aws-sdk-cloudwatchlogs 1.117.0 → 1.118.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 61f8f6e110cda61d882df71d1e7d901c36a2d54cbcb9e413061d2403ab365de1
-  data.tar.gz: f612ed28b92c6072b6c4710c28247e449b7a0a0e65632cb7fa978776b0cd6d08
+  metadata.gz: 23dc8be85a62f92df26846e57ce1fcb2fad5ecf49af8d4f04d5fdb90e738f0f4
+  data.tar.gz: ce4159d3bcb415937333a408651ff2b86e23569787c8a3f28411ff90c63d0dd1
 SHA512:
-  metadata.gz: 5a77cf21deef8e63c47c305dd717a8cec23943925ffd100702b25e595503f4e4a9b28b7c8cb30402217afb7e7e420e65b61bd2e3f439843b808a3263d9cfec33
-  data.tar.gz: 3b023c51ac34db04a2eaf8e4cca08cfb4e83dcd71f7a58c8bc67514f4ba3638952f973883976c545c3697b200cb00e6fb092fe54771759b1be506b96c1eb009f
+  metadata.gz: f6dedafa8bcdc23044187dba186e5c3ac7ecf2c67f2b0f1a95af67cfd68f288031889d873a3c177aeb8fee020b5d55859bfe27f8df137f961140c25a56c335f2
+  data.tar.gz: 329b7298a7ccd7a0cccc850b2664ccd5ff87f87a4238f5b5486e4f913bd56779534dc89d3cb32369404647fe01c207e00136b9cda7d19a986faaf30d7044e017

data/CHANGELOG.md

@@ -1,6 +1,11 @@
 Unreleased Changes
 ------------------
 
+1.118.0 (2025-06-18)
+------------------
+
+* Feature - Added CloudWatch Logs Transformer support for converting CloudTrail, VPC Flow, EKS Audit, AWS WAF and Route53 Resolver logs to OCSF v1.1 format.
+
 1.117.0 (2025-06-02)
 ------------------
 

data/VERSION

@@ -1 +1 @@
-1.117.0
+1.118.0

data/lib/aws-sdk-cloudwatchlogs/client.rb

@@ -3808,6 +3808,9 @@ module Aws::CloudWatchLogs
     #   resp.transformer_config[0].parse_key_value.non_match_value #=> String
     #   resp.transformer_config[0].parse_key_value.overwrite_if_exists #=> Boolean
     #   resp.transformer_config[0].parse_route_53.source #=> String
+    #   resp.transformer_config[0].parse_to_ocsf.source #=> String
+    #   resp.transformer_config[0].parse_to_ocsf.event_source #=> String, one of "CloudTrail", "Route53Resolver", "VPCFlow", "EKSAudit", "AWSWAF"
+    #   resp.transformer_config[0].parse_to_ocsf.ocsf_version #=> String, one of "V1.1"
     #   resp.transformer_config[0].parse_postgres.source #=> String
     #   resp.transformer_config[0].parse_vpc.source #=> String
     #   resp.transformer_config[0].parse_waf.source #=> String
@@ -4983,11 +4986,14 @@ module Aws::CloudWatchLogs
     #     `AD_DECISION_SERVER_LOGS`, `MANIFEST_SERVICE_LOGS`, and
     #     `TRANSCODE_LOGS`.
     #
+    #   * For Entity Resolution, the valid value is `WORKFLOW_LOGS`.
+    #
     #   * For IAM Identity Center, the valid value is `ERROR_LOGS`.
     #
     #   * For Amazon Q, the valid value is `EVENT_LOGS`.
     #
-    #   * For Amazon SES mail manager, the valid value is `APPLICATION_LOG`.
+    #   * For Amazon SES mail manager, the valid values are `APPLICATION_LOG`
+    #     and `TRAFFIC_POLICY_DEBUG_LOGS`.
     #
     #   * For Amazon WorkMail, the valid values are `ACCESS_CONTROL_LOGS`,
     #     `AUTHENTICATION_LOGS`, `WORKMAIL_AVAILABILITY_PROVIDER_LOGS`,
@@ -5345,12 +5351,11 @@ module Aws::CloudWatchLogs
     #   as the sum of all event messages in UTF-8, plus 26 bytes for each
     #   log event.
     #
-    # * None of the log events in the batch can be more than 2 hours in the
-    #   future.
+    # * Events more than 2 hours in the future are rejected while processing
+    #   remaining valid events.
     #
-    # * None of the log events in the batch can be more than 14 days in the
-    #   past. Also, none of the log events can be from earlier than the
-    #   retention period of the log group.
+    # * Events older than 14 days or preceding the log group's retention
+    #   period are rejected while processing remaining valid events.
     #
     # * The log events in the batch must be in chronological order by their
     #   timestamp. The timestamp is the time that the event occurred,
@@ -5359,17 +5364,21 @@ module Aws::CloudWatchLogs
     #   Web Services SDK for .NET, the timestamp is specified in .NET
     #   format: `yyyy-mm-ddThh:mm:ss`. For example, `2017-09-15T13:45:30`.)
     #
-    # * A batch of log events in a single request cannot span more than 24
-    #   hours. Otherwise, the operation fails.
+    # * A batch of log events in a single request must be in a chronological
+    #   order. Otherwise, the operation fails.
     #
     # * Each log event can be no larger than 1 MB.
     #
     # * The maximum number of log events in a batch is 10,000.
     #
-    # * The quota of five requests per second per log stream has been
-    #   removed. Instead, `PutLogEvents` actions are throttled based on a
-    #   per-second per-account quota. You can request an increase to the
-    #   per-second throttling quota by using the Service Quotas service.
+    # * For valid events (within 14 days in the past to 2 hours in future),
+    #   the time span in a single batch cannot exceed 24 hours. Otherwise,
+    #   the operation fails.
+    #
+    # The quota of five requests per second per log stream has been removed.
+    # Instead, `PutLogEvents` actions are throttled based on a per-second
+    # per-account quota. You can request an increase to the per-second
+    # throttling quota by using the Service Quotas service.
     #
     # If a call to `PutLogEvents` returns "UnrecognizedClientException"
     # the most likely cause is a non-valid Amazon Web Services access key ID
@@ -6050,6 +6059,11 @@ module Aws::CloudWatchLogs
     #         parse_route_53: {
     #           source: "Source",
     #         },
+    #         parse_to_ocsf: {
+    #           source: "Source",
+    #           event_source: "CloudTrail", # required, accepts CloudTrail, Route53Resolver, VPCFlow, EKSAudit, AWSWAF
+    #           ocsf_version: "V1.1", # required, accepts V1.1
+    #         },
     #         parse_postgres: {
     #           source: "Source",
     #         },
@@ -6850,6 +6864,11 @@ module Aws::CloudWatchLogs
     #         parse_route_53: {
     #           source: "Source",
     #         },
+    #         parse_to_ocsf: {
+    #           source: "Source",
+    #           event_source: "CloudTrail", # required, accepts CloudTrail, Route53Resolver, VPCFlow, EKSAudit, AWSWAF
+    #           ocsf_version: "V1.1", # required, accepts V1.1
+    #         },
     #         parse_postgres: {
     #           source: "Source",
     #         },
@@ -7198,7 +7217,7 @@ module Aws::CloudWatchLogs
         tracer: tracer
       )
       context[:gem_name] = 'aws-sdk-cloudwatchlogs'
-      context[:gem_version] = '1.117.0'
+      context[:gem_version] = '1.118.0'
       Seahorse::Client::Request.new(handlers, context)
     end
 

data/lib/aws-sdk-cloudwatchlogs/client_api.rb

@@ -176,6 +176,7 @@ module Aws::CloudWatchLogs
     EventId = Shapes::StringShape.new(name: 'EventId')
     EventMessage = Shapes::StringShape.new(name: 'EventMessage')
     EventNumber = Shapes::IntegerShape.new(name: 'EventNumber')
+    EventSource = Shapes::StringShape.new(name: 'EventSource')
     EventsLimit = Shapes::IntegerShape.new(name: 'EventsLimit')
     ExportDestinationBucket = Shapes::StringShape.new(name: 'ExportDestinationBucket')
     ExportDestinationPrefix = Shapes::StringShape.new(name: 'ExportDestinationPrefix')
@@ -333,6 +334,7 @@ module Aws::CloudWatchLogs
     MoveKeys = Shapes::StructureShape.new(name: 'MoveKeys')
     NextToken = Shapes::StringShape.new(name: 'NextToken')
     NonMatchValue = Shapes::StringShape.new(name: 'NonMatchValue')
+    OCSFVersion = Shapes::StringShape.new(name: 'OCSFVersion')
     OpenSearchApplication = Shapes::StructureShape.new(name: 'OpenSearchApplication')
     OpenSearchApplicationEndpoint = Shapes::StringShape.new(name: 'OpenSearchApplicationEndpoint')
     OpenSearchApplicationId = Shapes::StringShape.new(name: 'OpenSearchApplicationId')
@@ -363,6 +365,7 @@ module Aws::CloudWatchLogs
     ParseKeyValue = Shapes::StructureShape.new(name: 'ParseKeyValue')
     ParsePostgres = Shapes::StructureShape.new(name: 'ParsePostgres')
     ParseRoute53 = Shapes::StructureShape.new(name: 'ParseRoute53')
+    ParseToOCSF = Shapes::StructureShape.new(name: 'ParseToOCSF')
     ParseVPC = Shapes::StructureShape.new(name: 'ParseVPC')
     ParseWAF = Shapes::StructureShape.new(name: 'ParseWAF')
     ParserFieldDelimiter = Shapes::StringShape.new(name: 'ParserFieldDelimiter')
@@ -1507,6 +1510,11 @@ module Aws::CloudWatchLogs
     ParseRoute53.add_member(:source, Shapes::ShapeRef.new(shape: Source, location_name: "source"))
     ParseRoute53.struct_class = Types::ParseRoute53
 
+    ParseToOCSF.add_member(:source, Shapes::ShapeRef.new(shape: Source, location_name: "source"))
+    ParseToOCSF.add_member(:event_source, Shapes::ShapeRef.new(shape: EventSource, required: true, location_name: "eventSource"))
+    ParseToOCSF.add_member(:ocsf_version, Shapes::ShapeRef.new(shape: OCSFVersion, required: true, location_name: "ocsfVersion"))
+    ParseToOCSF.struct_class = Types::ParseToOCSF
+
     ParseVPC.add_member(:source, Shapes::ShapeRef.new(shape: Source, location_name: "source"))
     ParseVPC.struct_class = Types::ParseVPC
 
@@ -1538,6 +1546,7 @@ module Aws::CloudWatchLogs
     Processor.add_member(:parse_json, Shapes::ShapeRef.new(shape: ParseJSON, location_name: "parseJSON"))
     Processor.add_member(:parse_key_value, Shapes::ShapeRef.new(shape: ParseKeyValue, location_name: "parseKeyValue"))
     Processor.add_member(:parse_route_53, Shapes::ShapeRef.new(shape: ParseRoute53, location_name: "parseRoute53"))
+    Processor.add_member(:parse_to_ocsf, Shapes::ShapeRef.new(shape: ParseToOCSF, location_name: "parseToOCSF"))
     Processor.add_member(:parse_postgres, Shapes::ShapeRef.new(shape: ParsePostgres, location_name: "parsePostgres"))
     Processor.add_member(:parse_vpc, Shapes::ShapeRef.new(shape: ParseVPC, location_name: "parseVPC"))
     Processor.add_member(:parse_waf, Shapes::ShapeRef.new(shape: ParseWAF, location_name: "parseWAF"))

data/lib/aws-sdk-cloudwatchlogs/types.rb

@@ -5419,6 +5419,42 @@ module Aws::CloudWatchLogs
       include Aws::Structure
     end
 
+    # This processor converts logs into [Open Cybersecurity Schema Framework
+    # (OCSF)][1] events.
+    #
+    # For more information about this processor including examples, see [
+    # parseToOSCF][2] in the *CloudWatch Logs User Guide*.
+    #
+    #
+    #
+    # [1]: https://ocsf.io
+    # [2]: https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-parseToOCSF
+    #
+    # @!attribute [rw] source
+    #   The path to the field in the log event that you want to parse. If
+    #   you omit this value, the whole log message is parsed.
+    #   @return [String]
+    #
+    # @!attribute [rw] event_source
+    #   Specify the service or process that produces the log events that
+    #   will be converted with this processor.
+    #   @return [String]
+    #
+    # @!attribute [rw] ocsf_version
+    #   Specify which version of the OCSF schema to use for the transformed
+    #   log events.
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/logs-2014-03-28/ParseToOCSF AWS API Documentation
+    #
+    class ParseToOCSF < Struct.new(
+      :source,
+      :event_source,
+      :ocsf_version)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
     # Use this processor to parse Amazon VPC vended logs, extract fields,
     # and and convert them into a JSON format. This processor always
     # processes the entire log event message.
@@ -5678,6 +5714,11 @@ module Aws::CloudWatchLogs
     #   [1]: https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-parseRoute53
     #   @return [Types::ParseRoute53]
     #
+    # @!attribute [rw] parse_to_ocsf
+    #   Use this processor to convert logs into Open Cybersecurity Schema
+    #   Framework (OCSF) format
+    #   @return [Types::ParseToOCSF]
+    #
     # @!attribute [rw] parse_postgres
     #   Use this parameter to include the [ parsePostGres][1] processor in
     #   your transformer.
@@ -5784,6 +5825,7 @@ module Aws::CloudWatchLogs
       :parse_json,
       :parse_key_value,
       :parse_route_53,
+      :parse_to_ocsf,
       :parse_postgres,
       :parse_vpc,
       :parse_waf,
@@ -6154,11 +6196,14 @@ module Aws::CloudWatchLogs
     #     `AD_DECISION_SERVER_LOGS`, `MANIFEST_SERVICE_LOGS`, and
     #     `TRANSCODE_LOGS`.
     #
+    #   * For Entity Resolution, the valid value is `WORKFLOW_LOGS`.
+    #
     #   * For IAM Identity Center, the valid value is `ERROR_LOGS`.
     #
     #   * For Amazon Q, the valid value is `EVENT_LOGS`.
     #
-    #   * For Amazon SES mail manager, the valid value is `APPLICATION_LOG`.
+    #   * For Amazon SES mail manager, the valid values are
+    #     `APPLICATION_LOG` and `TRAFFIC_POLICY_DEBUG_LOGS`.
     #
     #   * For Amazon WorkMail, the valid values are `ACCESS_CONTROL_LOGS`,
     #     `AUTHENTICATION_LOGS`, `WORKMAIL_AVAILABILITY_PROVIDER_LOGS`,

data/lib/aws-sdk-cloudwatchlogs.rb

@@ -55,7 +55,7 @@ module Aws::CloudWatchLogs
   autoload :Endpoints, 'aws-sdk-cloudwatchlogs/endpoints'
   autoload :EventStreams, 'aws-sdk-cloudwatchlogs/event_streams'
 
-  GEM_VERSION = '1.117.0'
+  GEM_VERSION = '1.118.0'
 
 end
 

data/sig/client.rbs

@@ -1068,6 +1068,11 @@ module Aws
                                  parse_route_53: {
                                    source: ::String?
                                  }?,
+                                 parse_to_ocsf: {
+                                   source: ::String?,
+                                   event_source: ("CloudTrail" | "Route53Resolver" | "VPCFlow" | "EKSAudit" | "AWSWAF"),
+                                   ocsf_version: ("V1.1")
+                                 }?,
                                  parse_postgres: {
                                    source: ::String?
                                  }?,
@@ -1274,6 +1279,11 @@ module Aws
                                   parse_route_53: {
                                     source: ::String?
                                   }?,
+                                  parse_to_ocsf: {
+                                    source: ::String?,
+                                    event_source: ("CloudTrail" | "Route53Resolver" | "VPCFlow" | "EKSAudit" | "AWSWAF"),
+                                    ocsf_version: ("V1.1")
+                                  }?,
                                   parse_postgres: {
                                     source: ::String?
                                   }?,

data/sig/types.rbs

@@ -1214,6 +1214,13 @@ module Aws::CloudWatchLogs
       SENSITIVE: []
     end
 
+    class ParseToOCSF
+      attr_accessor source: ::String
+      attr_accessor event_source: ("CloudTrail" | "Route53Resolver" | "VPCFlow" | "EKSAudit" | "AWSWAF")
+      attr_accessor ocsf_version: ("V1.1")
+      SENSITIVE: []
+    end
+
     class ParseVPC
       attr_accessor source: ::String
       SENSITIVE: []
@@ -1252,6 +1259,7 @@ module Aws::CloudWatchLogs
       attr_accessor parse_json: Types::ParseJSON
       attr_accessor parse_key_value: Types::ParseKeyValue
       attr_accessor parse_route_53: Types::ParseRoute53
+      attr_accessor parse_to_ocsf: Types::ParseToOCSF
       attr_accessor parse_postgres: Types::ParsePostgres
       attr_accessor parse_vpc: Types::ParseVPC
       attr_accessor parse_waf: Types::ParseWAF

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: aws-sdk-cloudwatchlogs
 version: !ruby/object:Gem::Version
-  version: 1.117.0
+  version: 1.118.0
 platform: ruby
 authors:
 - Amazon Web Services