@aws-sdk/client-cloudwatch-logs 3.485.0 → 3.489.0

package/dist-cjs/models/models_0.js

@@ -17,6 +17,7 @@ class AccessDeniedException extends CloudWatchLogsServiceException_1.CloudWatchL
 exports.AccessDeniedException = AccessDeniedException;
 exports.PolicyType = {
     DATA_PROTECTION_POLICY: "DATA_PROTECTION_POLICY",
+    SUBSCRIPTION_FILTER_POLICY: "SUBSCRIPTION_FILTER_POLICY",
 };
 exports.Scope = {
     ALL: "ALL",

package/dist-es/models/models_0.js

@@ -13,6 +13,7 @@ export class AccessDeniedException extends __BaseException {
 }
 export const PolicyType = {
     DATA_PROTECTION_POLICY: "DATA_PROTECTION_POLICY",
+    SUBSCRIPTION_FILTER_POLICY: "SUBSCRIPTION_FILTER_POLICY",
 };
 export const Scope = {
     ALL: "ALL",

package/dist-types/commands/DeleteAccountPolicyCommand.d.ts

@@ -26,9 +26,20 @@ declare const DeleteAccountPolicyCommand_base: {
 };
 /**
  * @public
- * <p>Deletes a CloudWatch Logs account policy.</p>
- *          <p>To use this operation, you must be signed on with the <code>logs:DeleteDataProtectionPolicy</code> and
- *       <code>logs:DeleteAccountPolicy</code> permissions.</p>
+ * <p>Deletes a CloudWatch Logs account policy. This stops the policy from applying to all log groups
+ *     or a subset of log groups in the account. Log-group level policies will still be in effect.</p>
+ *          <p>To use this operation, you must be signed on with the correct permissions depending on the type of policy
+ *       that you are deleting.</p>
+ *          <ul>
+ *             <li>
+ *                <p>To delete a data protection policy, you must have the <code>logs:DeleteDataProtectionPolicy</code> and
+ *         <code>logs:DeleteAccountPolicy</code> permissions.</p>
+ *             </li>
+ *             <li>
+ *                <p>To delete a subscription filter policy, you must have the <code>logs:DeleteSubscriptionFilter</code> and
+ *         <code>logs:DeleteAccountPolicy</code> permissions.</p>
+ *             </li>
+ *          </ul>
  * @example
  * Use a bare-bones client and the command you need to make an API call.
  * ```javascript
@@ -37,7 +48,7 @@ declare const DeleteAccountPolicyCommand_base: {
  * const client = new CloudWatchLogsClient(config);
  * const input = { // DeleteAccountPolicyRequest
  *   policyName: "STRING_VALUE", // required
- *   policyType: "DATA_PROTECTION_POLICY", // required
+ *   policyType: "DATA_PROTECTION_POLICY" || "SUBSCRIPTION_FILTER_POLICY", // required
  * };
  * const command = new DeleteAccountPolicyCommand(input);
  * const response = await client.send(command);

package/dist-types/commands/DescribeAccountPoliciesCommand.d.ts

@@ -34,7 +34,7 @@ declare const DescribeAccountPoliciesCommand_base: {
  * // const { CloudWatchLogsClient, DescribeAccountPoliciesCommand } = require("@aws-sdk/client-cloudwatch-logs"); // CommonJS import
  * const client = new CloudWatchLogsClient(config);
  * const input = { // DescribeAccountPoliciesRequest
- *   policyType: "DATA_PROTECTION_POLICY", // required
+ *   policyType: "DATA_PROTECTION_POLICY" || "SUBSCRIPTION_FILTER_POLICY", // required
  *   policyName: "STRING_VALUE",
  *   accountIdentifiers: [ // AccountIds
  *     "STRING_VALUE",
@@ -48,8 +48,9 @@ declare const DescribeAccountPoliciesCommand_base: {
  * //       policyName: "STRING_VALUE",
  * //       policyDocument: "STRING_VALUE",
  * //       lastUpdatedTime: Number("long"),
- * //       policyType: "DATA_PROTECTION_POLICY",
+ * //       policyType: "DATA_PROTECTION_POLICY" || "SUBSCRIPTION_FILTER_POLICY",
  * //       scope: "ALL",
+ * //       selectionCriteria: "STRING_VALUE",
  * //       accountId: "STRING_VALUE",
  * //     },
  * //   ],

package/dist-types/commands/PutAccountPolicyCommand.d.ts

@@ -26,15 +26,20 @@ declare const PutAccountPolicyCommand_base: {
 };
 /**
  * @public
- * <p>Creates an account-level data protection policy that applies to all log groups in the account. A data protection policy can help safeguard sensitive
+ * <p>Creates an account-level data protection policy or subscription filter policy that applies to all log groups
+ *       or a subset of log groups in the account.</p>
+ *          <p>
+ *             <b>Data protection policy</b>
+ *          </p>
+ *          <p>A data protection policy can help safeguard sensitive
  *       data that's ingested by your log groups by auditing and masking the sensitive log data. Each account can have only
- *     one account-level policy.</p>
+ *     one account-level data protection policy.</p>
  *          <important>
  *             <p>Sensitive data is detected and masked when it is ingested into a log group. When you set a
  *       data protection policy, log events ingested into the log groups before that time are not masked.</p>
  *          </important>
  *          <p>If you use <code>PutAccountPolicy</code> to create a data protection policy for your whole account, it applies to both existing log groups
- *     and all log groups that are created later in this account. The account policy is applied to existing log groups
+ *     and all log groups that are created later in this account. The account-level policy is applied to existing log groups
  *     with eventual consistency. It might take up to 5 minutes before sensitive data in existing log groups begins to be masked.</p>
  *          <p>By default, when a user views a log event that includes masked data, the sensitive data is replaced by asterisks.
  *       A user who has the <code>logs:Unmask</code> permission can use a
@@ -45,14 +50,43 @@ declare const PutAccountPolicyCommand_base: {
  *       console by running a CloudWatch Logs Insights query with the <code>unmask</code> query command.</p>
  *          <p>For more information, including a list of types of data that can be audited and masked, see
  *       <a href="https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/mask-sensitive-log-data.html">Protect sensitive log data with masking</a>.</p>
- *          <p>To use the <code>PutAccountPolicy</code> operation, you must be signed on with the <code>logs:PutDataProtectionPolicy</code>
+ *          <p>To use the <code>PutAccountPolicy</code> operation for a data protection policy, you must be signed on with
+ *       the <code>logs:PutDataProtectionPolicy</code>
  *     and <code>logs:PutAccountPolicy</code> permissions.</p>
- *          <p>The <code>PutAccountPolicy</code> operation applies to all log groups in the account. You can also use
+ *          <p>The <code>PutAccountPolicy</code> operation applies to all log groups in the account. You can use
  *       <a href="https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_PutDataProtectionPolicy.html">PutDataProtectionPolicy</a>
  *       to create a data protection policy that applies to just one log group.
  *       If a log group has its own data protection policy and
  *       the account also has an account-level data protection policy, then the two policies are cumulative. Any sensitive term
  *       specified in either policy is masked.</p>
+ *          <p>
+ *             <b>Subscription filter policy</b>
+ *          </p>
+ *          <p>A subscription filter policy sets up a real-time feed of log events from CloudWatch Logs to other Amazon Web Services services.
+ *       Account-level subscription filter policies apply to both existing log groups and log groups that are created later in
+ *       this account. Supported destinations are Kinesis Data Streams, Kinesis Data Firehose, and
+ *       Lambda. When log events are sent to the receiving service, they are Base64 encoded and
+ *       compressed with the GZIP format.</p>
+ *          <p>The following destinations are supported for subscription filters:</p>
+ *          <ul>
+ *             <li>
+ *                <p>An Kinesis Data Streams data stream in the same account as the subscription policy, for same-account delivery.</p>
+ *             </li>
+ *             <li>
+ *                <p>An Kinesis Data Firehose data stream in the same account as the subscription policy, for same-account delivery.</p>
+ *             </li>
+ *             <li>
+ *                <p>A Lambda function in the same account as the subscription policy, for same-account delivery.</p>
+ *             </li>
+ *             <li>
+ *                <p>A logical destination in a different account created with <a href="https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_PutDestination.html">PutDestination</a>, for cross-account
+ *         delivery. Kinesis Data Streams and Kinesis Data Firehose are supported as logical destinations.</p>
+ *             </li>
+ *          </ul>
+ *          <p>Each account can have one account-level subscription filter policy.
+ *       If you are updating an existing filter, you must specify the correct name in <code>PolicyName</code>.
+ *       To perform a <code>PutAccountPolicy</code> subscription filter operation for any destination except a Lambda
+ *       function, you must also have the <code>iam:PassRole</code> permission.</p>
  * @example
  * Use a bare-bones client and the command you need to make an API call.
  * ```javascript
@@ -62,8 +96,9 @@ declare const PutAccountPolicyCommand_base: {
  * const input = { // PutAccountPolicyRequest
  *   policyName: "STRING_VALUE", // required
  *   policyDocument: "STRING_VALUE", // required
- *   policyType: "DATA_PROTECTION_POLICY", // required
+ *   policyType: "DATA_PROTECTION_POLICY" || "SUBSCRIPTION_FILTER_POLICY", // required
  *   scope: "ALL",
+ *   selectionCriteria: "STRING_VALUE",
  * };
  * const command = new PutAccountPolicyCommand(input);
  * const response = await client.send(command);
@@ -72,8 +107,9 @@ declare const PutAccountPolicyCommand_base: {
  * //     policyName: "STRING_VALUE",
  * //     policyDocument: "STRING_VALUE",
  * //     lastUpdatedTime: Number("long"),
- * //     policyType: "DATA_PROTECTION_POLICY",
+ * //     policyType: "DATA_PROTECTION_POLICY" || "SUBSCRIPTION_FILTER_POLICY",
  * //     scope: "ALL",
+ * //     selectionCriteria: "STRING_VALUE",
  * //     accountId: "STRING_VALUE",
  * //   },
  * // };

package/dist-types/commands/StartLiveTailCommand.d.ts

@@ -64,6 +64,9 @@ declare const StartLiveTailCommand_base: {
  *             <p>You can end a session before it times out by closing the session stream or by closing the client that is receiving the
  *   stream. The session also ends if the established connection between the client and the server breaks.</p>
  *          </important>
+ *          <p>For examples of using an SDK to start a Live Tail session, see
+ *     <a href="https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/example_cloudwatch-logs_StartLiveTail_section.html">
+ *       Start a Live Tail session using an Amazon Web Services SDK</a>.</p>
  * @example
  * Use a bare-bones client and the command you need to make an API call.
  * ```javascript

package/dist-types/models/models_0.d.ts

@@ -18,6 +18,7 @@ export declare class AccessDeniedException extends __BaseException {
  */
 export declare const PolicyType: {
     readonly DATA_PROTECTION_POLICY: "DATA_PROTECTION_POLICY";
+    readonly SUBSCRIPTION_FILTER_POLICY: "SUBSCRIPTION_FILTER_POLICY";
 };
 /**
  * @public
@@ -65,6 +66,11 @@ export interface AccountPolicy {
      * <p>The scope of the account policy.</p>
      */
     scope?: Scope;
+    /**
+     * @public
+     * <p>The log group selection criteria for this subscription filter policy.</p>
+     */
+    selectionCriteria?: string;
     /**
      * @public
      * <p>The Amazon Web Services account ID that the policy applies to.</p>
@@ -785,7 +791,7 @@ export interface CreateLogGroupRequest {
      *          </ul>
      *          <p>If you omit this parameter, the default of <code>STANDARD</code> is used.</p>
      *          <important>
-     *             <p>After a log group is created, its class can't be changed.</p>
+     *             <p>The value of <code>logGroupClass</code> can't be changed after a log group is created.</p>
      *          </important>
      *          <p>For details about the features supported by each class, see
      *       <a href="https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch_Logs_Log_Classes.html">Log classes</a>
@@ -853,7 +859,7 @@ export interface DeleteAccountPolicyRequest {
     policyName: string | undefined;
     /**
      * @public
-     * <p>The type of policy to delete. Currently, the only valid value is <code>DATA_PROTECTION_POLICY</code>.</p>
+     * <p>The type of policy to delete.</p>
      */
     policyType: PolicyType | undefined;
 }
@@ -1197,7 +1203,7 @@ export interface DescribeAccountPoliciesRequest {
     /**
      * @public
      * <p>Use this parameter to limit the returned policies to only the policies that match the policy type that you
-     *       specify. Currently, the only valid value is <code>DATA_PROTECTION_POLICY</code>.</p>
+     *       specify.</p>
      */
     policyType: PolicyType | undefined;
     /**
@@ -3374,8 +3380,11 @@ export interface PutAccountPolicyRequest {
     policyName: string | undefined;
     /**
      * @public
-     * <p>Specify the data protection policy, in JSON.</p>
-     *          <p>This policy must include two JSON blocks:</p>
+     * <p>Specify the policy, in JSON.</p>
+     *          <p>
+     *             <b>Data protection policy</b>
+     *          </p>
+     *          <p>A data protection policy must include two JSON blocks:</p>
      *          <ul>
      *             <li>
      *                <p>The first block must include both a <code>DataIdentifer</code> array and an
@@ -3408,12 +3417,56 @@ export interface PutAccountPolicyRequest {
      *     <code>Description</code>, and <code>Version</code> fields. The <code>Name</code> is different than the
      *       operation's <code>policyName</code> parameter, and is used as a dimension when
      *     CloudWatch Logs reports audit findings metrics to CloudWatch.</p>
-     *          <p>The JSON specified in <code>policyDocument</code> can be up to 30,720 characters.</p>
+     *          <p>The JSON specified in <code>policyDocument</code> can be up to 30,720 characters long.</p>
+     *          <p>
+     *             <b>Subscription filter policy</b>
+     *          </p>
+     *          <p>A subscription filter policy can include the following attributes in a JSON block:</p>
+     *          <ul>
+     *             <li>
+     *                <p>
+     *                   <b>DestinationArn</b> The ARN of the destination
+     *       to deliver log events to. Supported destinations are:</p>
+     *                <ul>
+     *                   <li>
+     *                      <p>An Kinesis Data Streams data stream in the same account as the subscription policy, for same-account delivery.</p>
+     *                   </li>
+     *                   <li>
+     *                      <p>An Kinesis Data Firehose data stream in the same account as the subscription policy, for same-account delivery.</p>
+     *                   </li>
+     *                   <li>
+     *                      <p>A Lambda function in the same account as the subscription policy, for same-account delivery.</p>
+     *                   </li>
+     *                   <li>
+     *                      <p>A logical destination in a different account created with <a href="https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_PutDestination.html">PutDestination</a>, for cross-account
+     *             delivery. Kinesis Data Streams and Kinesis Data Firehose are supported as logical destinations.</p>
+     *                   </li>
+     *                </ul>
+     *             </li>
+     *             <li>
+     *                <p>
+     *                   <b>RoleArn</b> The ARN of an IAM role that grants CloudWatch Logs permissions to deliver ingested log
+     *         events to the destination stream. You don't need to provide the ARN when you are working with
+     *         a logical destination for cross-account delivery.</p>
+     *             </li>
+     *             <li>
+     *                <p>
+     *                   <b>FilterPattern</b> A filter pattern for subscribing to a
+     *         filtered stream of log events.</p>
+     *             </li>
+     *             <li>
+     *                <p>
+     *                   <b>Distribution</b>The method used to distribute log data to the destination.
+     *         By default, log data is
+     *         grouped by log stream, but the grouping can be set to <code>Random</code> for a more even distribution.
+     *         This property is only applicable when the destination is an Kinesis Data Streams data stream.</p>
+     *             </li>
+     *          </ul>
      */
     policyDocument: string | undefined;
     /**
      * @public
-     * <p>Currently the only valid value for this parameter is <code>DATA_PROTECTION_POLICY</code>.</p>
+     * <p>The type of policy that you're creating or updating.</p>
      */
     policyType: PolicyType | undefined;
     /**
@@ -3423,6 +3476,17 @@ export interface PutAccountPolicyRequest {
      *     of <code>ALL</code> is used.</p>
      */
     scope?: Scope;
+    /**
+     * @public
+     * <p>Use this parameter to apply the subscription filter policy to a subset of log groups in the account.
+     *       Currently, the only supported filter is <code>LogGroupName NOT IN []</code>. The <code>selectionCriteria</code>
+     *     string can be up to 25KB in length. The length is determined by using its UTF-8 bytes.</p>
+     *          <p>Using the <code>selectionCriteria</code> parameter is useful to help prevent infinite loops.
+     *       For more information, see <a href="https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/Subscriptions-recursion-prevention.html">Log recursion prevention</a>.</p>
+     *          <p>Specifing <code>selectionCriteria</code> is valid only when you specify <code> SUBSCRIPTION_FILTER_POLICY</code>
+     *     for <code>policyType</code>.</p>
+     */
+    selectionCriteria?: string;
 }
 /**
  * @public
@@ -4005,6 +4069,7 @@ export interface StartLiveTailRequest {
      * @public
      * <p>If you specify this parameter, then only log events in the log streams that you specify here are
      *     included in the Live Tail session.</p>
+     *          <p>If you specify this field, you can't also specify the <code>logStreamNamePrefixes</code> field.</p>
      *          <note>
      *             <p>You can specify this parameter only if you specify only one log group in <code>logGroupIdentifiers</code>.</p>
      *          </note>
@@ -4015,6 +4080,7 @@ export interface StartLiveTailRequest {
      * <p>If you specify this parameter, then only log events in the log streams that have names that start with the
      *       prefixes that you specify here are
      *       included in the Live Tail session.</p>
+     *          <p>If you specify this field, you can't also specify the <code>logStreamNames</code> field.</p>
      *          <note>
      *             <p>You can specify this parameter only if you specify only one log group in <code>logGroupIdentifiers</code>.</p>
      *          </note>

package/dist-types/ts3.4/models/models_0.d.ts

@@ -9,6 +9,7 @@ export declare class AccessDeniedException extends __BaseException {
 }
 export declare const PolicyType: {
   readonly DATA_PROTECTION_POLICY: "DATA_PROTECTION_POLICY";
+  readonly SUBSCRIPTION_FILTER_POLICY: "SUBSCRIPTION_FILTER_POLICY";
 };
 export type PolicyType = (typeof PolicyType)[keyof typeof PolicyType];
 export declare const Scope: {
@@ -21,6 +22,7 @@ export interface AccountPolicy {
   lastUpdatedTime?: number;
   policyType?: PolicyType;
   scope?: Scope;
+  selectionCriteria?: string;
   accountId?: string;
 }
 export interface PatternToken {
@@ -827,6 +829,7 @@ export interface PutAccountPolicyRequest {
   policyDocument: string | undefined;
   policyType: PolicyType | undefined;
   scope?: Scope;
+  selectionCriteria?: string;
 }
 export interface PutAccountPolicyResponse {
   accountPolicy?: AccountPolicy;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@aws-sdk/client-cloudwatch-logs",
   "description": "AWS SDK for JavaScript Cloudwatch Logs Client for Node.js, Browser and React Native",
-  "version": "3.485.0",
+  "version": "3.489.0",
   "scripts": {
     "build": "concurrently 'yarn:build:cjs' 'yarn:build:es' 'yarn:build:types'",
     "build:cjs": "tsc -p tsconfig.cjs.json",
@@ -20,19 +20,19 @@
   "dependencies": {
     "@aws-crypto/sha256-browser": "3.0.0",
     "@aws-crypto/sha256-js": "3.0.0",
-    "@aws-sdk/client-sts": "3.485.0",
+    "@aws-sdk/client-sts": "3.489.0",
     "@aws-sdk/core": "3.485.0",
-    "@aws-sdk/credential-provider-node": "3.485.0",
-    "@aws-sdk/middleware-host-header": "3.485.0",
-    "@aws-sdk/middleware-logger": "3.485.0",
-    "@aws-sdk/middleware-recursion-detection": "3.485.0",
-    "@aws-sdk/middleware-signing": "3.485.0",
-    "@aws-sdk/middleware-user-agent": "3.485.0",
-    "@aws-sdk/region-config-resolver": "3.485.0",
-    "@aws-sdk/types": "3.485.0",
-    "@aws-sdk/util-endpoints": "3.485.0",
-    "@aws-sdk/util-user-agent-browser": "3.485.0",
-    "@aws-sdk/util-user-agent-node": "3.485.0",
+    "@aws-sdk/credential-provider-node": "3.489.0",
+    "@aws-sdk/middleware-host-header": "3.489.0",
+    "@aws-sdk/middleware-logger": "3.489.0",
+    "@aws-sdk/middleware-recursion-detection": "3.489.0",
+    "@aws-sdk/middleware-signing": "3.489.0",
+    "@aws-sdk/middleware-user-agent": "3.489.0",
+    "@aws-sdk/region-config-resolver": "3.489.0",
+    "@aws-sdk/types": "3.489.0",
+    "@aws-sdk/util-endpoints": "3.489.0",
+    "@aws-sdk/util-user-agent-browser": "3.489.0",
+    "@aws-sdk/util-user-agent-node": "3.489.0",
     "@smithy/config-resolver": "^2.0.23",
     "@smithy/core": "^1.2.2",
     "@smithy/eventstream-serde-browser": "^2.0.16",