@aws-sdk/client-cloudwatch-logs 3.347.1 → 3.350.0

package/dist-types/commands/DescribeLogGroupsCommand.d.ts

@@ -64,6 +64,9 @@ export interface DescribeLogGroupsCommandOutput extends DescribeLogGroupsRespons
  * //       storedBytes: Number("long"),
  * //       kmsKeyId: "STRING_VALUE",
  * //       dataProtectionStatus: "ACTIVATED" || "DELETED" || "ARCHIVED" || "DISABLED",
+ * //       inheritedProperties: [ // InheritedProperties
+ * //         "ACCOUNT_DATA_PROTECTION",
+ * //       ],
  * //     },
  * //   ],
  * //   nextToken: "STRING_VALUE",

package/dist-types/commands/FilterLogEventsCommand.d.ts

@@ -25,7 +25,7 @@ export interface FilterLogEventsCommandOutput extends FilterLogEventsResponse, _
  * @public
  * <p>Lists log events from the specified log group. You can list all the log events or filter the results
  *       using a filter pattern, a time range, and the name of the log stream.</p>
- *          <p>You must have the <code>logs;FilterLogEvents</code> permission to perform this operation.</p>
+ *          <p>You must have the <code>logs:FilterLogEvents</code> permission to perform this operation.</p>
  *          <p>You can specify the log group to search by using either <code>logGroupIdentifier</code> or <code>logGroupName</code>.
  *       You must include one of these two parameters, but you can't include both.
  *     </p>

package/dist-types/commands/PutAccountPolicyCommand.d.ts

@@ -0,0 +1,121 @@
+import { EndpointParameterInstructions } from "@aws-sdk/middleware-endpoint";
+import { Command as $Command } from "@aws-sdk/smithy-client";
+import { Handler, HttpHandlerOptions as __HttpHandlerOptions, MetadataBearer as __MetadataBearer, MiddlewareStack } from "@aws-sdk/types";
+import { CloudWatchLogsClientResolvedConfig, ServiceInputTypes, ServiceOutputTypes } from "../CloudWatchLogsClient";
+import { PutAccountPolicyRequest, PutAccountPolicyResponse } from "../models/models_0";
+/**
+ * @public
+ */
+export { __MetadataBearer, $Command };
+/**
+ * @public
+ *
+ * The input for {@link PutAccountPolicyCommand}.
+ */
+export interface PutAccountPolicyCommandInput extends PutAccountPolicyRequest {
+}
+/**
+ * @public
+ *
+ * The output of {@link PutAccountPolicyCommand}.
+ */
+export interface PutAccountPolicyCommandOutput extends PutAccountPolicyResponse, __MetadataBearer {
+}
+/**
+ * @public
+ * <p>Creates an account-level data protection policy that applies to all log groups in the account. A data protection policy can help safeguard sensitive
+ *       data that's ingested by your log groups by auditing and masking the sensitive log data. Each account can have only
+ *     one account-level policy.</p>
+ *          <important>
+ *             <p>Sensitive data is detected and masked when it is ingested into a log group. When you set a
+ *       data protection policy, log events ingested into the log groups before that time are not masked.</p>
+ *          </important>
+ *          <p>If you use <code>PutAccountPolicy</code> to create a data protection policy for your whole account, it applies to both existing log groups
+ *     and all log groups that are created later in this account. The account policy is applied to existing log groups
+ *     with eventual consistency. It might take up to 5 minutes before sensitive data in existing log groups begins to be masked.</p>
+ *          <p>By default, when a user views a log event that includes masked data, the sensitive data is replaced by asterisks.
+ *       A user who has the <code>logs:Unmask</code> permission can use a
+ *       <a href="https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_GetLogEvents.html">GetLogEvents</a> or
+ *       <a href="https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_FilterLogEvents.html">FilterLogEvents</a>
+ *       operation with the <code>unmask</code> parameter set to <code>true</code> to view the unmasked
+ *       log events. Users with the <code>logs:Unmask</code> can also view unmasked data in the CloudWatch Logs
+ *       console by running a CloudWatch Logs Insights query with the <code>unmask</code> query command.</p>
+ *          <p>For more information, including a list of types of data that can be audited and masked, see
+ *       <a href="https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/mask-sensitive-log-data.html">Protect sensitive log data with masking</a>.</p>
+ *          <p>To use the <code>PutAccountPolicy</code> operation, you must be signed on with the <code>logs:PutDataProtectionPolicy</code>
+ *     and <code>logs:PutAccountPolicy</code> permissions.</p>
+ *          <p>The <code>PutAccountPolicy</code> operation applies to all log groups in the account. You can also use
+ *       <a href="https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_PutDataProtectionPolicy.html">PutDataProtectionPolicy</a>
+ *       to create a data protection policy that applies to just one log group.
+ *       If a log group has its own data protection policy and
+ *       the account also has an account-level data protection policy, then the two policies are cumulative. Any sensitive term
+ *       specified in either policy is masked.</p>
+ * @example
+ * Use a bare-bones client and the command you need to make an API call.
+ * ```javascript
+ * import { CloudWatchLogsClient, PutAccountPolicyCommand } from "@aws-sdk/client-cloudwatch-logs"; // ES Modules import
+ * // const { CloudWatchLogsClient, PutAccountPolicyCommand } = require("@aws-sdk/client-cloudwatch-logs"); // CommonJS import
+ * const client = new CloudWatchLogsClient(config);
+ * const input = { // PutAccountPolicyRequest
+ *   policyName: "STRING_VALUE", // required
+ *   policyDocument: "STRING_VALUE", // required
+ *   policyType: "DATA_PROTECTION_POLICY", // required
+ *   scope: "ALL",
+ * };
+ * const command = new PutAccountPolicyCommand(input);
+ * const response = await client.send(command);
+ * // { // PutAccountPolicyResponse
+ * //   accountPolicy: { // AccountPolicy
+ * //     policyName: "STRING_VALUE",
+ * //     policyDocument: "STRING_VALUE",
+ * //     lastUpdatedTime: Number("long"),
+ * //     policyType: "DATA_PROTECTION_POLICY",
+ * //     scope: "ALL",
+ * //     accountId: "STRING_VALUE",
+ * //   },
+ * // };
+ *
+ * ```
+ *
+ * @param PutAccountPolicyCommandInput - {@link PutAccountPolicyCommandInput}
+ * @returns {@link PutAccountPolicyCommandOutput}
+ * @see {@link PutAccountPolicyCommandInput} for command's `input` shape.
+ * @see {@link PutAccountPolicyCommandOutput} for command's `response` shape.
+ * @see {@link CloudWatchLogsClientResolvedConfig | config} for CloudWatchLogsClient's `config` shape.
+ *
+ * @throws {@link InvalidParameterException} (client fault)
+ *  <p>A parameter is specified incorrectly.</p>
+ *
+ * @throws {@link LimitExceededException} (client fault)
+ *  <p>You have reached the maximum number of resources that can be created.</p>
+ *
+ * @throws {@link OperationAbortedException} (client fault)
+ *  <p>Multiple concurrent requests to update the same resource were in conflict.</p>
+ *
+ * @throws {@link ServiceUnavailableException} (server fault)
+ *  <p>The service cannot complete the request.</p>
+ *
+ * @throws {@link CloudWatchLogsServiceException}
+ * <p>Base exception class for all service exceptions from CloudWatchLogs service.</p>
+ *
+ */
+export declare class PutAccountPolicyCommand extends $Command<PutAccountPolicyCommandInput, PutAccountPolicyCommandOutput, CloudWatchLogsClientResolvedConfig> {
+    readonly input: PutAccountPolicyCommandInput;
+    static getEndpointParameterInstructions(): EndpointParameterInstructions;
+    /**
+     * @public
+     */
+    constructor(input: PutAccountPolicyCommandInput);
+    /**
+     * @internal
+     */
+    resolveMiddleware(clientStack: MiddlewareStack<ServiceInputTypes, ServiceOutputTypes>, configuration: CloudWatchLogsClientResolvedConfig, options?: __HttpHandlerOptions): Handler<PutAccountPolicyCommandInput, PutAccountPolicyCommandOutput>;
+    /**
+     * @internal
+     */
+    private serialize;
+    /**
+     * @internal
+     */
+    private deserialize;
+}

package/dist-types/commands/PutDataProtectionPolicyCommand.d.ts

@@ -38,6 +38,12 @@ export interface PutDataProtectionPolicyCommandOutput extends PutDataProtectionP
  *       console by running a CloudWatch Logs Insights query with the <code>unmask</code> query command.</p>
  *          <p>For more information, including a list of types of data that can be audited and masked, see
  *       <a href="https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/mask-sensitive-log-data.html">Protect sensitive log data with masking</a>.</p>
+ *          <p>The <code>PutDataProtectionPolicy</code> operation applies to only the specified log group. You can also use
+ *       <a href="https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_PutAccountPolicy.html">PutAccountPolicy</a>
+ *       to create an account-level data protection policy that applies to all log groups in the account,
+ *     including both existing log groups and log groups that are created level. If a log group has its own data protection policy and
+ *     the account also has an account-level data protection policy, then the two policies are cumulative. Any sensitive term
+ *     specified in either policy is masked.</p>
  * @example
  * Use a bare-bones client and the command you need to make an API call.
  * ```javascript

package/dist-types/commands/PutLogEventsCommand.d.ts

@@ -56,6 +56,9 @@ export interface PutLogEventsCommandOutput extends PutLogEventsResponse, __Metad
  *                <p>A batch of log events in a single request cannot span more than 24 hours. Otherwise, the operation fails.</p>
  *             </li>
  *             <li>
+ *                <p>Each log event can be no larger than 256 KB.</p>
+ *             </li>
+ *             <li>
  *                <p>The maximum number of log events in a batch is 10,000.</p>
  *             </li>
  *             <li>

package/dist-types/commands/PutSubscriptionFilterCommand.d.ts

@@ -49,7 +49,8 @@ export interface PutSubscriptionFilterCommandOutput extends __MetadataBearer {
  *          <p>Each log group can have up to two subscription filters associated with it. If you are
  *       updating an existing filter, you must specify the correct name in <code>filterName</code>.
  *       </p>
- *          <p>To perform a <code>PutSubscriptionFilter</code> operation, you must also have the
+ *          <p>To perform a <code>PutSubscriptionFilter</code> operation for any destination except a Lambda function,
+ *     you must also have the
  *       <code>iam:PassRole</code> permission.</p>
  * @example
  * Use a bare-bones client and the command you need to make an API call.

package/dist-types/commands/StartQueryCommand.d.ts

@@ -26,14 +26,14 @@ export interface StartQueryCommandOutput extends StartQueryResponse, __MetadataB
  * <p>Schedules a query of a log group using CloudWatch Logs Insights. You specify the log group
  *       and time range to query and the query string to use.</p>
  *          <p>For more information, see <a href="https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_QuerySyntax.html">CloudWatch Logs Insights Query Syntax</a>.</p>
- *          <p>Queries time out after 15 minutes of runtime. If your queries are timing out, reduce the
+ *          <p>Queries time out after 60 minutes of runtime. If your queries are timing out, reduce the
  *       time range being searched or partition your query into a number of queries.</p>
  *          <p>If you are using CloudWatch cross-account observability, you can use this operation in a
  *       monitoring account to start a query in a linked source account. For more information, see
  *         <a href="https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-Unified-Cross-Account.html">CloudWatch
  *         cross-account observability</a>. For a cross-account <code>StartQuery</code> operation,
  *       the query definition must be defined in the monitoring account.</p>
- *          <p>You can have up to 20 concurrent CloudWatch Logs insights queries, including queries
+ *          <p>You can have up to 30 concurrent CloudWatch Logs insights queries, including queries
  *       that have been added to dashboards. </p>
  * @example
  * Use a bare-bones client and the command you need to make an API call.

package/dist-types/commands/index.d.ts

@@ -3,6 +3,7 @@ export * from "./CancelExportTaskCommand";
 export * from "./CreateExportTaskCommand";
 export * from "./CreateLogGroupCommand";
 export * from "./CreateLogStreamCommand";
+export * from "./DeleteAccountPolicyCommand";
 export * from "./DeleteDataProtectionPolicyCommand";
 export * from "./DeleteDestinationCommand";
 export * from "./DeleteLogGroupCommand";
@@ -12,6 +13,7 @@ export * from "./DeleteQueryDefinitionCommand";
 export * from "./DeleteResourcePolicyCommand";
 export * from "./DeleteRetentionPolicyCommand";
 export * from "./DeleteSubscriptionFilterCommand";
+export * from "./DescribeAccountPoliciesCommand";
 export * from "./DescribeDestinationsCommand";
 export * from "./DescribeExportTasksCommand";
 export * from "./DescribeLogGroupsCommand";
@@ -30,6 +32,7 @@ export * from "./GetLogRecordCommand";
 export * from "./GetQueryResultsCommand";
 export * from "./ListTagsForResourceCommand";
 export * from "./ListTagsLogGroupCommand";
+export * from "./PutAccountPolicyCommand";
 export * from "./PutDataProtectionPolicyCommand";
 export * from "./PutDestinationCommand";
 export * from "./PutDestinationPolicyCommand";

package/dist-types/endpoint/EndpointParameters.d.ts

@@ -13,7 +13,7 @@ export declare const resolveClientEndpointParameters: <T>(options: T & ClientInp
     defaultSigningName: string;
 };
 export interface EndpointParameters extends __EndpointParameters {
-    Region: string;
+    Region?: string;
     UseDualStack?: boolean;
     UseFIPS?: boolean;
     Endpoint?: string;

package/dist-types/models/models_0.d.ts

@@ -1,5 +1,58 @@
 import { ExceptionOptionType as __ExceptionOptionType } from "@aws-sdk/smithy-client";
 import { CloudWatchLogsServiceException as __BaseException } from "./CloudWatchLogsServiceException";
+/**
+ * @public
+ * @enum
+ */
+export declare const PolicyType: {
+    readonly DATA_PROTECTION_POLICY: "DATA_PROTECTION_POLICY";
+};
+/**
+ * @public
+ */
+export type PolicyType = (typeof PolicyType)[keyof typeof PolicyType];
+/**
+ * @public
+ * @enum
+ */
+export declare const Scope: {
+    readonly ALL: "ALL";
+};
+/**
+ * @public
+ */
+export type Scope = (typeof Scope)[keyof typeof Scope];
+/**
+ * @public
+ * <p>A structure that contains information about one CloudWatch Logs account policy.</p>
+ */
+export interface AccountPolicy {
+    /**
+     * <p>The name of the account policy.</p>
+     */
+    policyName?: string;
+    /**
+     * <p>The policy document for this account policy.</p>
+     *          <p>The JSON specified in <code>policyDocument</code> can be up to 30,720 characters.</p>
+     */
+    policyDocument?: string;
+    /**
+     * <p>The date and time that this policy was most recently updated.</p>
+     */
+    lastUpdatedTime?: number;
+    /**
+     * <p>The type of policy for this account policy.</p>
+     */
+    policyType?: PolicyType | string;
+    /**
+     * <p>The scope of the account policy.</p>
+     */
+    scope?: Scope | string;
+    /**
+     * <p>The Amazon Web Services account ID that the policy applies to.</p>
+     */
+    accountId?: string;
+}
 /**
  * @public
  */
@@ -230,6 +283,19 @@ export declare const DataProtectionStatus: {
  * @public
  */
 export type DataProtectionStatus = (typeof DataProtectionStatus)[keyof typeof DataProtectionStatus];
+/**
+ * @public
+ */
+export interface DeleteAccountPolicyRequest {
+    /**
+     * <p>The name of the policy to delete.</p>
+     */
+    policyName: string | undefined;
+    /**
+     * <p>The type of policy to delete. Currently, the only valid value is <code>DATA_PROTECTION_POLICY</code>.</p>
+     */
+    policyType: PolicyType | string | undefined;
+}
 /**
  * @public
  */
@@ -334,6 +400,39 @@ export interface DeleteSubscriptionFilterRequest {
      */
     filterName: string | undefined;
 }
+/**
+ * @public
+ */
+export interface DescribeAccountPoliciesRequest {
+    /**
+     * <p>Use this parameter to limit the returned policies to only the policies that match the policy type that you
+     *       specify. Currently, the only valid value is <code>DATA_PROTECTION_POLICY</code>.</p>
+     */
+    policyType: PolicyType | string | undefined;
+    /**
+     * <p>Use this parameter to limit the returned policies to only the policy with the name that you specify.</p>
+     */
+    policyName?: string;
+    /**
+     * <p>If you are using an account that is set up as a monitoring account for CloudWatch unified cross-account
+     *       observability, you can use this to specify the account ID of a source account. If you do,
+     *       the operation returns the account policy for the specified account. Currently, you can specify only
+     *     one account ID in this parameter.</p>
+     *          <p>If you
+     *     omit this parameter, only the policy in the current account is returned.</p>
+     */
+    accountIdentifiers?: string[];
+}
+/**
+ * @public
+ */
+export interface DescribeAccountPoliciesResponse {
+    /**
+     * <p>An array of structures that contain information about the CloudWatch Logs account policies that match
+     *     the specified filters.</p>
+     */
+    accountPolicies?: AccountPolicy[];
+}
 /**
  * @public
  */
@@ -548,6 +647,9 @@ export interface DescribeLogGroupsRequest {
      * that match the string based on a case-sensitive substring search. For example, if you specify <code>Foo</code>, log groups
      * named <code>FooBar</code>, <code>aws/Foo</code>, and <code>GroupFoo</code> would match, but <code>foo</code>,
      * <code>F/o/o</code> and <code>Froo</code> would not match.</p>
+     *          <p>If you specify <code>logGroupNamePattern</code> in your request, then only
+     *         <code>arn</code>, <code>creationTime</code>, and <code>logGroupName</code>
+     *         are included in the response. </p>
      *          <note>
      *             <p>
      *                <code>logGroupNamePattern</code> and <code>logGroupNamePrefix</code> are mutually exclusive.
@@ -573,14 +675,20 @@ export interface DescribeLogGroupsRequest {
      *
      *       contains a null value, the operation returns all log groups in the monitoring account
      *       and all log groups in all source accounts that are linked to the monitoring account. </p>
-     *          <note>
-     *             <p> If you specify <code>includeLinkedAccounts</code> in your request, then
-     *         <code>metricFilterCount</code>, <code>retentionInDays</code>, and <code>storedBytes</code>
-     *         are not included in the response. </p>
-     *          </note>
      */
     includeLinkedAccounts?: boolean;
 }
+/**
+ * @public
+ * @enum
+ */
+export declare const InheritedProperty: {
+    readonly ACCOUNT_DATA_PROTECTION: "ACCOUNT_DATA_PROTECTION";
+};
+/**
+ * @public
+ */
+export type InheritedProperty = (typeof InheritedProperty)[keyof typeof InheritedProperty];
 /**
  * @public
  * <p>Represents a log group.</p>
@@ -597,7 +705,7 @@ export interface LogGroup {
     creationTime?: number;
     /**
      * <p>The number of days to retain the log events in the specified log group.
-     *       Possible values are: 1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, 2192, 2557, 2922, 3288, and 3653.</p>
+     *       Possible values are: 1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1096, 1827, 2192, 2557, 2922, 3288, and 3653.</p>
      *          <p>To set a log group so that its log events do not expire, use <a href="https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DeleteRetentionPolicy.html">DeleteRetentionPolicy</a>. </p>
      */
     retentionInDays?: number;
@@ -623,6 +731,11 @@ export interface LogGroup {
      *       <a href="https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_PutDataProtectionPolicy.html">PutDataProtectionPolicy</a>.</p>
      */
     dataProtectionStatus?: DataProtectionStatus | string;
+    /**
+     * <p>Displays all the properties that this log group has inherited from account-level
+     *     settings.</p>
+     */
+    inheritedProperties?: (InheritedProperty | string)[];
 }
 /**
  * @public
@@ -1651,7 +1764,7 @@ export interface GetQueryResultsResponse {
      * <p>The status of the most recent running of the query. Possible values are <code>Cancelled</code>,
      *       <code>Complete</code>, <code>Failed</code>, <code>Running</code>, <code>Scheduled</code>,
      *       <code>Timeout</code>, and <code>Unknown</code>.</p>
-     *          <p>Queries time out after 15 minutes of runtime. To avoid having your queries time out,
+     *          <p>Queries time out after 60 minutes of runtime. To avoid having your queries time out,
      *       reduce the time range being searched or partition your query into a number of queries.</p>
      */
     status?: QueryStatus | string;
@@ -1668,7 +1781,7 @@ export interface InputLogEvent {
      */
     timestamp: number | undefined;
     /**
-     * <p>The raw event message.</p>
+     * <p>The raw event message. Each log event can be no larger than 256 KB.</p>
      */
     message: string | undefined;
 }
@@ -1739,6 +1852,72 @@ export interface ListTagsLogGroupResponse {
      */
     tags?: Record<string, string>;
 }
+/**
+ * @public
+ */
+export interface PutAccountPolicyRequest {
+    /**
+     * <p>A name for the policy. This must be unique within the account.</p>
+     */
+    policyName: string | undefined;
+    /**
+     * <p>Specify the data protection policy, in JSON.</p>
+     *          <p>This policy must include two JSON blocks:</p>
+     *          <ul>
+     *             <li>
+     *                <p>The first block must include both a <code>DataIdentifer</code> array and an
+     *         <code>Operation</code> property with an <code>Audit</code> action. The <code>DataIdentifer</code> array lists the types of sensitive data that
+     *         you want to mask. For more information about the available options, see
+     *         <a href="https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/mask-sensitive-log-data-types.html">Types of data that you can mask</a>.</p>
+     *                <p>The <code>Operation</code> property with an <code>Audit</code> action is required to find the
+     *           sensitive data terms. This <code>Audit</code> action must contain a <code>FindingsDestination</code>
+     *           object. You can optionally use that <code>FindingsDestination</code> object to list one or more
+     *           destinations to send audit findings to. If you specify destinations such as log groups,
+     *           Kinesis Data Firehose streams, and S3 buckets, they must already exist.</p>
+     *             </li>
+     *             <li>
+     *                <p>The second block must include both a <code>DataIdentifer</code> array and an
+     *         <code>Operation</code> property with an <code>Deidentify</code> action. The
+     *         <code>DataIdentifer</code> array must exactly match the <code>DataIdentifer</code> array
+     *         in the first block of the policy.</p>
+     *                <p>The <code>Operation</code> property with the <code>Deidentify</code> action is what actually masks the
+     *           data, and it must
+     *           contain the <code>
+     *             "MaskConfig": \{\}</code> object. The <code>
+     *               "MaskConfig": \{\}</code> object must be empty.</p>
+     *             </li>
+     *          </ul>
+     *          <p>For an example data protection policy, see the <b>Examples</b> section on this page.</p>
+     *          <important>
+     *             <p>The contents of the two <code>DataIdentifer</code> arrays must match exactly.</p>
+     *          </important>
+     *          <p>In addition to the two JSON blocks, the <code>policyDocument</code> can also include <code>Name</code>,
+     *     <code>Description</code>, and <code>Version</code> fields. The <code>Name</code> is different than the
+     *       operation's <code>policyName</code> parameter, and is used as a dimension when
+     *     CloudWatch Logs reports audit findings metrics to CloudWatch.</p>
+     *          <p>The JSON specified in <code>policyDocument</code> can be up to 30,720 characters.</p>
+     */
+    policyDocument: string | undefined;
+    /**
+     * <p>Currently the only valid value for this parameter is <code>DATA_PROTECTION_POLICY</code>.</p>
+     */
+    policyType: PolicyType | string | undefined;
+    /**
+     * <p>Currently the only valid value for this parameter is <code>GLOBAL</code>, which specifies that the data
+     *       protection policy applies to all log groups in the account. If you omit this parameter, the default
+     *     of <code>GLOBAL</code> is used.</p>
+     */
+    scope?: Scope | string;
+}
+/**
+ * @public
+ */
+export interface PutAccountPolicyResponse {
+    /**
+     * <p>The account policy that you created.</p>
+     */
+    accountPolicy?: AccountPolicy;
+}
 /**
  * @public
  */
@@ -1776,8 +1955,12 @@ export interface PutDataProtectionPolicyRequest {
      *          </ul>
      *          <p>For an example data protection policy, see the <b>Examples</b> section on this page.</p>
      *          <important>
-     *             <p>The contents of two <code>DataIdentifer</code> arrays must match exactly.</p>
+     *             <p>The contents of the two <code>DataIdentifer</code> arrays must match exactly.</p>
      *          </important>
+     *          <p>In addition to the two JSON blocks, the <code>policyDocument</code> can also include <code>Name</code>,
+     *       <code>Description</code>, and <code>Version</code> fields. The <code>Name</code> is used as a dimension when
+     *       CloudWatch Logs reports audit findings metrics to CloudWatch.</p>
+     *          <p>The JSON specified in <code>policyDocument</code> can be up to 30,720 characters.</p>
      */
     policyDocument: string | undefined;
 }
@@ -1847,7 +2030,7 @@ export interface PutDestinationPolicyRequest {
     accessPolicy: string | undefined;
     /**
      * <p>Specify true if you are updating an existing destination policy to grant permission to
-     *     an organization ID instead of granting permission to individual AWS accounts. Before
+     *       an organization ID instead of granting permission to individual Amazon Web Services accounts. Before
      *     you update a destination policy this way, you must first update the subscription
      *     filters in the accounts that send logs to this destination. If you do not, the subscription
      *     filters might stop working. By specifying <code>true</code>
@@ -2072,7 +2255,7 @@ export interface PutRetentionPolicyRequest {
     logGroupName: string | undefined;
     /**
      * <p>The number of days to retain the log events in the specified log group.
-     *       Possible values are: 1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, 2192, 2557, 2922, 3288, and 3653.</p>
+     *       Possible values are: 1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1096, 1827, 2192, 2557, 2922, 3288, and 3653.</p>
      *          <p>To set a log group so that its log events do not expire, use <a href="https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DeleteRetentionPolicy.html">DeleteRetentionPolicy</a>. </p>
      */
     retentionInDays: number | undefined;

package/dist-types/protocols/Aws_json1_1.d.ts

@@ -5,6 +5,7 @@ import { CancelExportTaskCommandInput, CancelExportTaskCommandOutput } from "../
 import { CreateExportTaskCommandInput, CreateExportTaskCommandOutput } from "../commands/CreateExportTaskCommand";
 import { CreateLogGroupCommandInput, CreateLogGroupCommandOutput } from "../commands/CreateLogGroupCommand";
 import { CreateLogStreamCommandInput, CreateLogStreamCommandOutput } from "../commands/CreateLogStreamCommand";
+import { DeleteAccountPolicyCommandInput, DeleteAccountPolicyCommandOutput } from "../commands/DeleteAccountPolicyCommand";
 import { DeleteDataProtectionPolicyCommandInput, DeleteDataProtectionPolicyCommandOutput } from "../commands/DeleteDataProtectionPolicyCommand";
 import { DeleteDestinationCommandInput, DeleteDestinationCommandOutput } from "../commands/DeleteDestinationCommand";
 import { DeleteLogGroupCommandInput, DeleteLogGroupCommandOutput } from "../commands/DeleteLogGroupCommand";
@@ -14,6 +15,7 @@ import { DeleteQueryDefinitionCommandInput, DeleteQueryDefinitionCommandOutput }
 import { DeleteResourcePolicyCommandInput, DeleteResourcePolicyCommandOutput } from "../commands/DeleteResourcePolicyCommand";
 import { DeleteRetentionPolicyCommandInput, DeleteRetentionPolicyCommandOutput } from "../commands/DeleteRetentionPolicyCommand";
 import { DeleteSubscriptionFilterCommandInput, DeleteSubscriptionFilterCommandOutput } from "../commands/DeleteSubscriptionFilterCommand";
+import { DescribeAccountPoliciesCommandInput, DescribeAccountPoliciesCommandOutput } from "../commands/DescribeAccountPoliciesCommand";
 import { DescribeDestinationsCommandInput, DescribeDestinationsCommandOutput } from "../commands/DescribeDestinationsCommand";
 import { DescribeExportTasksCommandInput, DescribeExportTasksCommandOutput } from "../commands/DescribeExportTasksCommand";
 import { DescribeLogGroupsCommandInput, DescribeLogGroupsCommandOutput } from "../commands/DescribeLogGroupsCommand";
@@ -32,6 +34,7 @@ import { GetLogRecordCommandInput, GetLogRecordCommandOutput } from "../commands
 import { GetQueryResultsCommandInput, GetQueryResultsCommandOutput } from "../commands/GetQueryResultsCommand";
 import { ListTagsForResourceCommandInput, ListTagsForResourceCommandOutput } from "../commands/ListTagsForResourceCommand";
 import { ListTagsLogGroupCommandInput, ListTagsLogGroupCommandOutput } from "../commands/ListTagsLogGroupCommand";
+import { PutAccountPolicyCommandInput, PutAccountPolicyCommandOutput } from "../commands/PutAccountPolicyCommand";
 import { PutDataProtectionPolicyCommandInput, PutDataProtectionPolicyCommandOutput } from "../commands/PutDataProtectionPolicyCommand";
 import { PutDestinationCommandInput, PutDestinationCommandOutput } from "../commands/PutDestinationCommand";
 import { PutDestinationPolicyCommandInput, PutDestinationPolicyCommandOutput } from "../commands/PutDestinationPolicyCommand";
@@ -68,6 +71,10 @@ export declare const se_CreateLogGroupCommand: (input: CreateLogGroupCommandInpu
  * serializeAws_json1_1CreateLogStreamCommand
  */
 export declare const se_CreateLogStreamCommand: (input: CreateLogStreamCommandInput, context: __SerdeContext) => Promise<__HttpRequest>;
+/**
+ * serializeAws_json1_1DeleteAccountPolicyCommand
+ */
+export declare const se_DeleteAccountPolicyCommand: (input: DeleteAccountPolicyCommandInput, context: __SerdeContext) => Promise<__HttpRequest>;
 /**
  * serializeAws_json1_1DeleteDataProtectionPolicyCommand
  */
@@ -104,6 +111,10 @@ export declare const se_DeleteRetentionPolicyCommand: (input: DeleteRetentionPol
  * serializeAws_json1_1DeleteSubscriptionFilterCommand
  */
 export declare const se_DeleteSubscriptionFilterCommand: (input: DeleteSubscriptionFilterCommandInput, context: __SerdeContext) => Promise<__HttpRequest>;
+/**
+ * serializeAws_json1_1DescribeAccountPoliciesCommand
+ */
+export declare const se_DescribeAccountPoliciesCommand: (input: DescribeAccountPoliciesCommandInput, context: __SerdeContext) => Promise<__HttpRequest>;
 /**
  * serializeAws_json1_1DescribeDestinationsCommand
  */
@@ -176,6 +187,10 @@ export declare const se_ListTagsForResourceCommand: (input: ListTagsForResourceC
  * serializeAws_json1_1ListTagsLogGroupCommand
  */
 export declare const se_ListTagsLogGroupCommand: (input: ListTagsLogGroupCommandInput, context: __SerdeContext) => Promise<__HttpRequest>;
+/**
+ * serializeAws_json1_1PutAccountPolicyCommand
+ */
+export declare const se_PutAccountPolicyCommand: (input: PutAccountPolicyCommandInput, context: __SerdeContext) => Promise<__HttpRequest>;
 /**
  * serializeAws_json1_1PutDataProtectionPolicyCommand
  */
@@ -260,6 +275,10 @@ export declare const de_CreateLogGroupCommand: (output: __HttpResponse, context:
  * deserializeAws_json1_1CreateLogStreamCommand
  */
 export declare const de_CreateLogStreamCommand: (output: __HttpResponse, context: __SerdeContext) => Promise<CreateLogStreamCommandOutput>;
+/**
+ * deserializeAws_json1_1DeleteAccountPolicyCommand
+ */
+export declare const de_DeleteAccountPolicyCommand: (output: __HttpResponse, context: __SerdeContext) => Promise<DeleteAccountPolicyCommandOutput>;
 /**
  * deserializeAws_json1_1DeleteDataProtectionPolicyCommand
  */
@@ -296,6 +315,10 @@ export declare const de_DeleteRetentionPolicyCommand: (output: __HttpResponse, c
  * deserializeAws_json1_1DeleteSubscriptionFilterCommand
  */
 export declare const de_DeleteSubscriptionFilterCommand: (output: __HttpResponse, context: __SerdeContext) => Promise<DeleteSubscriptionFilterCommandOutput>;
+/**
+ * deserializeAws_json1_1DescribeAccountPoliciesCommand
+ */
+export declare const de_DescribeAccountPoliciesCommand: (output: __HttpResponse, context: __SerdeContext) => Promise<DescribeAccountPoliciesCommandOutput>;
 /**
  * deserializeAws_json1_1DescribeDestinationsCommand
  */
@@ -368,6 +391,10 @@ export declare const de_ListTagsForResourceCommand: (output: __HttpResponse, con
  * deserializeAws_json1_1ListTagsLogGroupCommand
  */
 export declare const de_ListTagsLogGroupCommand: (output: __HttpResponse, context: __SerdeContext) => Promise<ListTagsLogGroupCommandOutput>;
+/**
+ * deserializeAws_json1_1PutAccountPolicyCommand
+ */
+export declare const de_PutAccountPolicyCommand: (output: __HttpResponse, context: __SerdeContext) => Promise<PutAccountPolicyCommandOutput>;
 /**
  * deserializeAws_json1_1PutDataProtectionPolicyCommand
  */