aws-sdk-cloudtrail 1.113.0 → 1.114.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5fde2ce5f7584992769508427c9ce13d46f9b6e22287798721a43f2a03173fa1
-  data.tar.gz: f5099dd33319dcf3bfb8f880401addb95beb1f1b14c96c5578e9157362190d34
+  metadata.gz: 71a61e3c0704861fffcc08f729a200ebe801162783fe49524d501ff4635e6119
+  data.tar.gz: 8a0a3bd92ab177c5e5e0ecce47031a5189408939381c0d3f3aa420142b551630
 SHA512:
-  metadata.gz: 77f5c0395476dcc053ec67192a0c2f7bb4661e37444dbebd3561c3684cc947cc14c85ea76e86ce04134df5420d9c70108fa5620a20ba2786548e2261993c4a03
-  data.tar.gz: 10245274f396f48e61e1ee3e8f2eb011a0513cd9d5e656b1a84df68051be795005073f57d6fbf0da41d053d9a0f3efc1372ca6711165883a7c188cb5e6f50c74
+  metadata.gz: 875af53c2791f73e33ee181087b2f32abea6679c59bf2a673f793339b154a72c39e137cf224b7d9195bd4d3838f7d7c826014708d58320bb90efa4ed5572bbde
+  data.tar.gz: b0a458c66be02376025bcf6ae8d5934353edd17dcd51c9f78d44134e971d142afca6abdd0b9aaf876f9cbf824b3dc3bcb3d1696e63d159816be135c57ddd20f6

data/CHANGELOG.md

@@ -1,6 +1,11 @@
 Unreleased Changes
 ------------------
 
+1.114.0 (2025-11-19)
+------------------
+
+* Feature - AWS CloudTrail now supports Insights for data events, expanding beyond management events to automatically detect unusual activity on data plane operations.
+
 1.113.0 (2025-10-24)
 ------------------
 

data/VERSION

@@ -1 +1 @@
-1.113.0
+1.114.0

data/lib/aws-sdk-cloudtrail/client.rb

@@ -1098,10 +1098,10 @@ module Aws::CloudTrail
     #   account.
     #
     # @option params [String] :kms_key_id
-    #   Specifies the KMS key ID to use to encrypt the logs delivered by
-    #   CloudTrail. The value can be an alias name prefixed by `alias/`, a
-    #   fully specified ARN to an alias, a fully specified ARN to a key, or a
-    #   globally unique identifier.
+    #   Specifies the KMS key ID to use to encrypt the logs and digest files
+    #   delivered by CloudTrail. The value can be an alias name prefixed by
+    #   `alias/`, a fully specified ARN to an alias, a fully specified ARN to
+    #   a key, or a globally unique identifier.
     #
     #   CloudTrail also supports KMS multi-Region keys. For more information
     #   about multi-Region keys, see [Using multi-Region keys][1] in the *Key
@@ -1314,6 +1314,24 @@ module Aws::CloudTrail
     # shadow trails (replicated trails in other Regions) of a trail that is
     # enabled in all Regions.
     #
+    # While deleting a CloudTrail trail is an irreversible action,
+    # CloudTrail does not delete log files in the Amazon S3 bucket for that
+    # trail, the Amazon S3 bucket itself, or the CloudWatchlog group to
+    # which the trail delivers events. Deleting a multi-Region trail will
+    # stop logging of events in all Amazon Web Services Regions enabled in
+    # your Amazon Web Services account. Deleting a single-Region trail will
+    # stop logging of events in that Region only. It will not stop logging
+    # of events in other Regions even if the trails in those other Regions
+    # have identical names to the deleted trail.
+    #
+    #  For information about account closure and deletion of CloudTrail
+    # trails, see
+    # [https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-account-closure.html][1].
+    #
+    #
+    #
+    # [1]: https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-account-closure.html
+    #
     # @option params [required, String] :name
     #   Specifies the name or the CloudTrail ARN of the trail to be deleted.
     #   The following is the format of a trail ARN.
@@ -2064,10 +2082,10 @@ module Aws::CloudTrail
 
     # Describes the settings for the Insights event selectors that you
     # configured for your trail or event data store. `GetInsightSelectors`
-    # shows if CloudTrail Insights event logging is enabled on the trail or
-    # event data store, and if it is, which Insights types are enabled. If
-    # you run `GetInsightSelectors` on a trail or event data store that does
-    # not have Insights events enabled, the operation throws the exception
+    # shows if CloudTrail Insights logging is enabled and which Insights
+    # types are configured with corresponding event categories. If you run
+    # `GetInsightSelectors` on a trail or event data store that does not
+    # have Insights events enabled, the operation throws the exception
     # `InsightNotEnabledException`
     #
     # Specify either the `EventDataStore` parameter to get Insights event
@@ -2129,6 +2147,8 @@ module Aws::CloudTrail
     #   resp.trail_arn #=> String
     #   resp.insight_selectors #=> Array
     #   resp.insight_selectors[0].insight_type #=> String, one of "ApiCallRateInsight", "ApiErrorRateInsight"
+    #   resp.insight_selectors[0].event_categories #=> Array
+    #   resp.insight_selectors[0].event_categories[0] #=> String, one of "Management", "Data"
     #   resp.event_data_store_arn #=> String
     #   resp.insights_destination #=> String
     #
@@ -2610,6 +2630,106 @@ module Aws::CloudTrail
       req.send_request(options)
     end
 
+    # Returns Insights events generated on a trail that logs data events.
+    # You can list Insights events that occurred in a Region within the last
+    # 90 days.
+    #
+    # ListInsightsData supports the following Dimensions for Insights
+    # events:
+    #
+    # * Event ID
+    #
+    # * Event name
+    #
+    # * Event source
+    #
+    # All dimensions are optional. The default number of results returned is
+    # 50, with a maximum of 50 possible. The response includes a token that
+    # you can use to get the next page of results.
+    #
+    # The rate of ListInsightsData requests is limited to two per second,
+    # per account, per Region. If this limit is exceeded, a throttling error
+    # occurs.
+    #
+    # @option params [required, String] :insight_source
+    #   The Amazon Resource Name(ARN) of the trail for which you want to
+    #   retrieve Insights events.
+    #
+    # @option params [required, String] :data_type
+    #   Specifies the category of events returned. To fetch Insights events,
+    #   specify `InsightsEvents` as the value of `DataType`
+    #
+    # @option params [Hash<String,String>] :dimensions
+    #   Contains a map of dimensions. Currently the map can contain only one
+    #   item.
+    #
+    # @option params [Time,DateTime,Date,Integer,String] :start_time
+    #   Specifies that only events that occur after or at the specified time
+    #   are returned. If the specified start time is after the specified end
+    #   time, an error is returned.
+    #
+    # @option params [Time,DateTime,Date,Integer,String] :end_time
+    #   Specifies that only events that occur before or at the specified time
+    #   are returned. If the specified end time is before the specified start
+    #   time, an error is returned.
+    #
+    # @option params [Integer] :max_results
+    #   The number of events to return. Possible values are 1 through 50. The
+    #   default is 50.
+    #
+    # @option params [String] :next_token
+    #   The token to use to get the next page of results after a previous API
+    #   call. This token must be passed in with the same parameters that were
+    #   specified in the original call. For example, if the original call
+    #   specified a EventName as a dimension with `PutObject` as a value, the
+    #   call with NextToken should include those same parameters.
+    #
+    # @return [Types::ListInsightsDataResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::ListInsightsDataResponse#events #events} => Array&lt;Types::Event&gt;
+    #   * {Types::ListInsightsDataResponse#next_token #next_token} => String
+    #
+    # The returned {Seahorse::Client::Response response} is a pageable response and is Enumerable. For details on usage see {Aws::PageableResponse PageableResponse}.
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.list_insights_data({
+    #     insight_source: "ResourceArn", # required
+    #     data_type: "InsightsEvents", # required, accepts InsightsEvents
+    #     dimensions: {
+    #       "EventId" => "ListInsightsDataDimensionValue",
+    #     },
+    #     start_time: Time.now,
+    #     end_time: Time.now,
+    #     max_results: 1,
+    #     next_token: "PaginationToken",
+    #   })
+    #
+    # @example Response structure
+    #
+    #   resp.events #=> Array
+    #   resp.events[0].event_id #=> String
+    #   resp.events[0].event_name #=> String
+    #   resp.events[0].read_only #=> String
+    #   resp.events[0].access_key_id #=> String
+    #   resp.events[0].event_time #=> Time
+    #   resp.events[0].event_source #=> String
+    #   resp.events[0].username #=> String
+    #   resp.events[0].resources #=> Array
+    #   resp.events[0].resources[0].resource_type #=> String
+    #   resp.events[0].resources[0].resource_name #=> String
+    #   resp.events[0].cloud_trail_event #=> String
+    #   resp.next_token #=> String
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/cloudtrail-2013-11-01/ListInsightsData AWS API Documentation
+    #
+    # @overload list_insights_data(params = {})
+    # @param [Hash] params ({})
+    def list_insights_data(params = {}, options = {})
+      req = build_request(:list_insights_data, params)
+      req.send_request(options)
+    end
+
     # Returns Insights metrics data for trails that have enabled Insights.
     # The request must include the `EventSource`, `EventName`, and
     # `InsightType` parameters.
@@ -2629,9 +2749,28 @@ module Aws::CloudTrail
     # * Data points with a period of 3600 seconds (1 hour) are available for
     #   90 days.
     #
-    # Access to the `ListInsightsMetricData` API operation is linked to the
-    # `cloudtrail:LookupEvents` action. To use this operation, you must have
-    # permissions to perform the `cloudtrail:LookupEvents` action.
+    # To use `ListInsightsMetricData` operation, you must have the following
+    # permissions:
+    #
+    # * If `ListInsightsMetricData` is invoked with `TrailName` parameter,
+    #   access to the `ListInsightsMetricData` API operation is linked to
+    #   the `cloudtrail:LookupEvents` action and
+    #   `cloudtrail:ListInsightsData`. To use this operation, you must have
+    #   permissions to perform the `cloudtrail:LookupEvents` and
+    #   `cloudtrail:ListInsightsData` action on the specific trail.
+    #
+    # * If `ListInsightsMetricData` is invoked without `TrailName`
+    #   parameter, access to the `ListInsightsMetricData` API operation is
+    #   linked to the `cloudtrail:LookupEvents` action only. To use this
+    #   operation, you must have permissions to perform the
+    #   `cloudtrail:LookupEvents` action.
+    #
+    # @option params [String] :trail_name
+    #   The Amazon Resource Name(ARN) or name of the trail for which you want
+    #   to retrieve Insights metrics data. This parameter should only be
+    #   provided to fetch Insights metrics data generated on trails logging
+    #   data events. This parameter is not required for Insights metric data
+    #   generated on trails logging management events.
     #
     # @option params [required, String] :event_source
     #   The Amazon Web Services service to which the request was made, such as
@@ -2692,6 +2831,7 @@ module Aws::CloudTrail
     #
     # @return [Types::ListInsightsMetricDataResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
     #
+    #   * {Types::ListInsightsMetricDataResponse#trail_arn #trail_arn} => String
     #   * {Types::ListInsightsMetricDataResponse#event_source #event_source} => String
     #   * {Types::ListInsightsMetricDataResponse#event_name #event_name} => String
     #   * {Types::ListInsightsMetricDataResponse#insight_type #insight_type} => String
@@ -2705,6 +2845,7 @@ module Aws::CloudTrail
     # @example Request syntax with placeholder values
     #
     #   resp = client.list_insights_metric_data({
+    #     trail_name: "String",
     #     event_source: "EventSource", # required
     #     event_name: "EventName", # required
     #     insight_type: "ApiCallRateInsight", # required, accepts ApiCallRateInsight, ApiErrorRateInsight
@@ -2719,6 +2860,7 @@ module Aws::CloudTrail
     #
     # @example Response structure
     #
+    #   resp.trail_arn #=> String
     #   resp.event_source #=> String
     #   resp.event_name #=> String
     #   resp.insight_type #=> String, one of "ApiCallRateInsight", "ApiErrorRateInsight"
@@ -3346,12 +3488,18 @@ module Aws::CloudTrail
       req.send_request(options)
     end
 
-    # Lets you enable Insights event logging by specifying the Insights
-    # selectors that you want to enable on an existing trail or event data
-    # store. You also use `PutInsightSelectors` to turn off Insights event
-    # logging, by passing an empty list of Insights types. The valid
-    # Insights event types are `ApiErrorRateInsight` and
-    # `ApiCallRateInsight`.
+    # Lets you enable Insights event logging on specific event categories by
+    # specifying the Insights selectors that you want to enable on an
+    # existing trail or event data store. You also use `PutInsightSelectors`
+    # to turn off Insights event logging, by passing an empty list of
+    # Insights types. The valid Insights event types are
+    # `ApiErrorRateInsight` and `ApiCallRateInsight`, and valid
+    # EventCategories are `Management` and `Data`.
+    #
+    # <note markdown="1"> Insights on data events are not supported on event data stores. For
+    # event data stores, you can only enable Insights on management events.
+    #
+    #  </note>
     #
     # To enable Insights on an event data store, you must specify the ARNs
     # (or ID suffix of the ARNs) for the source event data store
@@ -3366,6 +3514,16 @@ module Aws::CloudTrail
     # (`TrailName`) of the CloudTrail trail for which you want to change or
     # add Insights selectors.
     #
+    # * For Management events Insights: To log CloudTrail Insights on the
+    #   API call rate, the trail or event data store must log `write`
+    #   management events. To log CloudTrail Insights on the API error rate,
+    #   the trail or event data store must log `read` or `write` management
+    #   events.
+    #
+    # * For Data events Insights: To log CloudTrail Insights on the API call
+    #   rate or API error rate, the trail must log `read` or `write` data
+    #   events. Data events Insights are not supported on event data store.
+    #
     # To log CloudTrail Insights events on API call volume, the trail or
     # event data store must log `write` management events. To log CloudTrail
     # Insights events on API error rate, the trail or event data store must
@@ -3389,17 +3547,19 @@ module Aws::CloudTrail
     #   `InsightsDestination` parameters.
     #
     # @option params [required, Array<Types::InsightSelector>] :insight_selectors
-    #   A JSON string that contains the Insights types you want to log on a
-    #   trail or event data store. `ApiCallRateInsight` and
-    #   `ApiErrorRateInsight` are valid Insight types.
+    #   Contains the Insights types you want to log on a specific category of
+    #   events on a trail or event data store. `ApiCallRateInsight` and
+    #   `ApiErrorRateInsight` are valid Insight types.The EventCategory field
+    #   can specify `Management` or `Data` events or both. For event data
+    #   store, you can log Insights for management events only.
     #
     #   The `ApiCallRateInsight` Insights type analyzes write-only management
-    #   API calls that are aggregated per minute against a baseline API call
-    #   volume.
+    #   API calls or read and write data API calls that are aggregated per
+    #   minute against a baseline API call volume.
     #
-    #   The `ApiErrorRateInsight` Insights type analyzes management API calls
-    #   that result in error codes. The error is shown if the API call is
-    #   unsuccessful.
+    #   The `ApiErrorRateInsight` Insights type analyzes management and data
+    #   API calls that result in error codes. The error is shown if the API
+    #   call is unsuccessful.
     #
     # @option params [String] :event_data_store
     #   The ARN (or ID suffix of the ARN) of the source event data store for
@@ -3431,6 +3591,7 @@ module Aws::CloudTrail
     #     insight_selectors: [ # required
     #       {
     #         insight_type: "ApiCallRateInsight", # accepts ApiCallRateInsight, ApiErrorRateInsight
+    #         event_categories: ["Management"], # accepts Management, Data
     #       },
     #     ],
     #     event_data_store: "EventDataStoreArn",
@@ -3442,6 +3603,8 @@ module Aws::CloudTrail
     #   resp.trail_arn #=> String
     #   resp.insight_selectors #=> Array
     #   resp.insight_selectors[0].insight_type #=> String, one of "ApiCallRateInsight", "ApiErrorRateInsight"
+    #   resp.insight_selectors[0].event_categories #=> Array
+    #   resp.insight_selectors[0].event_categories[0] #=> String, one of "Management", "Data"
     #   resp.event_data_store_arn #=> String
     #   resp.insights_destination #=> String
     #
@@ -4569,10 +4732,10 @@ module Aws::CloudTrail
     #   account.
     #
     # @option params [String] :kms_key_id
-    #   Specifies the KMS key ID to use to encrypt the logs delivered by
-    #   CloudTrail. The value can be an alias name prefixed by "alias/", a
-    #   fully specified ARN to an alias, a fully specified ARN to a key, or a
-    #   globally unique identifier.
+    #   Specifies the KMS key ID to use to encrypt the logs and digest files
+    #   delivered by CloudTrail. The value can be an alias name prefixed by
+    #   "alias/", a fully specified ARN to an alias, a fully specified ARN
+    #   to a key, or a globally unique identifier.
     #
     #   CloudTrail also supports KMS multi-Region keys. For more information
     #   about multi-Region keys, see [Using multi-Region keys][1] in the *Key
@@ -4685,7 +4848,7 @@ module Aws::CloudTrail
         tracer: tracer
       )
       context[:gem_name] = 'aws-sdk-cloudtrail'
-      context[:gem_version] = '1.113.0'
+      context[:gem_version] = '1.114.0'
       Seahorse::Client::Request.new(handlers, context)
     end
 

data/lib/aws-sdk-cloudtrail/client_api.rb

@@ -217,6 +217,13 @@ module Aws::CloudTrail
     ListImportsMaxResultsCount = Shapes::IntegerShape.new(name: 'ListImportsMaxResultsCount')
     ListImportsRequest = Shapes::StructureShape.new(name: 'ListImportsRequest')
     ListImportsResponse = Shapes::StructureShape.new(name: 'ListImportsResponse')
+    ListInsightsDataDimensionKey = Shapes::StringShape.new(name: 'ListInsightsDataDimensionKey')
+    ListInsightsDataDimensionValue = Shapes::StringShape.new(name: 'ListInsightsDataDimensionValue')
+    ListInsightsDataDimensions = Shapes::MapShape.new(name: 'ListInsightsDataDimensions')
+    ListInsightsDataMaxResultsCount = Shapes::IntegerShape.new(name: 'ListInsightsDataMaxResultsCount')
+    ListInsightsDataRequest = Shapes::StructureShape.new(name: 'ListInsightsDataRequest')
+    ListInsightsDataResponse = Shapes::StructureShape.new(name: 'ListInsightsDataResponse')
+    ListInsightsDataType = Shapes::StringShape.new(name: 'ListInsightsDataType')
     ListInsightsMetricDataRequest = Shapes::StructureShape.new(name: 'ListInsightsMetricDataRequest')
     ListInsightsMetricDataResponse = Shapes::StructureShape.new(name: 'ListInsightsMetricDataResponse')
     ListPublicKeysRequest = Shapes::StructureShape.new(name: 'ListPublicKeysRequest')
@@ -331,6 +338,8 @@ module Aws::CloudTrail
     ServiceQuotaExceededException = Shapes::StructureShape.new(name: 'ServiceQuotaExceededException')
     Source = Shapes::StringShape.new(name: 'Source')
     SourceConfig = Shapes::StructureShape.new(name: 'SourceConfig')
+    SourceEventCategories = Shapes::ListShape.new(name: 'SourceEventCategories')
+    SourceEventCategory = Shapes::StringShape.new(name: 'SourceEventCategory')
     StartDashboardRefreshRequest = Shapes::StructureShape.new(name: 'StartDashboardRefreshRequest')
     StartDashboardRefreshResponse = Shapes::StructureShape.new(name: 'StartDashboardRefreshResponse')
     StartEventDataStoreIngestionRequest = Shapes::StructureShape.new(name: 'StartEventDataStoreIngestionRequest')
@@ -885,6 +894,7 @@ module Aws::CloudTrail
     InsightNotEnabledException.struct_class = Types::InsightNotEnabledException
 
     InsightSelector.add_member(:insight_type, Shapes::ShapeRef.new(shape: InsightType, location_name: "InsightType"))
+    InsightSelector.add_member(:event_categories, Shapes::ShapeRef.new(shape: SourceEventCategories, location_name: "EventCategories"))
     InsightSelector.struct_class = Types::InsightSelector
 
     InsightSelectors.member = Shapes::ShapeRef.new(shape: InsightSelector)
@@ -1004,6 +1014,23 @@ module Aws::CloudTrail
     ListImportsResponse.add_member(:next_token, Shapes::ShapeRef.new(shape: PaginationToken, location_name: "NextToken"))
     ListImportsResponse.struct_class = Types::ListImportsResponse
 
+    ListInsightsDataDimensions.key = Shapes::ShapeRef.new(shape: ListInsightsDataDimensionKey)
+    ListInsightsDataDimensions.value = Shapes::ShapeRef.new(shape: ListInsightsDataDimensionValue)
+
+    ListInsightsDataRequest.add_member(:insight_source, Shapes::ShapeRef.new(shape: ResourceArn, required: true, location_name: "InsightSource"))
+    ListInsightsDataRequest.add_member(:data_type, Shapes::ShapeRef.new(shape: ListInsightsDataType, required: true, location_name: "DataType"))
+    ListInsightsDataRequest.add_member(:dimensions, Shapes::ShapeRef.new(shape: ListInsightsDataDimensions, location_name: "Dimensions"))
+    ListInsightsDataRequest.add_member(:start_time, Shapes::ShapeRef.new(shape: Date, location_name: "StartTime"))
+    ListInsightsDataRequest.add_member(:end_time, Shapes::ShapeRef.new(shape: Date, location_name: "EndTime"))
+    ListInsightsDataRequest.add_member(:max_results, Shapes::ShapeRef.new(shape: ListInsightsDataMaxResultsCount, location_name: "MaxResults"))
+    ListInsightsDataRequest.add_member(:next_token, Shapes::ShapeRef.new(shape: PaginationToken, location_name: "NextToken"))
+    ListInsightsDataRequest.struct_class = Types::ListInsightsDataRequest
+
+    ListInsightsDataResponse.add_member(:events, Shapes::ShapeRef.new(shape: EventsList, location_name: "Events"))
+    ListInsightsDataResponse.add_member(:next_token, Shapes::ShapeRef.new(shape: PaginationToken, location_name: "NextToken"))
+    ListInsightsDataResponse.struct_class = Types::ListInsightsDataResponse
+
+    ListInsightsMetricDataRequest.add_member(:trail_name, Shapes::ShapeRef.new(shape: String, location_name: "TrailName"))
     ListInsightsMetricDataRequest.add_member(:event_source, Shapes::ShapeRef.new(shape: EventSource, required: true, location_name: "EventSource"))
     ListInsightsMetricDataRequest.add_member(:event_name, Shapes::ShapeRef.new(shape: EventName, required: true, location_name: "EventName"))
     ListInsightsMetricDataRequest.add_member(:insight_type, Shapes::ShapeRef.new(shape: InsightType, required: true, location_name: "InsightType"))
@@ -1016,6 +1043,7 @@ module Aws::CloudTrail
     ListInsightsMetricDataRequest.add_member(:next_token, Shapes::ShapeRef.new(shape: InsightsMetricNextToken, location_name: "NextToken"))
     ListInsightsMetricDataRequest.struct_class = Types::ListInsightsMetricDataRequest
 
+    ListInsightsMetricDataResponse.add_member(:trail_arn, Shapes::ShapeRef.new(shape: String, location_name: "TrailARN"))
     ListInsightsMetricDataResponse.add_member(:event_source, Shapes::ShapeRef.new(shape: EventSource, location_name: "EventSource"))
     ListInsightsMetricDataResponse.add_member(:event_name, Shapes::ShapeRef.new(shape: EventName, location_name: "EventName"))
     ListInsightsMetricDataResponse.add_member(:insight_type, Shapes::ShapeRef.new(shape: InsightType, location_name: "InsightType"))
@@ -1285,6 +1313,8 @@ module Aws::CloudTrail
     SourceConfig.add_member(:advanced_event_selectors, Shapes::ShapeRef.new(shape: AdvancedEventSelectors, location_name: "AdvancedEventSelectors"))
     SourceConfig.struct_class = Types::SourceConfig
 
+    SourceEventCategories.member = Shapes::ShapeRef.new(shape: SourceEventCategory)
+
     StartDashboardRefreshRequest.add_member(:dashboard_id, Shapes::ShapeRef.new(shape: DashboardArn, required: true, location_name: "DashboardId"))
     StartDashboardRefreshRequest.add_member(:query_parameter_values, Shapes::ShapeRef.new(shape: QueryParameterValues, location_name: "QueryParameterValues"))
     StartDashboardRefreshRequest.struct_class = Types::StartDashboardRefreshRequest
@@ -1619,6 +1649,7 @@ module Aws::CloudTrail
         o.errors << Shapes::ShapeRef.new(shape: OrganizationsNotInUseException)
         o.errors << Shapes::ShapeRef.new(shape: OrganizationNotInAllFeaturesModeException)
         o.errors << Shapes::ShapeRef.new(shape: NoManagementAccountSLRExistsException)
+        o.errors << Shapes::ShapeRef.new(shape: ThrottlingException)
       end)
 
       api.add_operation(:create_trail, Seahorse::Model::Operation.new.tap do |o|
@@ -2094,6 +2125,23 @@ module Aws::CloudTrail
         )
       end)
 
+      api.add_operation(:list_insights_data, Seahorse::Model::Operation.new.tap do |o|
+        o.name = "ListInsightsData"
+        o.http_method = "POST"
+        o.http_request_uri = "/"
+        o.input = Shapes::ShapeRef.new(shape: ListInsightsDataRequest)
+        o.output = Shapes::ShapeRef.new(shape: ListInsightsDataResponse)
+        o.errors << Shapes::ShapeRef.new(shape: InvalidParameterException)
+        o.errors << Shapes::ShapeRef.new(shape: OperationNotPermittedException)
+        o.errors << Shapes::ShapeRef.new(shape: UnsupportedOperationException)
+        o[:pager] = Aws::Pager.new(
+          limit_key: "max_results",
+          tokens: {
+            "next_token" => "next_token"
+          }
+        )
+      end)
+
       api.add_operation(:list_insights_metric_data, Seahorse::Model::Operation.new.tap do |o|
         o.name = "ListInsightsMetricData"
         o.http_method = "POST"
@@ -2101,6 +2149,7 @@ module Aws::CloudTrail
         o.input = Shapes::ShapeRef.new(shape: ListInsightsMetricDataRequest)
         o.output = Shapes::ShapeRef.new(shape: ListInsightsMetricDataResponse)
         o.errors << Shapes::ShapeRef.new(shape: InvalidParameterException)
+        o.errors << Shapes::ShapeRef.new(shape: InvalidTrailNameException)
         o.errors << Shapes::ShapeRef.new(shape: OperationNotPermittedException)
         o.errors << Shapes::ShapeRef.new(shape: UnsupportedOperationException)
         o[:pager] = Aws::Pager.new(
@@ -2579,6 +2628,8 @@ module Aws::CloudTrail
         o.errors << Shapes::ShapeRef.new(shape: NotOrganizationMasterAccountException)
         o.errors << Shapes::ShapeRef.new(shape: NoManagementAccountSLRExistsException)
         o.errors << Shapes::ShapeRef.new(shape: OrganizationNotInAllFeaturesModeException)
+        o.errors << Shapes::ShapeRef.new(shape: ConflictException)
+        o.errors << Shapes::ShapeRef.new(shape: ThrottlingException)
       end)
 
       api.add_operation(:update_trail, Seahorse::Model::Operation.new.tap do |o|

data/lib/aws-sdk-cloudtrail/types.rb

@@ -884,10 +884,10 @@ module Aws::CloudTrail
     #   @return [String]
     #
     # @!attribute [rw] kms_key_id
-    #   Specifies the KMS key ID to use to encrypt the logs delivered by
-    #   CloudTrail. The value can be an alias name prefixed by `alias/`, a
-    #   fully specified ARN to an alias, a fully specified ARN to a key, or
-    #   a globally unique identifier.
+    #   Specifies the KMS key ID to use to encrypt the logs and digest files
+    #   delivered by CloudTrail. The value can be an alias name prefixed by
+    #   `alias/`, a fully specified ARN to an alias, a fully specified ARN
+    #   to a key, or a globally unique identifier.
     #
     #   CloudTrail also supports KMS multi-Region keys. For more information
     #   about multi-Region keys, see [Using multi-Region keys][1] in the
@@ -2378,9 +2378,12 @@ module Aws::CloudTrail
     #   @return [String]
     #
     # @!attribute [rw] insight_selectors
-    #   A JSON string that contains the Insight types you want to log on a
-    #   trail or event data store. `ApiErrorRateInsight` and
-    #   `ApiCallRateInsight` are supported as Insights types.
+    #   Contains the Insights types that are enabled on a trail or event
+    #   data store. It also specifies the event categories on which a
+    #   particular Insight type is enabled. `ApiCallRateInsight` and
+    #   `ApiErrorRateInsight` are valid Insight types.The EventCategory
+    #   field can specify `Management` or `Data` events or both. For event
+    #   data store, you can log Insights for management events only.
     #   @return [Array<Types::InsightSelector>]
     #
     # @!attribute [rw] event_data_store_arn
@@ -2919,18 +2922,33 @@ module Aws::CloudTrail
     #   types.
     #
     #   The `ApiCallRateInsight` Insights type analyzes write-only
-    #   management API calls that are aggregated per minute against a
-    #   baseline API call volume.
+    #   management API calls or read and write data API calls that are
+    #   aggregated per minute against a baseline API call volume.
     #
-    #   The `ApiErrorRateInsight` Insights type analyzes management API
-    #   calls that result in error codes. The error is shown if the API call
-    #   is unsuccessful.
+    #   The `ApiErrorRateInsight` Insights type analyzes management and data
+    #   API calls that result in error codes. The error is shown if the API
+    #   call is unsuccessful.
     #   @return [String]
     #
+    # @!attribute [rw] event_categories
+    #   Select the event category on which Insights should be enabled.
+    #
+    #   * If EventCategories is not provided, the specified Insights types
+    #     are enabled on management API calls by default.
+    #
+    #   * If EventCategories is provided, the given event categories will
+    #     overwrite the existing ones. For example, if a trail already has
+    #     Insights enabled on management events, and then a
+    #     PutInsightSelectors request is made with only data events
+    #     specified in EventCategories, Insights on management events will
+    #     be disabled.
+    #   @return [Array<String>]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/cloudtrail-2013-11-01/InsightSelector AWS API Documentation
     #
     class InsightSelector < Struct.new(
-      :insight_type)
+      :insight_type,
+      :event_categories)
       SENSITIVE = []
       include Aws::Structure
     end
@@ -3443,6 +3461,92 @@ module Aws::CloudTrail
       include Aws::Structure
     end
 
+    # @!attribute [rw] insight_source
+    #   The Amazon Resource Name(ARN) of the trail for which you want to
+    #   retrieve Insights events.
+    #   @return [String]
+    #
+    # @!attribute [rw] data_type
+    #   Specifies the category of events returned. To fetch Insights events,
+    #   specify `InsightsEvents` as the value of `DataType`
+    #   @return [String]
+    #
+    # @!attribute [rw] dimensions
+    #   Contains a map of dimensions. Currently the map can contain only one
+    #   item.
+    #   @return [Hash<String,String>]
+    #
+    # @!attribute [rw] start_time
+    #   Specifies that only events that occur after or at the specified time
+    #   are returned. If the specified start time is after the specified end
+    #   time, an error is returned.
+    #   @return [Time]
+    #
+    # @!attribute [rw] end_time
+    #   Specifies that only events that occur before or at the specified
+    #   time are returned. If the specified end time is before the specified
+    #   start time, an error is returned.
+    #   @return [Time]
+    #
+    # @!attribute [rw] max_results
+    #   The number of events to return. Possible values are 1 through 50.
+    #   The default is 50.
+    #   @return [Integer]
+    #
+    # @!attribute [rw] next_token
+    #   The token to use to get the next page of results after a previous
+    #   API call. This token must be passed in with the same parameters that
+    #   were specified in the original call. For example, if the original
+    #   call specified a EventName as a dimension with `PutObject` as a
+    #   value, the call with NextToken should include those same parameters.
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/cloudtrail-2013-11-01/ListInsightsDataRequest AWS API Documentation
+    #
+    class ListInsightsDataRequest < Struct.new(
+      :insight_source,
+      :data_type,
+      :dimensions,
+      :start_time,
+      :end_time,
+      :max_results,
+      :next_token)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # @!attribute [rw] events
+    #   A list of events returned based on the InsightSource, DataType or
+    #   Dimensions specified. The events list is sorted by time. The most
+    #   recent event is listed first.
+    #   @return [Array<Types::Event>]
+    #
+    # @!attribute [rw] next_token
+    #   The token to use to get the next page of results after a previous
+    #   API call. If the token does not appear, there are no more results to
+    #   return. The token must be passed in with the same parameters as the
+    #   previous call. For example, if the original call specified a
+    #   EventName as a dimension with `PutObject` as a value, the call with
+    #   NextToken should include those same parameters.
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/cloudtrail-2013-11-01/ListInsightsDataResponse AWS API Documentation
+    #
+    class ListInsightsDataResponse < Struct.new(
+      :events,
+      :next_token)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # @!attribute [rw] trail_name
+    #   The Amazon Resource Name(ARN) or name of the trail for which you
+    #   want to retrieve Insights metrics data. This parameter should only
+    #   be provided to fetch Insights metrics data generated on trails
+    #   logging data events. This parameter is not required for Insights
+    #   metric data generated on trails logging management events.
+    #   @return [String]
+    #
     # @!attribute [rw] event_source
     #   The Amazon Web Services service to which the request was made, such
     #   as `iam.amazonaws.com` or `s3.amazonaws.com`.
@@ -3513,6 +3617,7 @@ module Aws::CloudTrail
     # @see http://docs.aws.amazon.com/goto/WebAPI/cloudtrail-2013-11-01/ListInsightsMetricDataRequest AWS API Documentation
     #
     class ListInsightsMetricDataRequest < Struct.new(
+      :trail_name,
       :event_source,
       :event_name,
       :insight_type,
@@ -3527,6 +3632,11 @@ module Aws::CloudTrail
       include Aws::Structure
     end
 
+    # @!attribute [rw] trail_arn
+    #   Specifies the ARN of the trail. This is only returned when Insights
+    #   is enabled on a trail logging data events.
+    #   @return [String]
+    #
     # @!attribute [rw] event_source
     #   The Amazon Web Services service to which the request was made, such
     #   as `iam.amazonaws.com` or `s3.amazonaws.com`.
@@ -3574,6 +3684,7 @@ module Aws::CloudTrail
     # @see http://docs.aws.amazon.com/goto/WebAPI/cloudtrail-2013-11-01/ListInsightsMetricDataResponse AWS API Documentation
     #
     class ListInsightsMetricDataResponse < Struct.new(
+      :trail_arn,
       :event_source,
       :event_name,
       :insight_type,
@@ -4164,17 +4275,19 @@ module Aws::CloudTrail
     #   @return [String]
     #
     # @!attribute [rw] insight_selectors
-    #   A JSON string that contains the Insights types you want to log on a
-    #   trail or event data store. `ApiCallRateInsight` and
-    #   `ApiErrorRateInsight` are valid Insight types.
+    #   Contains the Insights types you want to log on a specific category
+    #   of events on a trail or event data store. `ApiCallRateInsight` and
+    #   `ApiErrorRateInsight` are valid Insight types.The EventCategory
+    #   field can specify `Management` or `Data` events or both. For event
+    #   data store, you can log Insights for management events only.
     #
     #   The `ApiCallRateInsight` Insights type analyzes write-only
-    #   management API calls that are aggregated per minute against a
-    #   baseline API call volume.
+    #   management API calls or read and write data API calls that are
+    #   aggregated per minute against a baseline API call volume.
     #
-    #   The `ApiErrorRateInsight` Insights type analyzes management API
-    #   calls that result in error codes. The error is shown if the API call
-    #   is unsuccessful.
+    #   The `ApiErrorRateInsight` Insights type analyzes management and data
+    #   API calls that result in error codes. The error is shown if the API
+    #   call is unsuccessful.
     #   @return [Array<Types::InsightSelector>]
     #
     # @!attribute [rw] event_data_store
@@ -4212,9 +4325,11 @@ module Aws::CloudTrail
     #   @return [String]
     #
     # @!attribute [rw] insight_selectors
-    #   A JSON string that contains the Insights event types that you want
-    #   to log on a trail or event data store. The valid Insights types are
-    #   `ApiErrorRateInsight` and `ApiCallRateInsight`.
+    #   Contains the Insights types you want to log on a specific category
+    #   of events in a trail or event data store. `ApiCallRateInsight` and
+    #   `ApiErrorRateInsight` are valid Insight types.The EventCategory
+    #   field can specify `Management` or `Data` events or both. For event
+    #   data store, you can only log Insights for management events only.
     #   @return [Array<Types::InsightSelector>]
     #
     # @!attribute [rw] event_data_store_arn
@@ -5342,9 +5457,9 @@ module Aws::CloudTrail
     #   @return [String]
     #
     # @!attribute [rw] kms_key_id
-    #   Specifies the KMS key ID that encrypts the logs delivered by
-    #   CloudTrail. The value is a fully specified ARN to a KMS key in the
-    #   following format.
+    #   Specifies the KMS key ID that encrypts the logs and digest files
+    #   delivered by CloudTrail. The value is a fully specified ARN to a KMS
+    #   key in the following format.
     #
     #   `arn:aws:kms:us-east-2:123456789012:key/12345678-1234-1234-1234-123456789012`
     #   @return [String]
@@ -5910,10 +6025,10 @@ module Aws::CloudTrail
     #   @return [String]
     #
     # @!attribute [rw] kms_key_id
-    #   Specifies the KMS key ID to use to encrypt the logs delivered by
-    #   CloudTrail. The value can be an alias name prefixed by "alias/", a
-    #   fully specified ARN to an alias, a fully specified ARN to a key, or
-    #   a globally unique identifier.
+    #   Specifies the KMS key ID to use to encrypt the logs and digest files
+    #   delivered by CloudTrail. The value can be an alias name prefixed by
+    #   "alias/", a fully specified ARN to an alias, a fully specified ARN
+    #   to a key, or a globally unique identifier.
     #
     #   CloudTrail also supports KMS multi-Region keys. For more information
     #   about multi-Region keys, see [Using multi-Region keys][1] in the
@@ -6037,9 +6152,9 @@ module Aws::CloudTrail
     #   @return [String]
     #
     # @!attribute [rw] kms_key_id
-    #   Specifies the KMS key ID that encrypts the logs delivered by
-    #   CloudTrail. The value is a fully specified ARN to a KMS key in the
-    #   following format.
+    #   Specifies the KMS key ID that encrypts the logs and digest files
+    #   delivered by CloudTrail. The value is a fully specified ARN to a KMS
+    #   key in the following format.
     #
     #   `arn:aws:kms:us-east-2:123456789012:key/12345678-1234-1234-1234-123456789012`
     #   @return [String]

data/lib/aws-sdk-cloudtrail.rb

@@ -54,7 +54,7 @@ module Aws::CloudTrail
   autoload :EndpointProvider, 'aws-sdk-cloudtrail/endpoint_provider'
   autoload :Endpoints, 'aws-sdk-cloudtrail/endpoints'
 
-  GEM_VERSION = '1.113.0'
+  GEM_VERSION = '1.114.0'
 
 end
 

data/sig/client.rbs

@@ -631,8 +631,26 @@ module Aws
                         ) -> _ListImportsResponseSuccess
                       | (?Hash[Symbol, untyped] params, ?Hash[Symbol, untyped] options) -> _ListImportsResponseSuccess
 
+      interface _ListInsightsDataResponseSuccess
+        include ::Seahorse::Client::_ResponseSuccess[Types::ListInsightsDataResponse]
+        def events: () -> ::Array[Types::Event]
+        def next_token: () -> ::String
+      end
+      # https://docs.aws.amazon.com/sdk-for-ruby/v3/api/Aws/CloudTrail/Client.html#list_insights_data-instance_method
+      def list_insights_data: (
+                                insight_source: ::String,
+                                data_type: ("InsightsEvents"),
+                                ?dimensions: Hash[("EventId" | "EventName" | "EventSource"), ::String],
+                                ?start_time: ::Time,
+                                ?end_time: ::Time,
+                                ?max_results: ::Integer,
+                                ?next_token: ::String
+                              ) -> _ListInsightsDataResponseSuccess
+                            | (Hash[Symbol, untyped] params, ?Hash[Symbol, untyped] options) -> _ListInsightsDataResponseSuccess
+
       interface _ListInsightsMetricDataResponseSuccess
         include ::Seahorse::Client::_ResponseSuccess[Types::ListInsightsMetricDataResponse]
+        def trail_arn: () -> ::String
         def event_source: () -> ::String
         def event_name: () -> ::String
         def insight_type: () -> ("ApiCallRateInsight" | "ApiErrorRateInsight")
@@ -643,6 +661,7 @@ module Aws
       end
       # https://docs.aws.amazon.com/sdk-for-ruby/v3/api/Aws/CloudTrail/Client.html#list_insights_metric_data-instance_method
       def list_insights_metric_data: (
+                                       ?trail_name: ::String,
                                        event_source: ::String,
                                        event_name: ::String,
                                        insight_type: ("ApiCallRateInsight" | "ApiErrorRateInsight"),
@@ -801,7 +820,8 @@ module Aws
                                    ?trail_name: ::String,
                                    insight_selectors: Array[
                                      {
-                                       insight_type: ("ApiCallRateInsight" | "ApiErrorRateInsight")?
+                                       insight_type: ("ApiCallRateInsight" | "ApiErrorRateInsight")?,
+                                       event_categories: Array[("Management" | "Data")]?
                                      },
                                    ],
                                    ?event_data_store: ::String,

data/sig/types.rbs

@@ -645,6 +645,7 @@ module Aws::CloudTrail
 
     class InsightSelector
       attr_accessor insight_type: ("ApiCallRateInsight" | "ApiErrorRateInsight")
+      attr_accessor event_categories: ::Array[("Management" | "Data")]
       SENSITIVE: []
     end
 
@@ -815,7 +816,25 @@ module Aws::CloudTrail
       SENSITIVE: []
     end
 
+    class ListInsightsDataRequest
+      attr_accessor insight_source: ::String
+      attr_accessor data_type: ("InsightsEvents")
+      attr_accessor dimensions: ::Hash[("EventId" | "EventName" | "EventSource"), ::String]
+      attr_accessor start_time: ::Time
+      attr_accessor end_time: ::Time
+      attr_accessor max_results: ::Integer
+      attr_accessor next_token: ::String
+      SENSITIVE: []
+    end
+
+    class ListInsightsDataResponse
+      attr_accessor events: ::Array[Types::Event]
+      attr_accessor next_token: ::String
+      SENSITIVE: []
+    end
+
     class ListInsightsMetricDataRequest
+      attr_accessor trail_name: ::String
       attr_accessor event_source: ::String
       attr_accessor event_name: ::String
       attr_accessor insight_type: ("ApiCallRateInsight" | "ApiErrorRateInsight")
@@ -830,6 +849,7 @@ module Aws::CloudTrail
     end
 
     class ListInsightsMetricDataResponse
+      attr_accessor trail_arn: ::String
       attr_accessor event_source: ::String
       attr_accessor event_name: ::String
       attr_accessor insight_type: ("ApiCallRateInsight" | "ApiErrorRateInsight")

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: aws-sdk-cloudtrail
 version: !ruby/object:Gem::Version
-  version: 1.113.0
+  version: 1.114.0
 platform: ruby
 authors:
 - Amazon Web Services