CmdID

CmdID / aws / aws cloudtrail

aws cloudtrail put-event-selectors

Configures event selectors (also referred to as basic event selectors) or advanced event selectors for your trail. AWS CLI reference

3 examples 3 options Its page in the AWS CLI reference

Opens CmdID with your command. It is read in your browser and sent nowhere.

Examples

from aws-cli, each command read by CmdID

Example 1: To configure a trail to log management events and data events by using advanced event selectors

The following put-event-selectors example creates an advanced event selector for a trail named myTrail to log all management events, log S3 PutObject and DeleteObject API calls for all but one S3 bucket, log data API calls for a Lambda function named myFunction, and log Publish API calls on an SNS topic named myTopic.

You can add advanced event selectors, and conditions for your advanced event selectors, up to a maximum of 500 values for all conditions and selectors on a trail. You can use advanced event selectors to log all available data event types. You can use either advanced event selectors or basic event selectors, but not both. If you apply advanced event selectors to a trail, any existing basic event selectors are overwritten.

aws cloudtrail put-event-selectors --trail-name myTrail --advanced-event-selectors '[{"Name": "Log all management events", "FieldSelectors": [{ "Field": "eventCategory", "Equals": ["Management"] }] },{"Name": "Log PutObject and DeleteObject events for all but one bucket","FieldSelectors": [{ "Field": "eventCategory", "Equals": ["Data"] },{ "Field": "resources.type", "Equals": ["AWS::S3::Object"] },{ "Field": "eventName", "Equals": ["PutObject","DeleteObject"] },{ "Field": "resources.ARN", "NotStartsWith": ["arn:aws:s3:::amzn-s3-demo-bucket/"] }]},{"Name": "Log data events for a specific Lambda function","FieldSelectors": [{ "Field": "eventCategory", "Equals": ["Data"] },{ "Field": "resources.type", "Equals": ["AWS::Lambda::Function"] },{ "Field": "resources.ARN", "Equals": ["arn:aws:lambda:us-west-2:123456789012:function:myFunction"] }]},{"Name": "Log all Publish API calls on a specific SNS topic","FieldSelectors": [{ "Field": "eventCategory", "Equals": ["Data"] },{ "Field": "resources.type", "Equals": ["AWS::SNS::Topic"] },{ "Field": "eventName", "Equals": ["Publish"] },{ "Field": "resources.ARN", "Equals": ["arn:aws:sns:us-west-2:123456789012:myTopic.fifo"] }]}]'Identify
--trail-nameSpecifies the name of the trail or trail ARN.
--advanced-event-selectorsSpecifies the settings for advanced event selectors.
Its output, shortened
{
    "TrailARN": "arn:aws:cloudtrail:us-west-2:123456789012:trail/myTrail",
    "AdvancedEventSelectors": [
        {
            "Name": "Log all management events",
            "FieldSelectors": [
                {
                    "Field": "eventCategory",
                    "Equals": [
                        "Management"
                    ]
                }
            ]
        },
        {
            "Name": "Log PutObject and DeleteObject events for all but one bucket",
            "FieldSelectors": [
                {
                    "Field": "eventCategory",
                    "Equals": [
                        "Data"
                    ]
                },
                {
                    "Field": "resources.type",
                    "Equals": [
                        "AWS::S3::Object"
                    ]
                },
                {
… 68 more lines

For more information, see Log events by using advanced event selectors in the AWS CloudTrail User Guide.

Example 2: To configure event selectors for a trail to log all management events and data events

The following put-event-selectors example creates an event selector for a trail named TrailName to include all management events, data events for two Amazon S3 bucket/prefix combinations, and data events for a single AWS Lambda function named hello-world-python-function.

You can configure up to 5 event selectors for a trail and up to 250 data resources for a trail. Event selectors are also referred to as basic event selectors. You can use event selectors to log management events and data events for S3 objects, Lambda functions, and DynnamoDB tables. To log data events for other resource types, you must use advanced event selectors.

aws cloudtrail put-event-selectors --trail-name TrailName --event-selectors '[{"ReadWriteType": "All","IncludeManagementEvents": true,"DataResources": [{"Type":"AWS::S3::Object", "Values": ["arn:aws:s3:::amzn-s3-demo-bucket/prefix","arn:aws:s3:::amzn-s3-demo-bucket2/prefix2"]},{"Type": "AWS::Lambda::Function","Values": ["arn:aws:lambda:us-west-2:123456789012:function:hello-world-python-function"]}]}]'Identify
--trail-nameSpecifies the name of the trail or trail ARN.
--event-selectorsSpecifies the settings for your event selectors.
Its output
{
    "EventSelectors": [
        {
            "IncludeManagementEvents": true,
            "DataResources": [
                {
                    "Values": [
                        "arn:aws:s3:::amzn-s3-demo-bucket/prefix",
                        "arn:aws:s3:::amzn-s3-demo-bucket2/prefix2"
                    ],
                    "Type": "AWS::S3::Object"
                },
                {
                    "Values": [
                        "arn:aws:lambda:us-west-2:123456789012:function:hello-world-python-function"
                    ],
                    "Type": "AWS::Lambda::Function"
                }
            ],
            "ReadWriteType": "All"
        }
    ],
    "TrailARN": "arn:aws:cloudtrail:us-west-2:123456789012:trail/TrailName"
}

For more information, see Log events by using basic event selectors in the AWS CloudTrail User Guide.

Example 3: To configure event selectors for a trail to log management events, all S3 data events on S3 objects, and all Lambda data events on functions in your account

The following put-event-selectors example creates an event selector for a trail named TrailName2 that includes all management events, and all data events for all Amazon S3 buckets and AWS Lambda functions in the AWS account.

aws cloudtrail put-event-selectors --trail-name TrailName2 --event-selectors '[{"ReadWriteType": "All","IncludeManagementEvents": true,"DataResources": [{"Type":"AWS::S3::Object", "Values": ["arn:aws:s3"]},{"Type": "AWS::Lambda::Function","Values": ["arn:aws:lambda"]}]}]'Identify
--trail-nameSpecifies the name of the trail or trail ARN.
--event-selectorsSpecifies the settings for your event selectors.
Its output
{
    "EventSelectors": [
        {
            "IncludeManagementEvents": true,
            "DataResources": [
                {
                    "Values": [
                        "arn:aws:s3"
                    ],
                    "Type": "AWS::S3::Object"
                },
                {
                    "Values": [
                        "arn:aws:lambda"
                    ],
                    "Type": "AWS::Lambda::Function"
                }
            ],
            "ReadWriteType": "All"
        }
    ],
    "TrailARN": "arn:aws:cloudtrail:us-west-2:123456789012:trail/TrailName2"
}

For more information, see Log events by using basic event selectors in the AWS CloudTrail User Guide.

Options

3 in the AWS CLI reference
--advanced-event-selectorsSpecifies the settings for advanced event selectors.
--event-selectorsSpecifies the settings for your event selectors.
--trail-nameSpecifies the name of the trail or trail ARN.