aws-cdk-lib 2.200.2__py3-none-any.whl → 2.224.0__py3-none-any.whl

aws_cdk/aws_cloudtrail/__init__.py

@@ -259,6 +259,19 @@ from ..aws_logs import (
 )
 from ..aws_s3 import IBucket as _IBucket_42e086fd
 from ..aws_sns import ITopic as _ITopic_9eca4852
+from ..interfaces.aws_cloudtrail import (
+    ChannelReference as _ChannelReference_f32eac36,
+    DashboardReference as _DashboardReference_c8d9a4d8,
+    EventDataStoreReference as _EventDataStoreReference_9009c169,
+    IChannelRef as _IChannelRef_578e7391,
+    IDashboardRef as _IDashboardRef_1dcd123e,
+    IEventDataStoreRef as _IEventDataStoreRef_da898eb2,
+    IResourcePolicyRef as _IResourcePolicyRef_018c99ea,
+    ITrailRef as _ITrailRef_38211c4b,
+    ResourcePolicyReference as _ResourcePolicyReference_79964037,
+    TrailReference as _TrailReference_842f4da2,
+)
+from ..interfaces.aws_s3 import IBucketRef as _IBucketRef_3debe44e
 
 
 @jsii.data_type(
@@ -363,7 +376,7 @@ class AddEventSelectorOptions:
         )
 
 
-@jsii.implements(_IInspectable_c2943556, _ITaggable_36806126)
+@jsii.implements(_IInspectable_c2943556, _IChannelRef_578e7391, _ITaggable_36806126)
 class CfnChannel(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -405,7 +418,8 @@ class CfnChannel(
         source: typing.Optional[builtins.str] = None,
         tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::CloudTrail::Channel``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param destinations: One or more event data stores to which events arriving through a channel will be logged.
@@ -467,6 +481,12 @@ class CfnChannel(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="channelRef")
+    def channel_ref(self) -> _ChannelReference_f32eac36:
+        '''A reference to a Channel resource.'''
+        return typing.cast(_ChannelReference_f32eac36, jsii.get(self, "channelRef"))
+
     @builtins.property
     @jsii.member(jsii_name="tags")
     def tags(self) -> _TagManager_0a598cb3:
@@ -719,7 +739,7 @@ class CfnChannelProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556, _ITaggableV2_4e6798f8)
+@jsii.implements(_IInspectable_c2943556, _IDashboardRef_1dcd123e, _ITaggableV2_4e6798f8)
 class CfnDashboard(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -784,7 +804,8 @@ class CfnDashboard(
         termination_protection_enabled: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
         widgets: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union["CfnDashboard.WidgetProperty", typing.Dict[builtins.str, typing.Any]]]]]] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::CloudTrail::Dashboard``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param name: The name of the dashboard. The name must be unique to your account. To create the Highlights dashboard, the name must be ``AWSCloudTrail-Highlights`` .
@@ -893,6 +914,12 @@ class CfnDashboard(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="dashboardRef")
+    def dashboard_ref(self) -> _DashboardReference_c8d9a4d8:
+        '''A reference to a Dashboard resource.'''
+        return typing.cast(_DashboardReference_c8d9a4d8, jsii.get(self, "dashboardRef"))
+
     @builtins.property
     @jsii.member(jsii_name="name")
     def name(self) -> typing.Optional[builtins.str]:
@@ -1413,7 +1440,7 @@ class CfnDashboardProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556, _ITaggable_36806126)
+@jsii.implements(_IInspectable_c2943556, _IEventDataStoreRef_da898eb2, _ITaggable_36806126)
 class CfnEventDataStore(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -1449,6 +1476,10 @@ class CfnEventDataStore(
                 name="name"
             )],
             billing_mode="billingMode",
+            context_key_selectors=[cloudtrail.CfnEventDataStore.ContextKeySelectorProperty(
+                equal_to=["equalTo"],
+                type="type"
+            )],
             federation_enabled=False,
             federation_role_arn="federationRoleArn",
             ingestion_enabled=False,
@@ -1457,6 +1488,7 @@ class CfnEventDataStore(
                 insight_type="insightType"
             )],
             kms_key_id="kmsKeyId",
+            max_event_size="maxEventSize",
             multi_region_enabled=False,
             name="name",
             organization_enabled=False,
@@ -1476,12 +1508,14 @@ class CfnEventDataStore(
         *,
         advanced_event_selectors: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union["CfnEventDataStore.AdvancedEventSelectorProperty", typing.Dict[builtins.str, typing.Any]]]]]] = None,
         billing_mode: typing.Optional[builtins.str] = None,
+        context_key_selectors: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union["CfnEventDataStore.ContextKeySelectorProperty", typing.Dict[builtins.str, typing.Any]]]]]] = None,
         federation_enabled: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
         federation_role_arn: typing.Optional[builtins.str] = None,
         ingestion_enabled: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
         insights_destination: typing.Optional[builtins.str] = None,
         insight_selectors: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union["CfnEventDataStore.InsightSelectorProperty", typing.Dict[builtins.str, typing.Any]]]]]] = None,
         kms_key_id: typing.Optional[builtins.str] = None,
+        max_event_size: typing.Optional[builtins.str] = None,
         multi_region_enabled: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
         name: typing.Optional[builtins.str] = None,
         organization_enabled: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
@@ -1489,17 +1523,20 @@ class CfnEventDataStore(
         tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
         termination_protection_enabled: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::CloudTrail::EventDataStore``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param advanced_event_selectors: The advanced event selectors to use to select the events for the data store. You can configure up to five advanced event selectors for each event data store. For more information about how to use advanced event selectors to log CloudTrail events, see `Log events by using advanced event selectors <https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html#creating-data-event-selectors-advanced>`_ in the CloudTrail User Guide. For more information about how to use advanced event selectors to include AWS Config configuration items in your event data store, see `Create an event data store for AWS Config configuration items <https://docs.aws.amazon.com/awscloudtrail/latest/userguide/lake-eds-cli.html#lake-cli-create-eds-config>`_ in the CloudTrail User Guide. For more information about how to use advanced event selectors to include events outside of AWS events in your event data store, see `Create an integration to log events from outside AWS <https://docs.aws.amazon.com/awscloudtrail/latest/userguide/lake-integrations-cli.html#lake-cli-create-integration>`_ in the CloudTrail User Guide.
         :param billing_mode: The billing mode for the event data store determines the cost for ingesting events and the default and maximum retention period for the event data store. The following are the possible values: - ``EXTENDABLE_RETENTION_PRICING`` - This billing mode is generally recommended if you want a flexible retention period of up to 3653 days (about 10 years). The default retention period for this billing mode is 366 days. - ``FIXED_RETENTION_PRICING`` - This billing mode is recommended if you expect to ingest more than 25 TB of event data per month and need a retention period of up to 2557 days (about 7 years). The default retention period for this billing mode is 2557 days. The default value is ``EXTENDABLE_RETENTION_PRICING`` . For more information about CloudTrail pricing, see `AWS CloudTrail Pricing <https://docs.aws.amazon.com/cloudtrail/pricing/>`_ and `Managing CloudTrail Lake costs <https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-lake-manage-costs.html>`_ .
+        :param context_key_selectors: The list of context key selectors that are configured for the event data store.
         :param federation_enabled: Indicates if `Lake query federation <https://docs.aws.amazon.com/awscloudtrail/latest/userguide/query-federation.html>`_ is enabled. By default, Lake query federation is disabled. You cannot delete an event data store if Lake query federation is enabled.
         :param federation_role_arn: If Lake query federation is enabled, provides the ARN of the federation role used to access the resources for the federated event data store. The federation role must exist in your account and provide the `required minimum permissions <https://docs.aws.amazon.com/awscloudtrail/latest/userguide/query-federation.html#query-federation-permissions-role>`_ .
         :param ingestion_enabled: Specifies whether the event data store should start ingesting live events. The default is true.
         :param insights_destination: The ARN (or ID suffix of the ARN) of the destination event data store that logs Insights events. For more information, see `Create an event data store for CloudTrail Insights events <https://docs.aws.amazon.com/awscloudtrail/latest/userguide/query-event-data-store-insights.html>`_ .
         :param insight_selectors: A JSON string that contains the Insights types you want to log on an event data store. ``ApiCallRateInsight`` and ``ApiErrorRateInsight`` are valid Insight types. The ``ApiCallRateInsight`` Insights type analyzes write-only management API calls that are aggregated per minute against a baseline API call volume. The ``ApiErrorRateInsight`` Insights type analyzes management API calls that result in error codes. The error is shown if the API call is unsuccessful.
         :param kms_key_id: Specifies the AWS KMS key ID to use to encrypt the events delivered by CloudTrail. The value can be an alias name prefixed by ``alias/`` , a fully specified ARN to an alias, a fully specified ARN to a key, or a globally unique identifier. .. epigraph:: Disabling or deleting the KMS key, or removing CloudTrail permissions on the key, prevents CloudTrail from logging events to the event data store, and prevents users from querying the data in the event data store that was encrypted with the key. After you associate an event data store with a KMS key, the KMS key cannot be removed or changed. Before you disable or delete a KMS key that you are using with an event data store, delete or back up your event data store. CloudTrail also supports AWS KMS multi-Region keys. For more information about multi-Region keys, see `Using multi-Region keys <https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html>`_ in the *AWS Key Management Service Developer Guide* . Examples: - ``alias/MyAliasName`` - ``arn:aws:kms:us-east-2:123456789012:alias/MyAliasName`` - ``arn:aws:kms:us-east-2:123456789012:key/12345678-1234-1234-1234-123456789012`` - ``12345678-1234-1234-1234-123456789012``
+        :param max_event_size: The maximum allowed size for events to be stored in the specified event data store. If you are using context key selectors, MaxEventSize must be set to Large.
         :param multi_region_enabled: Specifies whether the event data store includes events from all Regions, or only from the Region in which the event data store is created.
         :param name: The name of the event data store.
         :param organization_enabled: Specifies whether an event data store collects events logged for an organization in AWS Organizations .
@@ -1514,12 +1551,14 @@ class CfnEventDataStore(
         props = CfnEventDataStoreProps(
             advanced_event_selectors=advanced_event_selectors,
             billing_mode=billing_mode,
+            context_key_selectors=context_key_selectors,
             federation_enabled=federation_enabled,
             federation_role_arn=federation_role_arn,
             ingestion_enabled=ingestion_enabled,
             insights_destination=insights_destination,
             insight_selectors=insight_selectors,
             kms_key_id=kms_key_id,
+            max_event_size=max_event_size,
             multi_region_enabled=multi_region_enabled,
             name=name,
             organization_enabled=organization_enabled,
@@ -1601,6 +1640,12 @@ class CfnEventDataStore(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="eventDataStoreRef")
+    def event_data_store_ref(self) -> _EventDataStoreReference_9009c169:
+        '''A reference to a EventDataStore resource.'''
+        return typing.cast(_EventDataStoreReference_9009c169, jsii.get(self, "eventDataStoreRef"))
+
     @builtins.property
     @jsii.member(jsii_name="tags")
     def tags(self) -> _TagManager_0a598cb3:
@@ -1638,6 +1683,24 @@ class CfnEventDataStore(
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
         jsii.set(self, "billingMode", value) # pyright: ignore[reportArgumentType]
 
+    @builtins.property
+    @jsii.member(jsii_name="contextKeySelectors")
+    def context_key_selectors(
+        self,
+    ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnEventDataStore.ContextKeySelectorProperty"]]]]:
+        '''The list of context key selectors that are configured for the event data store.'''
+        return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnEventDataStore.ContextKeySelectorProperty"]]]], jsii.get(self, "contextKeySelectors"))
+
+    @context_key_selectors.setter
+    def context_key_selectors(
+        self,
+        value: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnEventDataStore.ContextKeySelectorProperty"]]]],
+    ) -> None:
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__aa0ae30f8c5291a79387d1a2f7fb5c056fc8459c7878eb58241f52eba3a4762e)
+            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
+        jsii.set(self, "contextKeySelectors", value) # pyright: ignore[reportArgumentType]
+
     @builtins.property
     @jsii.member(jsii_name="federationEnabled")
     def federation_enabled(
@@ -1731,6 +1794,19 @@ class CfnEventDataStore(
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
         jsii.set(self, "kmsKeyId", value) # pyright: ignore[reportArgumentType]
 
+    @builtins.property
+    @jsii.member(jsii_name="maxEventSize")
+    def max_event_size(self) -> typing.Optional[builtins.str]:
+        '''The maximum allowed size for events to be stored in the specified event data store.'''
+        return typing.cast(typing.Optional[builtins.str], jsii.get(self, "maxEventSize"))
+
+    @max_event_size.setter
+    def max_event_size(self, value: typing.Optional[builtins.str]) -> None:
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__a69353bf46f46a1067b410e6f91c0033234561f53fceb13608d40dd90dd0832e)
+            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
+        jsii.set(self, "maxEventSize", value) # pyright: ignore[reportArgumentType]
+
     @builtins.property
     @jsii.member(jsii_name="multiRegionEnabled")
     def multi_region_enabled(
@@ -2163,6 +2239,79 @@ class CfnEventDataStore(
                 k + "=" + repr(v) for k, v in self._values.items()
             )
 
+    @jsii.data_type(
+        jsii_type="aws-cdk-lib.aws_cloudtrail.CfnEventDataStore.ContextKeySelectorProperty",
+        jsii_struct_bases=[],
+        name_mapping={"equal_to": "equalTo", "type": "type"},
+    )
+    class ContextKeySelectorProperty:
+        def __init__(
+            self,
+            *,
+            equal_to: typing.Sequence[builtins.str],
+            type: builtins.str,
+        ) -> None:
+            '''An object that contains information types to be included in CloudTrail enriched events.
+
+            :param equal_to: A list of keys defined by Type to be included in CloudTrail enriched events.
+            :param type: Specifies the type of the event record field in ContextKeySelector. Valid values include RequestContext, TagContext.
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudtrail-eventdatastore-contextkeyselector.html
+            :exampleMetadata: fixture=_generated
+
+            Example::
+
+                # The code below shows an example of how to instantiate this type.
+                # The values are placeholders you should change.
+                from aws_cdk import aws_cloudtrail as cloudtrail
+                
+                context_key_selector_property = cloudtrail.CfnEventDataStore.ContextKeySelectorProperty(
+                    equal_to=["equalTo"],
+                    type="type"
+                )
+            '''
+            if __debug__:
+                type_hints = typing.get_type_hints(_typecheckingstub__442b3465c9cf8a3aebc6597e8616078b26e24675af399050c52412909f6169e3)
+                check_type(argname="argument equal_to", value=equal_to, expected_type=type_hints["equal_to"])
+                check_type(argname="argument type", value=type, expected_type=type_hints["type"])
+            self._values: typing.Dict[builtins.str, typing.Any] = {
+                "equal_to": equal_to,
+                "type": type,
+            }
+
+        @builtins.property
+        def equal_to(self) -> typing.List[builtins.str]:
+            '''A list of keys defined by Type to be included in CloudTrail enriched events.
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudtrail-eventdatastore-contextkeyselector.html#cfn-cloudtrail-eventdatastore-contextkeyselector-equals
+            '''
+            result = self._values.get("equal_to")
+            assert result is not None, "Required property 'equal_to' is missing"
+            return typing.cast(typing.List[builtins.str], result)
+
+        @builtins.property
+        def type(self) -> builtins.str:
+            '''Specifies the type of the event record field in ContextKeySelector.
+
+            Valid values include RequestContext, TagContext.
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudtrail-eventdatastore-contextkeyselector.html#cfn-cloudtrail-eventdatastore-contextkeyselector-type
+            '''
+            result = self._values.get("type")
+            assert result is not None, "Required property 'type' is missing"
+            return typing.cast(builtins.str, result)
+
+        def __eq__(self, rhs: typing.Any) -> builtins.bool:
+            return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+        def __ne__(self, rhs: typing.Any) -> builtins.bool:
+            return not (rhs == self)
+
+        def __repr__(self) -> str:
+            return "ContextKeySelectorProperty(%s)" % ", ".join(
+                k + "=" + repr(v) for k, v in self._values.items()
+            )
+
     @jsii.data_type(
         jsii_type="aws-cdk-lib.aws_cloudtrail.CfnEventDataStore.InsightSelectorProperty",
         jsii_struct_bases=[],
@@ -2229,12 +2378,14 @@ class CfnEventDataStore(
     name_mapping={
         "advanced_event_selectors": "advancedEventSelectors",
         "billing_mode": "billingMode",
+        "context_key_selectors": "contextKeySelectors",
         "federation_enabled": "federationEnabled",
         "federation_role_arn": "federationRoleArn",
         "ingestion_enabled": "ingestionEnabled",
         "insights_destination": "insightsDestination",
         "insight_selectors": "insightSelectors",
         "kms_key_id": "kmsKeyId",
+        "max_event_size": "maxEventSize",
         "multi_region_enabled": "multiRegionEnabled",
         "name": "name",
         "organization_enabled": "organizationEnabled",
@@ -2249,12 +2400,14 @@ class CfnEventDataStoreProps:
         *,
         advanced_event_selectors: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union[CfnEventDataStore.AdvancedEventSelectorProperty, typing.Dict[builtins.str, typing.Any]]]]]] = None,
         billing_mode: typing.Optional[builtins.str] = None,
+        context_key_selectors: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union[CfnEventDataStore.ContextKeySelectorProperty, typing.Dict[builtins.str, typing.Any]]]]]] = None,
         federation_enabled: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
         federation_role_arn: typing.Optional[builtins.str] = None,
         ingestion_enabled: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
         insights_destination: typing.Optional[builtins.str] = None,
         insight_selectors: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union[CfnEventDataStore.InsightSelectorProperty, typing.Dict[builtins.str, typing.Any]]]]]] = None,
         kms_key_id: typing.Optional[builtins.str] = None,
+        max_event_size: typing.Optional[builtins.str] = None,
         multi_region_enabled: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
         name: typing.Optional[builtins.str] = None,
         organization_enabled: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
@@ -2266,12 +2419,14 @@ class CfnEventDataStoreProps:
 
         :param advanced_event_selectors: The advanced event selectors to use to select the events for the data store. You can configure up to five advanced event selectors for each event data store. For more information about how to use advanced event selectors to log CloudTrail events, see `Log events by using advanced event selectors <https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html#creating-data-event-selectors-advanced>`_ in the CloudTrail User Guide. For more information about how to use advanced event selectors to include AWS Config configuration items in your event data store, see `Create an event data store for AWS Config configuration items <https://docs.aws.amazon.com/awscloudtrail/latest/userguide/lake-eds-cli.html#lake-cli-create-eds-config>`_ in the CloudTrail User Guide. For more information about how to use advanced event selectors to include events outside of AWS events in your event data store, see `Create an integration to log events from outside AWS <https://docs.aws.amazon.com/awscloudtrail/latest/userguide/lake-integrations-cli.html#lake-cli-create-integration>`_ in the CloudTrail User Guide.
         :param billing_mode: The billing mode for the event data store determines the cost for ingesting events and the default and maximum retention period for the event data store. The following are the possible values: - ``EXTENDABLE_RETENTION_PRICING`` - This billing mode is generally recommended if you want a flexible retention period of up to 3653 days (about 10 years). The default retention period for this billing mode is 366 days. - ``FIXED_RETENTION_PRICING`` - This billing mode is recommended if you expect to ingest more than 25 TB of event data per month and need a retention period of up to 2557 days (about 7 years). The default retention period for this billing mode is 2557 days. The default value is ``EXTENDABLE_RETENTION_PRICING`` . For more information about CloudTrail pricing, see `AWS CloudTrail Pricing <https://docs.aws.amazon.com/cloudtrail/pricing/>`_ and `Managing CloudTrail Lake costs <https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-lake-manage-costs.html>`_ .
+        :param context_key_selectors: The list of context key selectors that are configured for the event data store.
         :param federation_enabled: Indicates if `Lake query federation <https://docs.aws.amazon.com/awscloudtrail/latest/userguide/query-federation.html>`_ is enabled. By default, Lake query federation is disabled. You cannot delete an event data store if Lake query federation is enabled.
         :param federation_role_arn: If Lake query federation is enabled, provides the ARN of the federation role used to access the resources for the federated event data store. The federation role must exist in your account and provide the `required minimum permissions <https://docs.aws.amazon.com/awscloudtrail/latest/userguide/query-federation.html#query-federation-permissions-role>`_ .
         :param ingestion_enabled: Specifies whether the event data store should start ingesting live events. The default is true.
         :param insights_destination: The ARN (or ID suffix of the ARN) of the destination event data store that logs Insights events. For more information, see `Create an event data store for CloudTrail Insights events <https://docs.aws.amazon.com/awscloudtrail/latest/userguide/query-event-data-store-insights.html>`_ .
         :param insight_selectors: A JSON string that contains the Insights types you want to log on an event data store. ``ApiCallRateInsight`` and ``ApiErrorRateInsight`` are valid Insight types. The ``ApiCallRateInsight`` Insights type analyzes write-only management API calls that are aggregated per minute against a baseline API call volume. The ``ApiErrorRateInsight`` Insights type analyzes management API calls that result in error codes. The error is shown if the API call is unsuccessful.
         :param kms_key_id: Specifies the AWS KMS key ID to use to encrypt the events delivered by CloudTrail. The value can be an alias name prefixed by ``alias/`` , a fully specified ARN to an alias, a fully specified ARN to a key, or a globally unique identifier. .. epigraph:: Disabling or deleting the KMS key, or removing CloudTrail permissions on the key, prevents CloudTrail from logging events to the event data store, and prevents users from querying the data in the event data store that was encrypted with the key. After you associate an event data store with a KMS key, the KMS key cannot be removed or changed. Before you disable or delete a KMS key that you are using with an event data store, delete or back up your event data store. CloudTrail also supports AWS KMS multi-Region keys. For more information about multi-Region keys, see `Using multi-Region keys <https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html>`_ in the *AWS Key Management Service Developer Guide* . Examples: - ``alias/MyAliasName`` - ``arn:aws:kms:us-east-2:123456789012:alias/MyAliasName`` - ``arn:aws:kms:us-east-2:123456789012:key/12345678-1234-1234-1234-123456789012`` - ``12345678-1234-1234-1234-123456789012``
+        :param max_event_size: The maximum allowed size for events to be stored in the specified event data store. If you are using context key selectors, MaxEventSize must be set to Large.
         :param multi_region_enabled: Specifies whether the event data store includes events from all Regions, or only from the Region in which the event data store is created.
         :param name: The name of the event data store.
         :param organization_enabled: Specifies whether an event data store collects events logged for an organization in AWS Organizations .
@@ -2306,6 +2461,10 @@ class CfnEventDataStoreProps:
                     name="name"
                 )],
                 billing_mode="billingMode",
+                context_key_selectors=[cloudtrail.CfnEventDataStore.ContextKeySelectorProperty(
+                    equal_to=["equalTo"],
+                    type="type"
+                )],
                 federation_enabled=False,
                 federation_role_arn="federationRoleArn",
                 ingestion_enabled=False,
@@ -2314,6 +2473,7 @@ class CfnEventDataStoreProps:
                     insight_type="insightType"
                 )],
                 kms_key_id="kmsKeyId",
+                max_event_size="maxEventSize",
                 multi_region_enabled=False,
                 name="name",
                 organization_enabled=False,
@@ -2329,12 +2489,14 @@ class CfnEventDataStoreProps:
             type_hints = typing.get_type_hints(_typecheckingstub__bc172d8375a6bcb019f0df4a0d571d671956c64545dc03fc01f9ad66e38ac10e)
             check_type(argname="argument advanced_event_selectors", value=advanced_event_selectors, expected_type=type_hints["advanced_event_selectors"])
             check_type(argname="argument billing_mode", value=billing_mode, expected_type=type_hints["billing_mode"])
+            check_type(argname="argument context_key_selectors", value=context_key_selectors, expected_type=type_hints["context_key_selectors"])
             check_type(argname="argument federation_enabled", value=federation_enabled, expected_type=type_hints["federation_enabled"])
             check_type(argname="argument federation_role_arn", value=federation_role_arn, expected_type=type_hints["federation_role_arn"])
             check_type(argname="argument ingestion_enabled", value=ingestion_enabled, expected_type=type_hints["ingestion_enabled"])
             check_type(argname="argument insights_destination", value=insights_destination, expected_type=type_hints["insights_destination"])
             check_type(argname="argument insight_selectors", value=insight_selectors, expected_type=type_hints["insight_selectors"])
             check_type(argname="argument kms_key_id", value=kms_key_id, expected_type=type_hints["kms_key_id"])
+            check_type(argname="argument max_event_size", value=max_event_size, expected_type=type_hints["max_event_size"])
             check_type(argname="argument multi_region_enabled", value=multi_region_enabled, expected_type=type_hints["multi_region_enabled"])
             check_type(argname="argument name", value=name, expected_type=type_hints["name"])
             check_type(argname="argument organization_enabled", value=organization_enabled, expected_type=type_hints["organization_enabled"])
@@ -2346,6 +2508,8 @@ class CfnEventDataStoreProps:
             self._values["advanced_event_selectors"] = advanced_event_selectors
         if billing_mode is not None:
             self._values["billing_mode"] = billing_mode
+        if context_key_selectors is not None:
+            self._values["context_key_selectors"] = context_key_selectors
         if federation_enabled is not None:
             self._values["federation_enabled"] = federation_enabled
         if federation_role_arn is not None:
@@ -2358,6 +2522,8 @@ class CfnEventDataStoreProps:
             self._values["insight_selectors"] = insight_selectors
         if kms_key_id is not None:
             self._values["kms_key_id"] = kms_key_id
+        if max_event_size is not None:
+            self._values["max_event_size"] = max_event_size
         if multi_region_enabled is not None:
             self._values["multi_region_enabled"] = multi_region_enabled
         if name is not None:
@@ -2408,6 +2574,17 @@ class CfnEventDataStoreProps:
         result = self._values.get("billing_mode")
         return typing.cast(typing.Optional[builtins.str], result)
 
+    @builtins.property
+    def context_key_selectors(
+        self,
+    ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, CfnEventDataStore.ContextKeySelectorProperty]]]]:
+        '''The list of context key selectors that are configured for the event data store.
+
+        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudtrail-eventdatastore.html#cfn-cloudtrail-eventdatastore-contextkeyselectors
+        '''
+        result = self._values.get("context_key_selectors")
+        return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, CfnEventDataStore.ContextKeySelectorProperty]]]], result)
+
     @builtins.property
     def federation_enabled(
         self,
@@ -2494,6 +2671,17 @@ class CfnEventDataStoreProps:
         result = self._values.get("kms_key_id")
         return typing.cast(typing.Optional[builtins.str], result)
 
+    @builtins.property
+    def max_event_size(self) -> typing.Optional[builtins.str]:
+        '''The maximum allowed size for events to be stored in the specified event data store.
+
+        If you are using context key selectors, MaxEventSize must be set to Large.
+
+        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudtrail-eventdatastore.html#cfn-cloudtrail-eventdatastore-maxeventsize
+        '''
+        result = self._values.get("max_event_size")
+        return typing.cast(typing.Optional[builtins.str], result)
+
     @builtins.property
     def multi_region_enabled(
         self,
@@ -2575,7 +2763,7 @@ class CfnEventDataStoreProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556)
+@jsii.implements(_IInspectable_c2943556, _IResourcePolicyRef_018c99ea)
 class CfnResourcePolicy(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -2611,7 +2799,8 @@ class CfnResourcePolicy(
         resource_arn: builtins.str,
         resource_policy: typing.Any,
     ) -> None:
-        '''
+        '''Create a new ``AWS::CloudTrail::ResourcePolicy``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param resource_arn: The Amazon Resource Name (ARN) of the CloudTrail event data store, dashboard, or channel attached to the resource-based policy. Example event data store ARN format: ``arn:aws:cloudtrail:us-east-2:123456789012:eventdatastore/EXAMPLE-f852-4e8f-8bd1-bcf6cEXAMPLE`` Example dashboard ARN format: ``arn:aws:cloudtrail:us-east-1:123456789012:dashboard/exampleDash`` Example channel ARN format: ``arn:aws:cloudtrail:us-east-2:123456789012:channel/01234567890``
@@ -2662,6 +2851,12 @@ class CfnResourcePolicy(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="resourcePolicyRef")
+    def resource_policy_ref(self) -> _ResourcePolicyReference_79964037:
+        '''A reference to a ResourcePolicy resource.'''
+        return typing.cast(_ResourcePolicyReference_79964037, jsii.get(self, "resourcePolicyRef"))
+
     @builtins.property
     @jsii.member(jsii_name="resourceArn")
     def resource_arn(self) -> builtins.str:
@@ -2771,7 +2966,7 @@ class CfnResourcePolicyProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556, _ITaggable_36806126)
+@jsii.implements(_IInspectable_c2943556, _ITrailRef_38211c4b, _ITaggable_36806126)
 class CfnTrail(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -2863,7 +3058,8 @@ class CfnTrail(
         tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
         trail_name: typing.Optional[builtins.str] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::CloudTrail::Trail``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param is_logging: Whether the CloudTrail trail is currently logging AWS API calls.
@@ -2908,6 +3104,48 @@ class CfnTrail(
 
         jsii.create(self.__class__, self, [scope, id, props])
 
+    @jsii.member(jsii_name="fromTrailArn")
+    @builtins.classmethod
+    def from_trail_arn(
+        cls,
+        scope: _constructs_77d1e7e8.Construct,
+        id: builtins.str,
+        arn: builtins.str,
+    ) -> _ITrailRef_38211c4b:
+        '''Creates a new ITrailRef from an ARN.
+
+        :param scope: -
+        :param id: -
+        :param arn: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__de13fd6629dabd92566f74df031bb3846b1f0c60616e28f88435c2f70ea1f0dd)
+            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
+            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
+            check_type(argname="argument arn", value=arn, expected_type=type_hints["arn"])
+        return typing.cast(_ITrailRef_38211c4b, jsii.sinvoke(cls, "fromTrailArn", [scope, id, arn]))
+
+    @jsii.member(jsii_name="fromTrailName")
+    @builtins.classmethod
+    def from_trail_name(
+        cls,
+        scope: _constructs_77d1e7e8.Construct,
+        id: builtins.str,
+        trail_name: builtins.str,
+    ) -> _ITrailRef_38211c4b:
+        '''Creates a new ITrailRef from a trailName.
+
+        :param scope: -
+        :param id: -
+        :param trail_name: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__de86420b3e78209dc350b0fda0b9e94a90b38d019fdd7b81692f6899942ea4ae)
+            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
+            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
+            check_type(argname="argument trail_name", value=trail_name, expected_type=type_hints["trail_name"])
+        return typing.cast(_ITrailRef_38211c4b, jsii.sinvoke(cls, "fromTrailName", [scope, id, trail_name]))
+
     @jsii.member(jsii_name="inspect")
     def inspect(self, inspector: _TreeInspector_488e0dd5) -> None:
         '''Examines the CloudFormation resource and discloses attributes.
@@ -2967,6 +3205,12 @@ class CfnTrail(
         '''Tag Manager which manages the tags for this resource.'''
         return typing.cast(_TagManager_0a598cb3, jsii.get(self, "tags"))
 
+    @builtins.property
+    @jsii.member(jsii_name="trailRef")
+    def trail_ref(self) -> _TrailReference_842f4da2:
+        '''A reference to a Trail resource.'''
+        return typing.cast(_TrailReference_842f4da2, jsii.get(self, "trailRef"))
+
     @builtins.property
     @jsii.member(jsii_name="isLogging")
     def is_logging(self) -> typing.Union[builtins.bool, _IResolvable_da3f097b]:
@@ -4408,7 +4652,7 @@ class S3EventSelector:
     def __init__(
         self,
         *,
-        bucket: _IBucket_42e086fd,
+        bucket: _IBucketRef_3debe44e,
         object_prefix: typing.Optional[builtins.str] = None,
     ) -> None:
         '''Selecting an S3 bucket and an optional prefix to be logged for data events.
@@ -4423,12 +4667,12 @@ class S3EventSelector:
             # The code below shows an example of how to instantiate this type.
             # The values are placeholders you should change.
             from aws_cdk import aws_cloudtrail as cloudtrail
-            from aws_cdk import aws_s3 as s3
+            from aws_cdk.interfaces import aws_s3 as interfaces_aws_s3
             
-            # bucket: s3.Bucket
+            # bucket_ref: interfaces_aws_s3.IBucketRef
             
             s3_event_selector = cloudtrail.S3EventSelector(
-                bucket=bucket,
+                bucket=bucket_ref,
             
                 # the properties below are optional
                 object_prefix="objectPrefix"
@@ -4445,11 +4689,11 @@ class S3EventSelector:
             self._values["object_prefix"] = object_prefix
 
     @builtins.property
-    def bucket(self) -> _IBucket_42e086fd:
+    def bucket(self) -> _IBucketRef_3debe44e:
         '''S3 bucket.'''
         result = self._values.get("bucket")
         assert result is not None, "Required property 'bucket' is missing"
-        return typing.cast(_IBucket_42e086fd, result)
+        return typing.cast(_IBucketRef_3debe44e, result)
 
     @builtins.property
     def object_prefix(self) -> typing.Optional[builtins.str]:
@@ -5285,12 +5529,14 @@ def _typecheckingstub__058a94222b13ad44b4607ad5932ec9b6a2defcb250ff436576e6e8976
     *,
     advanced_event_selectors: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union[CfnEventDataStore.AdvancedEventSelectorProperty, typing.Dict[builtins.str, typing.Any]]]]]] = None,
     billing_mode: typing.Optional[builtins.str] = None,
+    context_key_selectors: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union[CfnEventDataStore.ContextKeySelectorProperty, typing.Dict[builtins.str, typing.Any]]]]]] = None,
     federation_enabled: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
     federation_role_arn: typing.Optional[builtins.str] = None,
     ingestion_enabled: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
     insights_destination: typing.Optional[builtins.str] = None,
     insight_selectors: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union[CfnEventDataStore.InsightSelectorProperty, typing.Dict[builtins.str, typing.Any]]]]]] = None,
     kms_key_id: typing.Optional[builtins.str] = None,
+    max_event_size: typing.Optional[builtins.str] = None,
     multi_region_enabled: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
     name: typing.Optional[builtins.str] = None,
     organization_enabled: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
@@ -5325,6 +5571,12 @@ def _typecheckingstub__106939491635761bff083d6af3ca26d1723f9df71ec433399c5746554
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__aa0ae30f8c5291a79387d1a2f7fb5c056fc8459c7878eb58241f52eba3a4762e(
+    value: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, CfnEventDataStore.ContextKeySelectorProperty]]]],
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__765513d5a073b76962f766e5dc1a967c4ad42a5bb2200d9f880aac945789b35d(
     value: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]],
 ) -> None:
@@ -5361,6 +5613,12 @@ def _typecheckingstub__b2945b7a3d4af202bf1a8d8550ce4b17a1ab219e4dd829832fc9bd51a
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__a69353bf46f46a1067b410e6f91c0033234561f53fceb13608d40dd90dd0832e(
+    value: typing.Optional[builtins.str],
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__69742230d7479a5e2d180046d6dbe2ea4627b1fbe6861d248e8fa77f7c0dcd20(
     value: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]],
 ) -> None:
@@ -5418,6 +5676,14 @@ def _typecheckingstub__13e48a5f3f6a4ee090f15046f2744cbdc1f623a943843b6e8cd72526e
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__442b3465c9cf8a3aebc6597e8616078b26e24675af399050c52412909f6169e3(
+    *,
+    equal_to: typing.Sequence[builtins.str],
+    type: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__5dc8183d614f9c9498310cd377ff020cdc048d422b2548bbe678fc3c199d1dc6(
     *,
     insight_type: typing.Optional[builtins.str] = None,
@@ -5429,12 +5695,14 @@ def _typecheckingstub__bc172d8375a6bcb019f0df4a0d571d671956c64545dc03fc01f9ad66e
     *,
     advanced_event_selectors: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union[CfnEventDataStore.AdvancedEventSelectorProperty, typing.Dict[builtins.str, typing.Any]]]]]] = None,
     billing_mode: typing.Optional[builtins.str] = None,
+    context_key_selectors: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union[CfnEventDataStore.ContextKeySelectorProperty, typing.Dict[builtins.str, typing.Any]]]]]] = None,
     federation_enabled: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
     federation_role_arn: typing.Optional[builtins.str] = None,
     ingestion_enabled: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
     insights_destination: typing.Optional[builtins.str] = None,
     insight_selectors: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union[CfnEventDataStore.InsightSelectorProperty, typing.Dict[builtins.str, typing.Any]]]]]] = None,
     kms_key_id: typing.Optional[builtins.str] = None,
+    max_event_size: typing.Optional[builtins.str] = None,
     multi_region_enabled: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
     name: typing.Optional[builtins.str] = None,
     organization_enabled: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
@@ -5511,6 +5779,22 @@ def _typecheckingstub__2259d5765ec84e4697f55f0d491871f1aa010feb94b3445a33a9e4b9f
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__de13fd6629dabd92566f74df031bb3846b1f0c60616e28f88435c2f70ea1f0dd(
+    scope: _constructs_77d1e7e8.Construct,
+    id: builtins.str,
+    arn: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__de86420b3e78209dc350b0fda0b9e94a90b38d019fdd7b81692f6899942ea4ae(
+    scope: _constructs_77d1e7e8.Construct,
+    id: builtins.str,
+    trail_name: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__27c0b3977f3ce3e2ad80b21e158e38a08a45c6700ebeed895b3710e8c214a1bb(
     inspector: _TreeInspector_488e0dd5,
 ) -> None:
@@ -5695,7 +5979,7 @@ def _typecheckingstub__1cb2fd9327becb7b11bbb80f00762b693b18c3d8338685289adc8907f
 
 def _typecheckingstub__7d0df2bbec441689030ea9ec1ee0c490c06396957a77ed6d3353b714dbe525ea(
     *,
-    bucket: _IBucket_42e086fd,
+    bucket: _IBucketRef_3debe44e,
     object_prefix: typing.Optional[builtins.str] = None,
 ) -> None:
     """Type checking stubs"""