aws-sdk-cloudtrail 1.74.0 → 1.75.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 91edac860f1d3195c8a03259a925c5a8561024b08857941651f3960933507423
-  data.tar.gz: 23a753272c4869b98496f9462ac9c1d5ada370228dd2ef25559611ab25dca2ad
+  metadata.gz: 1894cf5fd4e3eb0fa034c855cb55b05f17903e62603c6e559e86ded3d1ca590c
+  data.tar.gz: 415105679ee0befcf6cd0f258c8a859bb88c69c7fbb9c1bf04ecd808d2d0d63c
 SHA512:
-  metadata.gz: 9f4ce5eab5052adbebb1afa18cc74004962b5811ee1179455767d38b37f051036cddbd7baf7238a5cfd87b582e8158e98f4b6cde6d497ffed642dd0a95c6c4fb
-  data.tar.gz: 73f9b634c44c4656db2b5d9fd388af1eba7e79211aa2d6ae4a8addcb7256839f3e5317784ad78bb0ad3154dce86b0d22b1779cd26873a385a8e66192afcd2a51
+  metadata.gz: f7c6c327842f3c30b86a8259a4b4d795c9de7e979c4d85e9e15f80dcbd2704f2c1e3cd969c04270213c14d5ea243f510a1a4935b467197c97c2cce10083c9b9b
+  data.tar.gz: e30da2cb3248ead42155656eb8e8a46bd0c7bd0a9dd00d4254bdeea5fd5632ad6bcf4a245b2f8f3bdcb2d045e2e8c012e3531de8617a12e92e5b6761d9d82a2e

data/CHANGELOG.md

@@ -1,6 +1,11 @@
 Unreleased Changes
 ------------------
 
+1.75.0 (2024-01-18)
+------------------
+
+* Feature - This release adds a new API ListInsightsMetricData to retrieve metric data from CloudTrail Insights.
+
 1.74.0 (2023-11-28)
 ------------------
 

data/VERSION

@@ -1 +1 @@
-1.74.0
+1.75.0

data/lib/aws-sdk-cloudtrail/client.rb

@@ -862,11 +862,6 @@ module Aws::CloudTrail
     #
     #   Not required unless you specify `CloudWatchLogsRoleArn`.
     #
-    #   <note markdown="1"> Only the management account can configure a CloudWatch Logs log group
-    #   for an organization trail.
-    #
-    #    </note>
-    #
     # @option params [String] :cloud_watch_logs_role_arn
     #   Specifies the role for the CloudWatch Logs endpoint to assume to write
     #   to a user's log group. You must use a role that exists in your
@@ -1240,11 +1235,12 @@ module Aws::CloudTrail
     end
 
     # Disables Lake query federation on the specified event data store. When
-    # you disable federation, CloudTrail removes the metadata associated
-    # with the federated event data store in the Glue Data Catalog and
-    # removes registration for the federation role ARN and event data store
-    # in Lake Formation. No CloudTrail Lake data is deleted when you disable
-    # federation.
+    # you disable federation, CloudTrail disables the integration with Glue,
+    # Lake Formation, and Amazon Athena. After disabling Lake query
+    # federation, you can no longer query your event data in Amazon Athena.
+    #
+    # No CloudTrail Lake data is deleted when you disable federation and you
+    # can continue to run queries in CloudTrail Lake.
     #
     # @option params [required, String] :event_data_store
     #   The ARN (or ID suffix of the ARN) of the event data store for which
@@ -1282,13 +1278,13 @@ module Aws::CloudTrail
     # metadata stored in the Glue Data Catalog lets the Athena query engine
     # know how to find, read, and process the data that you want to query.
     #
-    # When you enable Lake query federation, CloudTrail creates a federated
+    # When you enable Lake query federation, CloudTrail creates a managed
     # database named `aws:cloudtrail` (if the database doesn't already
-    # exist) and a federated table in the Glue Data Catalog. The event data
-    # store ID is used for the table name. CloudTrail registers the role ARN
-    # and event data store in [Lake Formation][2], the service responsible
-    # for revoking or granting permissions to the federated resources in the
-    # Glue Data Catalog.
+    # exist) and a managed federated table in the Glue Data Catalog. The
+    # event data store ID is used for the table name. CloudTrail registers
+    # the role ARN and event data store in [Lake Formation][2], the service
+    # responsible for allowing fine-grained access control of the federated
+    # resources in the Glue Data Catalog.
     #
     # For more information about Lake query federation, see [Federate an
     # event data store][3].
@@ -1296,7 +1292,7 @@ module Aws::CloudTrail
     #
     #
     # [1]: https://docs.aws.amazon.com/glue/latest/dg/components-overview.html#data-catalog-intro
-    # [2]: https://docs.aws.amazon.com/lake-formation/latest/dg/how-it-works.html
+    # [2]: https://docs.aws.amazon.com/awscloudtrail/latest/userguide/query-federation-lake-formation.html
     # [3]: https://docs.aws.amazon.com/awscloudtrail/latest/userguide/query-federation.html
     #
     # @option params [required, String] :event_data_store
@@ -2102,6 +2098,134 @@ module Aws::CloudTrail
       req.send_request(options)
     end
 
+    # Returns Insights metrics data for trails that have enabled Insights.
+    # The request must include the `EventSource`, `EventName`, and
+    # `InsightType` parameters.
+    #
+    # If the `InsightType` is set to `ApiErrorRateInsight`, the request must
+    # also include the `ErrorCode` parameter.
+    #
+    # The following are the available time periods for
+    # `ListInsightsMetricData`. Each cutoff is inclusive.
+    #
+    # * Data points with a period of 60 seconds (1-minute) are available for
+    #   15 days.
+    #
+    # * Data points with a period of 300 seconds (5-minute) are available
+    #   for 63 days.
+    #
+    # * Data points with a period of 3600 seconds (1 hour) are available for
+    #   90 days.
+    #
+    # Access to the `ListInsightsMetricData` API operation is linked to the
+    # `cloudtrail:LookupEvents` action. To use this operation, you must have
+    # permissions to perform the `cloudtrail:LookupEvents` action.
+    #
+    # @option params [required, String] :event_source
+    #   The Amazon Web Services service to which the request was made, such as
+    #   `iam.amazonaws.com` or `s3.amazonaws.com`.
+    #
+    # @option params [required, String] :event_name
+    #   The name of the event, typically the Amazon Web Services API on which
+    #   unusual levels of activity were recorded.
+    #
+    # @option params [required, String] :insight_type
+    #   The type of CloudTrail Insights event, which is either
+    #   `ApiCallRateInsight` or `ApiErrorRateInsight`. The
+    #   `ApiCallRateInsight` Insights type analyzes write-only management API
+    #   calls that are aggregated per minute against a baseline API call
+    #   volume. The `ApiErrorRateInsight` Insights type analyzes management
+    #   API calls that result in error codes.
+    #
+    # @option params [String] :error_code
+    #   Conditionally required if the `InsightType` parameter is set to
+    #   `ApiErrorRateInsight`.
+    #
+    #   If returning metrics for the `ApiErrorRateInsight` Insights type, this
+    #   is the error to retrieve data for. For example, `AccessDenied`.
+    #
+    # @option params [Time,DateTime,Date,Integer,String] :start_time
+    #   Specifies, in UTC, the start time for time-series data. The value
+    #   specified is inclusive; results include data points with the specified
+    #   time stamp.
+    #
+    #   The default is 90 days before the time of request.
+    #
+    # @option params [Time,DateTime,Date,Integer,String] :end_time
+    #   Specifies, in UTC, the end time for time-series data. The value
+    #   specified is exclusive; results include data points up to the
+    #   specified time stamp.
+    #
+    #   The default is the time of request.
+    #
+    # @option params [Integer] :period
+    #   Granularity of data to retrieve, in seconds. Valid values are `60`,
+    #   `300`, and `3600`. If you specify any other value, you will get an
+    #   error. The default is 3600 seconds.
+    #
+    # @option params [String] :data_type
+    #   Type of datapoints to return. Valid values are `NonZeroData` and
+    #   `FillWithZeros`. The default is `NonZeroData`.
+    #
+    # @option params [Integer] :max_results
+    #   The maximum number of datapoints to return. Valid values are integers
+    #   from 1 to 21600. The default value is 21600.
+    #
+    # @option params [String] :next_token
+    #   Returned if all datapoints can't be returned in a single call. For
+    #   example, due to reaching `MaxResults`.
+    #
+    #   Add this parameter to the request to continue retrieving results
+    #   starting from the last evaluated point.
+    #
+    # @return [Types::ListInsightsMetricDataResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::ListInsightsMetricDataResponse#event_source #event_source} => String
+    #   * {Types::ListInsightsMetricDataResponse#event_name #event_name} => String
+    #   * {Types::ListInsightsMetricDataResponse#insight_type #insight_type} => String
+    #   * {Types::ListInsightsMetricDataResponse#error_code #error_code} => String
+    #   * {Types::ListInsightsMetricDataResponse#timestamps #timestamps} => Array&lt;Time&gt;
+    #   * {Types::ListInsightsMetricDataResponse#values #values} => Array&lt;Float&gt;
+    #   * {Types::ListInsightsMetricDataResponse#next_token #next_token} => String
+    #
+    # The returned {Seahorse::Client::Response response} is a pageable response and is Enumerable. For details on usage see {Aws::PageableResponse PageableResponse}.
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.list_insights_metric_data({
+    #     event_source: "EventSource", # required
+    #     event_name: "EventName", # required
+    #     insight_type: "ApiCallRateInsight", # required, accepts ApiCallRateInsight, ApiErrorRateInsight
+    #     error_code: "ErrorCode",
+    #     start_time: Time.now,
+    #     end_time: Time.now,
+    #     period: 1,
+    #     data_type: "FillWithZeros", # accepts FillWithZeros, NonZeroData
+    #     max_results: 1,
+    #     next_token: "InsightsMetricNextToken",
+    #   })
+    #
+    # @example Response structure
+    #
+    #   resp.event_source #=> String
+    #   resp.event_name #=> String
+    #   resp.insight_type #=> String, one of "ApiCallRateInsight", "ApiErrorRateInsight"
+    #   resp.error_code #=> String
+    #   resp.timestamps #=> Array
+    #   resp.timestamps[0] #=> Time
+    #   resp.values #=> Array
+    #   resp.values[0] #=> Float
+    #   resp.next_token #=> String
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/cloudtrail-2013-11-01/ListInsightsMetricData AWS API Documentation
+    #
+    # @overload list_insights_metric_data(params = {})
+    # @param [Hash] params ({})
+    def list_insights_metric_data(params = {}, options = {})
+      req = build_request(:list_insights_metric_data, params)
+      req.send_request(options)
+    end
+
     # Returns all public keys whose private keys were used to sign the
     # digest files within the specified time range. The public key is needed
     # to validate digest files that were signed with its corresponding
@@ -3305,13 +3429,14 @@ module Aws::CloudTrail
     # `TerminationProtection` is enabled.
     #
     # For event data stores for CloudTrail events, `AdvancedEventSelectors`
-    # includes or excludes management, data, or Insights events in your
-    # event data store. For more information about `AdvancedEventSelectors`,
-    # see [AdvancedEventSelectors][1].
+    # includes or excludes management or data events in your event data
+    # store. For more information about `AdvancedEventSelectors`, see
+    # [AdvancedEventSelectors][1].
     #
-    # For event data stores for Config configuration items, Audit Manager
-    # evidence, or non-Amazon Web Services events, `AdvancedEventSelectors`
-    # includes events of that type in your event data store.
+    # For event data stores for CloudTrail Insights events, Config
+    # configuration items, Audit Manager evidence, or non-Amazon Web
+    # Services events, `AdvancedEventSelectors` includes events of that type
+    # in your event data store.
     #
     #
     #
@@ -3609,11 +3734,6 @@ module Aws::CloudTrail
     #
     #   Not required unless you specify `CloudWatchLogsRoleArn`.
     #
-    #   <note markdown="1"> Only the management account can configure a CloudWatch Logs log group
-    #   for an organization trail.
-    #
-    #    </note>
-    #
     # @option params [String] :cloud_watch_logs_role_arn
     #   Specifies the role for the CloudWatch Logs endpoint to assume to write
     #   to a user's log group. You must use a role that exists in your
@@ -3731,7 +3851,7 @@ module Aws::CloudTrail
         params: params,
         config: config)
       context[:gem_name] = 'aws-sdk-cloudtrail'
-      context[:gem_version] = '1.74.0'
+      context[:gem_version] = '1.75.0'
       Seahorse::Client::Request.new(handlers, context)
     end
 

data/lib/aws-sdk-cloudtrail/client_api.rb

@@ -78,8 +78,10 @@ module Aws::CloudTrail
     Destinations = Shapes::ListShape.new(name: 'Destinations')
     DisableFederationRequest = Shapes::StructureShape.new(name: 'DisableFederationRequest')
     DisableFederationResponse = Shapes::StructureShape.new(name: 'DisableFederationResponse')
+    Double = Shapes::FloatShape.new(name: 'Double')
     EnableFederationRequest = Shapes::StructureShape.new(name: 'EnableFederationRequest')
     EnableFederationResponse = Shapes::StructureShape.new(name: 'EnableFederationResponse')
+    ErrorCode = Shapes::StringShape.new(name: 'ErrorCode')
     ErrorMessage = Shapes::StringShape.new(name: 'ErrorMessage')
     Event = Shapes::StructureShape.new(name: 'Event')
     EventCategory = Shapes::StringShape.new(name: 'EventCategory')
@@ -96,8 +98,10 @@ module Aws::CloudTrail
     EventDataStoreStatus = Shapes::StringShape.new(name: 'EventDataStoreStatus')
     EventDataStoreTerminationProtectedException = Shapes::StructureShape.new(name: 'EventDataStoreTerminationProtectedException')
     EventDataStores = Shapes::ListShape.new(name: 'EventDataStores')
+    EventName = Shapes::StringShape.new(name: 'EventName')
     EventSelector = Shapes::StructureShape.new(name: 'EventSelector')
     EventSelectors = Shapes::ListShape.new(name: 'EventSelectors')
+    EventSource = Shapes::StringShape.new(name: 'EventSource')
     EventsList = Shapes::ListShape.new(name: 'EventsList')
     ExcludeManagementEventSources = Shapes::ListShape.new(name: 'ExcludeManagementEventSources')
     FederationRoleArn = Shapes::StringShape.new(name: 'FederationRoleArn')
@@ -137,6 +141,11 @@ module Aws::CloudTrail
     InsightSelector = Shapes::StructureShape.new(name: 'InsightSelector')
     InsightSelectors = Shapes::ListShape.new(name: 'InsightSelectors')
     InsightType = Shapes::StringShape.new(name: 'InsightType')
+    InsightsMetricDataType = Shapes::StringShape.new(name: 'InsightsMetricDataType')
+    InsightsMetricMaxResults = Shapes::IntegerShape.new(name: 'InsightsMetricMaxResults')
+    InsightsMetricNextToken = Shapes::StringShape.new(name: 'InsightsMetricNextToken')
+    InsightsMetricPeriod = Shapes::IntegerShape.new(name: 'InsightsMetricPeriod')
+    InsightsMetricValues = Shapes::ListShape.new(name: 'InsightsMetricValues')
     InsufficientDependencyServiceAccessPermissionException = Shapes::StructureShape.new(name: 'InsufficientDependencyServiceAccessPermissionException')
     InsufficientEncryptionPolicyException = Shapes::StructureShape.new(name: 'InsufficientEncryptionPolicyException')
     InsufficientS3BucketPolicyException = Shapes::StructureShape.new(name: 'InsufficientS3BucketPolicyException')
@@ -183,6 +192,8 @@ module Aws::CloudTrail
     ListImportsMaxResultsCount = Shapes::IntegerShape.new(name: 'ListImportsMaxResultsCount')
     ListImportsRequest = Shapes::StructureShape.new(name: 'ListImportsRequest')
     ListImportsResponse = Shapes::StructureShape.new(name: 'ListImportsResponse')
+    ListInsightsMetricDataRequest = Shapes::StructureShape.new(name: 'ListInsightsMetricDataRequest')
+    ListInsightsMetricDataResponse = Shapes::StructureShape.new(name: 'ListInsightsMetricDataResponse')
     ListPublicKeysRequest = Shapes::StructureShape.new(name: 'ListPublicKeysRequest')
     ListPublicKeysResponse = Shapes::StructureShape.new(name: 'ListPublicKeysResponse')
     ListQueriesMaxResultsCount = Shapes::IntegerShape.new(name: 'ListQueriesMaxResultsCount')
@@ -285,6 +296,7 @@ module Aws::CloudTrail
     TagsList = Shapes::ListShape.new(name: 'TagsList')
     TerminationProtectionEnabled = Shapes::BooleanShape.new(name: 'TerminationProtectionEnabled')
     ThrottlingException = Shapes::StructureShape.new(name: 'ThrottlingException')
+    Timestamps = Shapes::ListShape.new(name: 'Timestamps')
     Trail = Shapes::StructureShape.new(name: 'Trail')
     TrailAlreadyExistsException = Shapes::StructureShape.new(name: 'TrailAlreadyExistsException')
     TrailInfo = Shapes::StructureShape.new(name: 'TrailInfo')
@@ -731,6 +743,8 @@ module Aws::CloudTrail
 
     InsightSelectors.member = Shapes::ShapeRef.new(shape: InsightSelector)
 
+    InsightsMetricValues.member = Shapes::ShapeRef.new(shape: Double)
+
     InsufficientDependencyServiceAccessPermissionException.struct_class = Types::InsufficientDependencyServiceAccessPermissionException
 
     InsufficientEncryptionPolicyException.struct_class = Types::InsufficientEncryptionPolicyException
@@ -832,6 +846,27 @@ module Aws::CloudTrail
     ListImportsResponse.add_member(:next_token, Shapes::ShapeRef.new(shape: PaginationToken, location_name: "NextToken"))
     ListImportsResponse.struct_class = Types::ListImportsResponse
 
+    ListInsightsMetricDataRequest.add_member(:event_source, Shapes::ShapeRef.new(shape: EventSource, required: true, location_name: "EventSource"))
+    ListInsightsMetricDataRequest.add_member(:event_name, Shapes::ShapeRef.new(shape: EventName, required: true, location_name: "EventName"))
+    ListInsightsMetricDataRequest.add_member(:insight_type, Shapes::ShapeRef.new(shape: InsightType, required: true, location_name: "InsightType"))
+    ListInsightsMetricDataRequest.add_member(:error_code, Shapes::ShapeRef.new(shape: ErrorCode, location_name: "ErrorCode"))
+    ListInsightsMetricDataRequest.add_member(:start_time, Shapes::ShapeRef.new(shape: Date, location_name: "StartTime"))
+    ListInsightsMetricDataRequest.add_member(:end_time, Shapes::ShapeRef.new(shape: Date, location_name: "EndTime"))
+    ListInsightsMetricDataRequest.add_member(:period, Shapes::ShapeRef.new(shape: InsightsMetricPeriod, location_name: "Period"))
+    ListInsightsMetricDataRequest.add_member(:data_type, Shapes::ShapeRef.new(shape: InsightsMetricDataType, location_name: "DataType"))
+    ListInsightsMetricDataRequest.add_member(:max_results, Shapes::ShapeRef.new(shape: InsightsMetricMaxResults, location_name: "MaxResults"))
+    ListInsightsMetricDataRequest.add_member(:next_token, Shapes::ShapeRef.new(shape: InsightsMetricNextToken, location_name: "NextToken"))
+    ListInsightsMetricDataRequest.struct_class = Types::ListInsightsMetricDataRequest
+
+    ListInsightsMetricDataResponse.add_member(:event_source, Shapes::ShapeRef.new(shape: EventSource, location_name: "EventSource"))
+    ListInsightsMetricDataResponse.add_member(:event_name, Shapes::ShapeRef.new(shape: EventName, location_name: "EventName"))
+    ListInsightsMetricDataResponse.add_member(:insight_type, Shapes::ShapeRef.new(shape: InsightType, location_name: "InsightType"))
+    ListInsightsMetricDataResponse.add_member(:error_code, Shapes::ShapeRef.new(shape: ErrorCode, location_name: "ErrorCode"))
+    ListInsightsMetricDataResponse.add_member(:timestamps, Shapes::ShapeRef.new(shape: Timestamps, location_name: "Timestamps"))
+    ListInsightsMetricDataResponse.add_member(:values, Shapes::ShapeRef.new(shape: InsightsMetricValues, location_name: "Values"))
+    ListInsightsMetricDataResponse.add_member(:next_token, Shapes::ShapeRef.new(shape: InsightsMetricNextToken, location_name: "NextToken"))
+    ListInsightsMetricDataResponse.struct_class = Types::ListInsightsMetricDataResponse
+
     ListPublicKeysRequest.add_member(:start_time, Shapes::ShapeRef.new(shape: Date, location_name: "StartTime"))
     ListPublicKeysRequest.add_member(:end_time, Shapes::ShapeRef.new(shape: Date, location_name: "EndTime"))
     ListPublicKeysRequest.add_member(:next_token, Shapes::ShapeRef.new(shape: String, location_name: "NextToken"))
@@ -1105,6 +1140,8 @@ module Aws::CloudTrail
 
     ThrottlingException.struct_class = Types::ThrottlingException
 
+    Timestamps.member = Shapes::ShapeRef.new(shape: Date)
+
     Trail.add_member(:name, Shapes::ShapeRef.new(shape: String, location_name: "Name"))
     Trail.add_member(:s3_bucket_name, Shapes::ShapeRef.new(shape: String, location_name: "S3BucketName"))
     Trail.add_member(:s3_key_prefix, Shapes::ShapeRef.new(shape: String, location_name: "S3KeyPrefix"))
@@ -1720,6 +1757,23 @@ module Aws::CloudTrail
         )
       end)
 
+      api.add_operation(:list_insights_metric_data, Seahorse::Model::Operation.new.tap do |o|
+        o.name = "ListInsightsMetricData"
+        o.http_method = "POST"
+        o.http_request_uri = "/"
+        o.input = Shapes::ShapeRef.new(shape: ListInsightsMetricDataRequest)
+        o.output = Shapes::ShapeRef.new(shape: ListInsightsMetricDataResponse)
+        o.errors << Shapes::ShapeRef.new(shape: InvalidParameterException)
+        o.errors << Shapes::ShapeRef.new(shape: OperationNotPermittedException)
+        o.errors << Shapes::ShapeRef.new(shape: UnsupportedOperationException)
+        o[:pager] = Aws::Pager.new(
+          limit_key: "max_results",
+          tokens: {
+            "next_token" => "next_token"
+          }
+        )
+      end)
+
       api.add_operation(:list_public_keys, Seahorse::Model::Operation.new.tap do |o|
         o.name = "ListPublicKeys"
         o.http_method = "POST"

data/lib/aws-sdk-cloudtrail/endpoints.rb

@@ -390,6 +390,20 @@ module Aws::CloudTrail
       end
     end
 
+    class ListInsightsMetricData
+      def self.build(context)
+        unless context.config.regional_endpoint
+          endpoint = context.config.endpoint.to_s
+        end
+        Aws::CloudTrail::EndpointParameters.new(
+          region: context.config.region,
+          use_dual_stack: context.config.use_dualstack_endpoint,
+          use_fips: context.config.use_fips_endpoint,
+          endpoint: endpoint,
+        )
+      end
+    end
+
     class ListPublicKeys
       def self.build(context)
         unless context.config.regional_endpoint

data/lib/aws-sdk-cloudtrail/plugins/endpoints.rb

@@ -111,6 +111,8 @@ module Aws::CloudTrail
             Aws::CloudTrail::Endpoints::ListImportFailures.build(context)
           when :list_imports
             Aws::CloudTrail::Endpoints::ListImports.build(context)
+          when :list_insights_metric_data
+            Aws::CloudTrail::Endpoints::ListInsightsMetricData.build(context)
           when :list_public_keys
             Aws::CloudTrail::Endpoints::ListPublicKeys.build(context)
           when :list_queries

data/lib/aws-sdk-cloudtrail/types.rb

@@ -127,17 +127,20 @@ module Aws::CloudTrail
     #
     # @!attribute [rw] field
     #   A field in a CloudTrail event record on which to filter events to be
-    #   logged. For event data stores for Config configuration items, Audit
-    #   Manager evidence, or non-Amazon Web Services events, the field is
-    #   used only for selecting events as filtering is not supported.
+    #   logged. For event data stores for CloudTrail Insights events, Config
+    #   configuration items, Audit Manager evidence, or events outside of
+    #   Amazon Web Services, the field is used only for selecting events as
+    #   filtering is not supported.
     #
-    #   For CloudTrail event records, supported fields include `readOnly`,
-    #   `eventCategory`, `eventSource` (for management events), `eventName`,
-    #   `resources.type`, and `resources.ARN`.
+    #   For CloudTrail management events, supported fields include
+    #   `readOnly`, `eventCategory`, and `eventSource`.
     #
-    #   For event data stores for Config configuration items, Audit Manager
-    #   evidence, or non-Amazon Web Services events, the only supported
-    #   field is `eventCategory`.
+    #   For CloudTrail data events, supported fields include `readOnly`,
+    #   `eventCategory`, `eventName`, `resources.type`, and `resources.ARN`.
+    #
+    #   For event data stores for CloudTrail Insights events, Config
+    #   configuration items, Audit Manager evidence, or events outside of
+    #   Amazon Web Services, the only supported field is `eventCategory`.
     #
     #   * <b> <code>readOnly</code> </b> - Optional. Can be set to `Equals`
     #     a value of `true` or `false`. If you do not add this field,
@@ -157,11 +160,14 @@ module Aws::CloudTrail
     #   * <b> <code>eventCategory</code> </b> - This is required and must be
     #     set to `Equals`.
     #
-    #     * For CloudTrail event records, the value must be `Management` or
-    #       `Data`.
+    #     * For CloudTrail management events, the value must be
+    #       `Management`.
+    #
+    #     * For CloudTrail data events, the value must be `Data`.
     #
-    #     * For CloudTrail Insights event records, the value must be
-    #       `Insight`.
+    #     The following are used only for event data stores:
+    #
+    #     * For CloudTrail Insights events, the value must be `Insight`.
     #
     #     * For Config configuration items, the value must be
     #       `ConfigurationItem`.
@@ -181,6 +187,16 @@ module Aws::CloudTrail
     #
     #     * `AWS::S3::Object`
     #
+    #     * `AWS::B2BI::Transformer`
+    #
+    #     * `AWS::Bedrock::AgentAlias`
+    #
+    #     * `AWS::Bedrock::KnowledgeBase`
+    #
+    #     * `AWS::Cassandra::Table`
+    #
+    #     * `AWS::CloudFront::KeyValueStore`
+    #
     #     * `AWS::CloudTrail::Channel`
     #
     #     * `AWS::CodeWhisperer::Customization`
@@ -201,6 +217,10 @@ module Aws::CloudTrail
     #
     #     * `AWS::GuardDuty::Detector`
     #
+    #     * `AWS::IoTTwinMaker::Entity`
+    #
+    #     * `AWS::IoTTwinMaker::Workspace`
+    #
     #     * `AWS::KendraRanking::ExecutionPlan`
     #
     #     * `AWS::KinesisVideo::Stream`
@@ -211,18 +231,38 @@ module Aws::CloudTrail
     #
     #     * `AWS::MedicalImaging::Datastore`
     #
+    #     * `AWS::NeptuneGraph::Graph`
+    #
     #     * `AWS::PCAConnectorAD::Connector`
     #
+    #     * `AWS::QBusiness::Application`
+    #
+    #     * `AWS::QBusiness::DataSource`
+    #
+    #     * `AWS::QBusiness::Index`
+    #
+    #     * `AWS::QBusiness::WebExperience`
+    #
+    #     * `AWS::RDS::DBCluster`
+    #
     #     * `AWS::SageMaker::Endpoint`
     #
     #     * `AWS::SageMaker::ExperimentTrialComponent`
     #
     #     * `AWS::SageMaker::FeatureGroup`
     #
+    #     * `AWS::ServiceDiscovery::Namespace `
+    #
+    #     * `AWS::ServiceDiscovery::Service`
+    #
+    #     * `AWS::SCN::Instance`
+    #
     #     * `AWS::SNS::PlatformEndpoint`
     #
     #     * `AWS::SNS::Topic`
     #
+    #     * `AWS::SQS::Queue`
+    #
     #     * `AWS::S3::AccessPoint`
     #
     #     * `AWS::S3ObjectLambda::AccessPoint`
@@ -231,6 +271,10 @@ module Aws::CloudTrail
     #
     #     * `AWS::SSMMessages::ControlChannel`
     #
+    #     * `AWS::ThinClient::Device`
+    #
+    #     * `AWS::ThinClient::Environment`
+    #
     #     * `AWS::Timestream::Database`
     #
     #     * `AWS::Timestream::Table`
@@ -273,6 +317,46 @@ module Aws::CloudTrail
     #
     #     ^
     #
+    #     When resources.type equals `AWS::B2BI::Transformer`, and the
+    #     operator is set to `Equals` or `NotEquals`, the ARN must be in the
+    #     following format:
+    #
+    #     * `arn:<partition>:b2bi:<region>:<account_ID>:transformer/<transformer_ID>`
+    #
+    #     ^
+    #
+    #     When resources.type equals `AWS::Bedrock::AgentAlias`, and the
+    #     operator is set to `Equals` or `NotEquals`, the ARN must be in the
+    #     following format:
+    #
+    #     * `arn:<partition>:bedrock:<region>:<account_ID>:agent-alias/<agent_ID>/<alias_ID>`
+    #
+    #     ^
+    #
+    #     When resources.type equals `AWS::Bedrock::KnowledgeBase`, and the
+    #     operator is set to `Equals` or `NotEquals`, the ARN must be in the
+    #     following format:
+    #
+    #     * `arn:<partition>:bedrock:<region>:<account_ID>:knowledge-base/<knowledge_base_ID>`
+    #
+    #     ^
+    #
+    #     When resources.type equals `AWS::Cassandra::Table`, and the
+    #     operator is set to `Equals` or `NotEquals`, the ARN must be in the
+    #     following format:
+    #
+    #     * `arn:<partition>:cassandra:<region>:<account_ID>:/keyspace/<keyspace_name>/table/<table_name>`
+    #
+    #     ^
+    #
+    #     When resources.type equals `AWS::CloudFront::KeyValueStore`, and
+    #     the operator is set to `Equals` or `NotEquals`, the ARN must be in
+    #     the following format:
+    #
+    #     * `arn:<partition>:cloudfront:<region>:<account_ID>:key-value-store/<KVS_name>`
+    #
+    #     ^
+    #
     #     When resources.type equals `AWS::CloudTrail::Channel`, and the
     #     operator is set to `Equals` or `NotEquals`, the ARN must be in the
     #     following format:
@@ -325,7 +409,7 @@ module Aws::CloudTrail
     #     operator is set to `Equals` or `NotEquals`, the ARN must be in the
     #     following format:
     #
-    #     * `arn:<partition>:emrwal:<region>::workspace/<workspace_name>`
+    #     * `arn:<partition>:emrwal:<region>:<account_ID>:workspace/<workspace_name>`
     #
     #     ^
     #
@@ -353,6 +437,22 @@ module Aws::CloudTrail
     #
     #     ^
     #
+    #     When `resources.type` equals `AWS::IoTTwinMaker::Entity`, and the
+    #     operator is set to `Equals` or `NotEquals`, the ARN must be in the
+    #     following format:
+    #
+    #     * `arn:<partition>:iottwinmaker:<region>:<account_ID>:workspace/<workspace_ID>/entity/<entity_ID>`
+    #
+    #     ^
+    #
+    #     When `resources.type` equals `AWS::IoTTwinMaker::Workspace`, and
+    #     the operator is set to `Equals` or `NotEquals`, the ARN must be in
+    #     the following format:
+    #
+    #     * `arn:<partition>:iottwinmaker:<region>:<account_ID>:workspace/<workspace_ID>`
+    #
+    #     ^
+    #
     #     When `resources.type` equals `AWS::KendraRanking::ExecutionPlan`,
     #     and the operator is set to `Equals` or `NotEquals`, the ARN must
     #     be in the following format:
@@ -365,7 +465,7 @@ module Aws::CloudTrail
     #     operator is set to `Equals` or `NotEquals`, the ARN must be in the
     #     following format:
     #
-    #     * `arn:<partition>:kinesisvideo:<region>:<account_ID>:stream/<stream_name/<creation_time>`
+    #     * `arn:<partition>:kinesisvideo:<region>:<account_ID>:stream/<stream_name>/<creation_time>`
     #
     #     ^
     #
@@ -393,6 +493,14 @@ module Aws::CloudTrail
     #
     #     ^
     #
+    #     When `resources.type` equals `AWS::NeptuneGraph::Graph`, and the
+    #     operator is set to `Equals` or `NotEquals`, the ARN must be in the
+    #     following format:
+    #
+    #     * `arn:<partition>:neptune-graph:<region>:<account_ID>:graph/<graph_ID>`
+    #
+    #     ^
+    #
     #     When `resources.type` equals `AWS::PCAConnectorAD::Connector`, and
     #     the operator is set to `Equals` or `NotEquals`, the ARN must be in
     #     the following format:
@@ -401,6 +509,46 @@ module Aws::CloudTrail
     #
     #     ^
     #
+    #     When `resources.type` equals `AWS::QBusiness::Application`, and
+    #     the operator is set to `Equals` or `NotEquals`, the ARN must be in
+    #     the following format:
+    #
+    #     * `arn:<partition>:qbusiness:<region>:<account_ID>:application/<application_ID>`
+    #
+    #     ^
+    #
+    #     When `resources.type` equals `AWS::QBusiness::DataSource`, and the
+    #     operator is set to `Equals` or `NotEquals`, the ARN must be in the
+    #     following format:
+    #
+    #     * `arn:<partition>:qbusiness:<region>:<account_ID>:application/<application_ID>/index/<index_ID>/data-source/<datasource_ID>`
+    #
+    #     ^
+    #
+    #     When `resources.type` equals `AWS::QBusiness::Index`, and the
+    #     operator is set to `Equals` or `NotEquals`, the ARN must be in the
+    #     following format:
+    #
+    #     * `arn:<partition>:qbusiness:<region>:<account_ID>:application/<application_ID>/index/<index_ID>`
+    #
+    #     ^
+    #
+    #     When `resources.type` equals `AWS::QBusiness::WebExperience`, and
+    #     the operator is set to `Equals` or `NotEquals`, the ARN must be in
+    #     the following format:
+    #
+    #     * `arn:<partition>:qbusiness:<region>:<account_ID>:application/<application_ID>/web-experience/<web_experience_ID>`
+    #
+    #     ^
+    #
+    #     When `resources.type` equals `AWS::RDS::DBCluster`, and the
+    #     operator is set to `Equals` or `NotEquals`, the ARN must be in the
+    #     following format:
+    #
+    #     * `arn:<partition>:rds:<region>:<account_ID>:cluster/<cluster_name>`
+    #
+    #     ^
+    #
     #     When `resources.type` equals `AWS::SageMaker::Endpoint`, and the
     #     operator is set to `Equals` or `NotEquals`, the ARN must be in the
     #     following format:
@@ -426,6 +574,30 @@ module Aws::CloudTrail
     #
     #     ^
     #
+    #     When `resources.type` equals `AWS::SCN::Instance`, and the
+    #     operator is set to `Equals` or `NotEquals`, the ARN must be in the
+    #     following format:
+    #
+    #     * `arn:<partition>:scn:<region>:<account_ID>:instance/<instance_ID>`
+    #
+    #     ^
+    #
+    #     When `resources.type` equals `AWS::ServiceDiscovery::Namespace`,
+    #     and the operator is set to `Equals` or `NotEquals`, the ARN must
+    #     be in the following format:
+    #
+    #     * `arn:<partition>:servicediscovery:<region>:<account_ID>:namespace/<namespace_ID>`
+    #
+    #     ^
+    #
+    #     When `resources.type` equals `AWS::ServiceDiscovery::Service`, and
+    #     the operator is set to `Equals` or `NotEquals`, the ARN must be in
+    #     the following format:
+    #
+    #     * `arn:<partition>:servicediscovery:<region>:<account_ID>:service/<service_ID>`
+    #
+    #     ^
+    #
     #     When `resources.type` equals `AWS::SNS::PlatformEndpoint`, and the
     #     operator is set to `Equals` or `NotEquals`, the ARN must be in the
     #     following format:
@@ -442,6 +614,14 @@ module Aws::CloudTrail
     #
     #     ^
     #
+    #     When `resources.type` equals `AWS::SQS::Queue`, and the operator
+    #     is set to `Equals` or `NotEquals`, the ARN must be in the
+    #     following format:
+    #
+    #     * `arn:<partition>:sqs:<region>:<account_ID>:<queue_name>`
+    #
+    #     ^
+    #
     #     When `resources.type` equals `AWS::S3::AccessPoint`, and the
     #     operator is set to `Equals` or `NotEquals`, the ARN must be in one
     #     of the following formats. To log events on all objects in an S3
@@ -477,6 +657,22 @@ module Aws::CloudTrail
     #
     #     ^
     #
+    #     When `resources.type` equals `AWS::ThinClient::Device`, and the
+    #     operator is set to `Equals` or `NotEquals`, the ARN must be in the
+    #     following format:
+    #
+    #     * `arn:<partition>:thinclient:<region>:<account_ID>:device/<device_ID>`
+    #
+    #     ^
+    #
+    #     When `resources.type` equals `AWS::ThinClient::Environment`, and
+    #     the operator is set to `Equals` or `NotEquals`, the ARN must be in
+    #     the following format:
+    #
+    #     * `arn:<partition>:thinclient:<region>:<account_ID>:environment/<environment_ID>`
+    #
+    #     ^
+    #
     #     When `resources.type` equals `AWS::Timestream::Database`, and the
     #     operator is set to `Equals` or `NotEquals`, the ARN must be in the
     #     following format:
@@ -1106,11 +1302,6 @@ module Aws::CloudTrail
     #   account.
     #
     #   Not required unless you specify `CloudWatchLogsRoleArn`.
-    #
-    #   <note markdown="1"> Only the management account can configure a CloudWatch Logs log
-    #   group for an organization trail.
-    #
-    #    </note>
     #   @return [String]
     #
     # @!attribute [rw] cloud_watch_logs_role_arn
@@ -1339,67 +1530,9 @@ module Aws::CloudTrail
     #
     #   * `AWS::S3::Object`
     #
-    #   The following resource types are also available through *advanced*
-    #   event selectors. Basic event selector resource types are valid in
-    #   advanced event selectors, but advanced event selector resource types
-    #   are not valid in basic event selectors. For more information, see
-    #   [AdvancedFieldSelector][1].
-    #
-    #   * `AWS::CloudTrail::Channel`
-    #
-    #   * `AWS::CodeWhisperer::Customization`
-    #
-    #   * `AWS::CodeWhisperer::Profile`
-    #
-    #   * `AWS::Cognito::IdentityPool`
-    #
-    #   * `AWS::DynamoDB::Stream`
-    #
-    #   * `AWS::EC2::Snapshot`
-    #
-    #   * `AWS::EMRWAL::Workspace`
-    #
-    #   * `AWS::FinSpace::Environment`
-    #
-    #   * `AWS::Glue::Table`
-    #
-    #   * `AWS::GuardDuty::Detector`
-    #
-    #   * `AWS::KendraRanking::ExecutionPlan`
-    #
-    #   * `AWS::KinesisVideo::Stream`
-    #
-    #   * `AWS::ManagedBlockchain::Network`
-    #
-    #   * `AWS::ManagedBlockchain::Node`
-    #
-    #   * `AWS::MedicalImaging::Datastore`
-    #
-    #   * `AWS::PCAConnectorAD::Connector`
-    #
-    #   * `AWS::SageMaker::Endpoint`
-    #
-    #   * `AWS::SageMaker::ExperimentTrialComponent`
-    #
-    #   * `AWS::SageMaker::FeatureGroup`
-    #
-    #   * `AWS::SNS::PlatformEndpoint`
-    #
-    #   * `AWS::SNS::Topic`
-    #
-    #   * `AWS::S3::AccessPoint`
-    #
-    #   * `AWS::S3ObjectLambda::AccessPoint`
-    #
-    #   * `AWS::S3Outposts::Object`
-    #
-    #   * `AWS::SSMMessages::ControlChannel`
-    #
-    #   * `AWS::Timestream::Database`
-    #
-    #   * `AWS::Timestream::Table`
-    #
-    #   * `AWS::VerifiedPermissions::PolicyStore`
+    #   Additional resource types are available through *advanced* event
+    #   selectors. For more information about these additional resource
+    #   types, see [AdvancedFieldSelector][1].
     #
     #
     #
@@ -1712,7 +1845,7 @@ module Aws::CloudTrail
     # @!attribute [rw] type
     #   The type of destination for events arriving from a channel. For
     #   channels used for a CloudTrail Lake integration, the value is
-    #   `EventDataStore`. For service-linked channels, the value is
+    #   `EVENT_DATA_STORE`. For service-linked channels, the value is
     #   `AWS_SERVICE`.
     #   @return [String]
     #
@@ -3371,6 +3504,148 @@ module Aws::CloudTrail
       include Aws::Structure
     end
 
+    # @!attribute [rw] event_source
+    #   The Amazon Web Services service to which the request was made, such
+    #   as `iam.amazonaws.com` or `s3.amazonaws.com`.
+    #   @return [String]
+    #
+    # @!attribute [rw] event_name
+    #   The name of the event, typically the Amazon Web Services API on
+    #   which unusual levels of activity were recorded.
+    #   @return [String]
+    #
+    # @!attribute [rw] insight_type
+    #   The type of CloudTrail Insights event, which is either
+    #   `ApiCallRateInsight` or `ApiErrorRateInsight`. The
+    #   `ApiCallRateInsight` Insights type analyzes write-only management
+    #   API calls that are aggregated per minute against a baseline API call
+    #   volume. The `ApiErrorRateInsight` Insights type analyzes management
+    #   API calls that result in error codes.
+    #   @return [String]
+    #
+    # @!attribute [rw] error_code
+    #   Conditionally required if the `InsightType` parameter is set to
+    #   `ApiErrorRateInsight`.
+    #
+    #   If returning metrics for the `ApiErrorRateInsight` Insights type,
+    #   this is the error to retrieve data for. For example, `AccessDenied`.
+    #   @return [String]
+    #
+    # @!attribute [rw] start_time
+    #   Specifies, in UTC, the start time for time-series data. The value
+    #   specified is inclusive; results include data points with the
+    #   specified time stamp.
+    #
+    #   The default is 90 days before the time of request.
+    #   @return [Time]
+    #
+    # @!attribute [rw] end_time
+    #   Specifies, in UTC, the end time for time-series data. The value
+    #   specified is exclusive; results include data points up to the
+    #   specified time stamp.
+    #
+    #   The default is the time of request.
+    #   @return [Time]
+    #
+    # @!attribute [rw] period
+    #   Granularity of data to retrieve, in seconds. Valid values are `60`,
+    #   `300`, and `3600`. If you specify any other value, you will get an
+    #   error. The default is 3600 seconds.
+    #   @return [Integer]
+    #
+    # @!attribute [rw] data_type
+    #   Type of datapoints to return. Valid values are `NonZeroData` and
+    #   `FillWithZeros`. The default is `NonZeroData`.
+    #   @return [String]
+    #
+    # @!attribute [rw] max_results
+    #   The maximum number of datapoints to return. Valid values are
+    #   integers from 1 to 21600. The default value is 21600.
+    #   @return [Integer]
+    #
+    # @!attribute [rw] next_token
+    #   Returned if all datapoints can't be returned in a single call. For
+    #   example, due to reaching `MaxResults`.
+    #
+    #   Add this parameter to the request to continue retrieving results
+    #   starting from the last evaluated point.
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/cloudtrail-2013-11-01/ListInsightsMetricDataRequest AWS API Documentation
+    #
+    class ListInsightsMetricDataRequest < Struct.new(
+      :event_source,
+      :event_name,
+      :insight_type,
+      :error_code,
+      :start_time,
+      :end_time,
+      :period,
+      :data_type,
+      :max_results,
+      :next_token)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # @!attribute [rw] event_source
+    #   The Amazon Web Services service to which the request was made, such
+    #   as `iam.amazonaws.com` or `s3.amazonaws.com`.
+    #   @return [String]
+    #
+    # @!attribute [rw] event_name
+    #   The name of the event, typically the Amazon Web Services API on
+    #   which unusual levels of activity were recorded.
+    #   @return [String]
+    #
+    # @!attribute [rw] insight_type
+    #   The type of CloudTrail Insights event, which is either
+    #   `ApiCallRateInsight` or `ApiErrorRateInsight`. The
+    #   `ApiCallRateInsight` Insights type analyzes write-only management
+    #   API calls that are aggregated per minute against a baseline API call
+    #   volume. The `ApiErrorRateInsight` Insights type analyzes management
+    #   API calls that result in error codes.
+    #   @return [String]
+    #
+    # @!attribute [rw] error_code
+    #   Only returned if `InsightType` parameter was set to
+    #   `ApiErrorRateInsight`.
+    #
+    #   If returning metrics for the `ApiErrorRateInsight` Insights type,
+    #   this is the error to retrieve data for. For example, `AccessDenied`.
+    #   @return [String]
+    #
+    # @!attribute [rw] timestamps
+    #   List of timestamps at intervals corresponding to the specified time
+    #   period.
+    #   @return [Array<Time>]
+    #
+    # @!attribute [rw] values
+    #   List of values representing the API call rate or error rate at each
+    #   timestamp. The number of values is equal to the number of
+    #   timestamps.
+    #   @return [Array<Float>]
+    #
+    # @!attribute [rw] next_token
+    #   Only returned if the full results could not be returned in a single
+    #   query. You can set the `NextToken` parameter in the next request to
+    #   this value to continue retrieval.
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/cloudtrail-2013-11-01/ListInsightsMetricDataResponse AWS API Documentation
+    #
+    class ListInsightsMetricDataResponse < Struct.new(
+      :event_source,
+      :event_name,
+      :insight_type,
+      :error_code,
+      :timestamps,
+      :values,
+      :next_token)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
     # Requests the public keys for a specified time range.
     #
     # @!attribute [rw] start_time
@@ -5248,11 +5523,6 @@ module Aws::CloudTrail
     #   account.
     #
     #   Not required unless you specify `CloudWatchLogsRoleArn`.
-    #
-    #   <note markdown="1"> Only the management account can configure a CloudWatch Logs log
-    #   group for an organization trail.
-    #
-    #    </note>
     #   @return [String]
     #
     # @!attribute [rw] cloud_watch_logs_role_arn

data/lib/aws-sdk-cloudtrail.rb

@@ -52,6 +52,6 @@ require_relative 'aws-sdk-cloudtrail/customizations'
 # @!group service
 module Aws::CloudTrail
 
-  GEM_VERSION = '1.74.0'
+  GEM_VERSION = '1.75.0'
 
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: aws-sdk-cloudtrail
 version: !ruby/object:Gem::Version
-  version: 1.74.0
+  version: 1.75.0
 platform: ruby
 authors:
 - Amazon Web Services
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-11-28 00:00:00.000000000 Z
+date: 2024-01-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk-core
@@ -72,7 +72,7 @@ licenses:
 metadata:
   source_code_uri: https://github.com/aws/aws-sdk-ruby/tree/version-3/gems/aws-sdk-cloudtrail
   changelog_uri: https://github.com/aws/aws-sdk-ruby/tree/version-3/gems/aws-sdk-cloudtrail/CHANGELOG.md
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -87,8 +87,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.1.6
-signing_key: 
+rubygems_version: 3.4.10
+signing_key:
 specification_version: 4
 summary: AWS SDK for Ruby - CloudTrail
 test_files: []