleting.

+ * * @example * Use a bare-bones client and the command you need to make an API call. * ```javascript @@ -39,7 +50,7 @@ export interface DeleteAccountPolicyCommandOutput extends __MetadataBearer {} * const client = new CloudWatchLogsClient(config); * const input = { // DeleteAccountPolicyRequest * policyName: "STRING_VALUE", // required - * policyType: "DATA_PROTECTION_POLICY", // required + * policyType: "DATA_PROTECTION_POLICY" || "SUBSCRIPTION_FILTER_POLICY", // required * }; * const command = new DeleteAccountPolicyCommand(input); * const response = await client.send(command); diff --git a/clients/client-cloudwatch-logs/src/commands/DescribeAccountPoliciesCommand.ts b/clients/client-cloudwatch-logs/src/commands/DescribeAccountPoliciesCommand.ts index 8aff2b3a7fea9..25ec479d5f991 100644 --- a/clients/client-cloudwatch-logs/src/commands/DescribeAccountPoliciesCommand.ts +++ b/clients/client-cloudwatch-logs/src/commands/DescribeAccountPoliciesCommand.ts @@ -36,7 +36,7 @@ export interface DescribeAccountPoliciesCommandOutput extends DescribeAccountPol * // const { CloudWatchLogsClient, DescribeAccountPoliciesCommand } = require("@aws-sdk/client-cloudwatch-logs"); // CommonJS import * const client = new CloudWatchLogsClient(config); * const input = { // DescribeAccountPoliciesRequest - * policyType: "DATA_PROTECTION_POLICY", // required + * policyType: "DATA_PROTECTION_POLICY" || "SUBSCRIPTION_FILTER_POLICY", // required * policyName: "STRING_VALUE", * accountIdentifiers: [ // AccountIds * "STRING_VALUE", @@ -50,8 +50,9 @@ export interface DescribeAccountPoliciesCommandOutput extends DescribeAccountPol * // policyName: "STRING_VALUE", * // policyDocument: "STRING_VALUE", * // lastUpdatedTime: Number("long"), - * // policyType: "DATA_PROTECTION_POLICY", + * // policyType: "DATA_PROTECTION_POLICY" || "SUBSCRIPTION_FILTER_POLICY", * // scope: "ALL", + * // selectionCriteria: "STRING_VALUE", * // accountId: "STRING_VALUE", * // }, * // ], diff --git a/clients/client-cloudwatch-logs/src/commands/PutAccountPolicyCommand.ts b/clients/client-cloudwatch-logs/src/commands/PutAccountPolicyCommand.ts index 1991ab4412bb2..16b86d2c88ddc 100644 --- a/clients/client-cloudwatch-logs/src/commands/PutAccountPolicyCommand.ts +++ b/clients/client-cloudwatch-logs/src/commands/PutAccountPolicyCommand.ts @@ -28,15 +28,20 @@ export interface PutAccountPolicyCommandOutput extends PutAccountPolicyResponse, /** * @public - *

Creates an account-level data protection policy that applies to all log groups in the account. A data protection policy can help safeguard sensitive + *

Creates an account-level data protection policy or subscription filter policy that applies to all log groups + * or a subset of log groups in the account.

+ *

+ * Data protection policy + *

+ *

A data protection policy can help safeguard sensitive * data that's ingested by your log groups by auditing and masking the sensitive log data. Each account can have only - * one account-level policy.

+ * one account-level data protection policy.

* *

Sensitive data is detected and masked when it is ingested into a log group. When you set a * data protection policy, log events ingested into the log groups before that time are not masked.

* *

If you use PutAccountPolicy to create a data protection policy for your whole account, it applies to both existing log groups - * and all log groups that are created later in this account. The account policy is applied to existing log groups + * and all log groups that are created later in this account. The account-level policy is applied to existing log groups * with eventual consistency. It might take up to 5 minutes before sensitive data in existing log groups begins to be masked.

*

By default, when a user views a log event that includes masked data, the sensitive data is replaced by asterisks. * A user who has the logs:Unmask permission can use a @@ -47,14 +52,43 @@ export interface PutAccountPolicyCommandOutput extends PutAccountPolicyResponse, * console by running a CloudWatch Logs Insights query with the unmask query command.

*

For more information, including a list of types of data that can be audited and masked, see * Protect sensitive log data with masking.

- *

To use the PutAccountPolicy operation, you must be signed on with the logs:PutDataProtectionPolicy + *

To use the PutAccountPolicy operation for a data protection policy, you must be signed on with + * the logs:PutDataProtectionPolicy * and logs:PutAccountPolicy permissions.

- *

The PutAccountPolicy operation applies to all log groups in the account. You can also use + *

The PutAccountPolicy operation applies to all log groups in the account. You can use * PutDataProtectionPolicy * to create a data protection policy that applies to just one log group. * If a log group has its own data protection policy and * the account also has an account-level data protection policy, then the two policies are cumulative. Any sensitive term * specified in either policy is masked.

+ *

+ * Subscription filter policy + *

+ *

A subscription filter policy sets up a real-time feed of log events from CloudWatch Logs to other Amazon Web Services services. + * Account-level subscription filter policies apply to both existing log groups and log groups that are created later in + * this account. Supported destinations are Kinesis Data Streams, Kinesis Data Firehose, and + * Lambda. When log events are sent to the receiving service, they are Base64 encoded and + * compressed with the GZIP format.

+ *

The following destinations are supported for subscription filters:

+ * + *

Each account can have one account-level subscription filter policy. + * If you are updating an existing filter, you must specify the correct name in PolicyName. + * To perform a PutAccountPolicy subscription filter operation for any destination except a Lambda + * function, you must also have the iam:PassRole permission.

* @example * Use a bare-bones client and the command you need to make an API call. * ```javascript @@ -64,8 +98,9 @@ export interface PutAccountPolicyCommandOutput extends PutAccountPolicyResponse, * const input = { // PutAccountPolicyRequest * policyName: "STRING_VALUE", // required * policyDocument: "STRING_VALUE", // required - * policyType: "DATA_PROTECTION_POLICY", // required + * policyType: "DATA_PROTECTION_POLICY" || "SUBSCRIPTION_FILTER_POLICY", // required * scope: "ALL", + * selectionCriteria: "STRING_VALUE", * }; * const command = new PutAccountPolicyCommand(input); * const response = await client.send(command); @@ -74,8 +109,9 @@ export interface PutAccountPolicyCommandOutput extends PutAccountPolicyResponse, * // policyName: "STRING_VALUE", * // policyDocument: "STRING_VALUE", * // lastUpdatedTime: Number("long"), - * // policyType: "DATA_PROTECTION_POLICY", + * // policyType: "DATA_PROTECTION_POLICY" || "SUBSCRIPTION_FILTER_POLICY", * // scope: "ALL", + * // selectionCriteria: "STRING_VALUE", * // accountId: "STRING_VALUE", * // }, * // }; diff --git a/clients/client-cloudwatch-logs/src/commands/StartLiveTailCommand.ts b/clients/client-cloudwatch-logs/src/commands/StartLiveTailCommand.ts index 1ea00e0b6c0a7..26f05885cffda 100644 --- a/clients/client-cloudwatch-logs/src/commands/StartLiveTailCommand.ts +++ b/clients/client-cloudwatch-logs/src/commands/StartLiveTailCommand.ts @@ -70,6 +70,9 @@ export interface StartLiveTailCommandOutput extends StartLiveTailResponse, __Met *

You can end a session before it times out by closing the session stream or by closing the client that is receiving the * stream. The session also ends if the established connection between the client and the server breaks.

* + *

For examples of using an SDK to start a Live Tail session, see + * + * Start a Live Tail session using an Amazon Web Services SDK.

* @example * Use a bare-bones client and the command you need to make an API call. * ```javascript diff --git a/clients/client-cloudwatch-logs/src/models/models_0.ts b/clients/client-cloudwatch-logs/src/models/models_0.ts index cd784ed23472b..670bba90aa363 100644 --- a/clients/client-cloudwatch-logs/src/models/models_0.ts +++ b/clients/client-cloudwatch-logs/src/models/models_0.ts @@ -29,6 +29,7 @@ export class AccessDeniedException extends __BaseException { */ export const PolicyType = { DATA_PROTECTION_POLICY: "DATA_PROTECTION_POLICY", + SUBSCRIPTION_FILTER_POLICY: "SUBSCRIPTION_FILTER_POLICY", } as const; /** @@ -85,6 +86,12 @@ export interface AccountPolicy { */ scope?: Scope; + /** + * @public + *

The log group selection criteria for this subscription filter policy.

+ */ + selectionCriteria?: string; + /** * @public *

The Amazon Web Services account ID that the policy applies to.

@@ -970,7 +977,7 @@ export interface CreateLogGroupRequest { * *

If you omit this parameter, the default of STANDARD is used.

* - *

After a log group is created, its class can't be changed.

+ *

The value of logGroupClass can't be changed after a log group is created.

* *

For details about the features supported by each class, see * Log classes @@ -1053,7 +1060,7 @@ export interface DeleteAccountPolicyRequest { /** * @public - *

The type of policy to delete. Currently, the only valid value is DATA_PROTECTION_POLICY.

+ *

The type of policy to delete.

*/ policyType: PolicyType | undefined; } @@ -1431,7 +1438,7 @@ export interface DescribeAccountPoliciesRequest { /** * @public *

Use this parameter to limit the returned policies to only the policies that match the policy type that you - * specify. Currently, the only valid value is DATA_PROTECTION_POLICY.

+ * specify.

*/ policyType: PolicyType | undefined; @@ -3885,8 +3892,11 @@ export interface PutAccountPolicyRequest { /** * @public - *

Specify the data protection policy, in JSON.

- *

This policy must include two JSON blocks:

+ *

Specify the policy, in JSON.

+ *

+ * Data protection policy + *

+ *

A data protection policy must include two JSON blocks:

*