Put Event Selectors
cloudtrail_put_event_selectors | R Documentation |
Configures an event selector or advanced event selectors for your trail¶
Description¶
Configures an event selector or advanced event selectors for your trail. Use event selectors or advanced event selectors to specify management and data event settings for your trail. If you want your trail to log Insights events, be sure the event selector enables logging of the Insights event types you want configured for your trail. For more information about logging Insights events, see Logging Insights events in the CloudTrail User Guide. By default, trails created without specific event selectors are configured to log all read and write management events, and no data events.
When an event occurs in your account, CloudTrail evaluates the event selectors or advanced event selectors in all trails. For each trail, if the event matches any event selector, the trail processes and logs the event. If the event doesn't match any event selector, the trail doesn't log the event.
Example
-
You create an event selector for a trail and specify that you want write-only events.
-
The EC2
GetConsoleOutput
andRunInstances
API operations occur in your account. -
CloudTrail evaluates whether the events match your event selectors.
-
The
RunInstances
is a write-only event and it matches your event selector. The trail logs the event. -
The
GetConsoleOutput
is a read-only event that doesn't match your event selector. The trail doesn't log the event.
The put_event_selectors
operation must be called from the Region in
which the trail was created; otherwise, an InvalidHomeRegionException
exception is thrown.
You can configure up to five event selectors for each trail. For more information, see Logging management events, Logging data events, and Quotas in CloudTrail in the CloudTrail User Guide.
You can add advanced event selectors, and conditions for your advanced
event selectors, up to a maximum of 500 values for all conditions and
selectors on a trail. You can use either AdvancedEventSelectors
or
EventSelectors
, but not both. If you apply AdvancedEventSelectors
to
a trail, any existing EventSelectors
are overwritten. For more
information about advanced event selectors, see Logging data
events
in the CloudTrail User Guide.
Usage¶
Arguments¶
TrailName
[required] Specifies the name of the trail or trail ARN. If you specify a trail name, the string must meet the following requirements:
Contain only ASCII letters (a-z, A-Z), numbers (0-9), periods (.), underscores (_), or dashes (-)
Start with a letter or number, and end with a letter or number
Be between 3 and 128 characters
Have no adjacent periods, underscores or dashes. Names like
my-_namespace
andmy--namespace
are not valid.Not be in IP address format (for example, 192.168.5.4)
If you specify a trail ARN, it must be in the following format.
arn:aws:cloudtrail:us-east-2:123456789012:trail/MyTrail
EventSelectors
Specifies the settings for your event selectors. You can configure up to five event selectors for a trail. You can use either
EventSelectors
orAdvancedEventSelectors
in aput_event_selectors
request, but not both. If you applyEventSelectors
to a trail, any existingAdvancedEventSelectors
are overwritten.AdvancedEventSelectors
Specifies the settings for advanced event selectors. You can add advanced event selectors, and conditions for your advanced event selectors, up to a maximum of 500 values for all conditions and selectors on a trail. You can use either
AdvancedEventSelectors
orEventSelectors
, but not both. If you applyAdvancedEventSelectors
to a trail, any existingEventSelectors
are overwritten. For more information about advanced event selectors, see Logging data events in the CloudTrail User Guide.
Value¶
A list with the following syntax:
list(
TrailARN = "string",
EventSelectors = list(
list(
ReadWriteType = "ReadOnly"|"WriteOnly"|"All",
IncludeManagementEvents = TRUE|FALSE,
DataResources = list(
list(
Type = "string",
Values = list(
"string"
)
)
),
ExcludeManagementEventSources = list(
"string"
)
)
),
AdvancedEventSelectors = list(
list(
Name = "string",
FieldSelectors = list(
list(
Field = "string",
Equals = list(
"string"
),
StartsWith = list(
"string"
),
EndsWith = list(
"string"
),
NotEquals = list(
"string"
),
NotStartsWith = list(
"string"
),
NotEndsWith = list(
"string"
)
)
)
)
)
)
Request syntax¶
svc$put_event_selectors(
TrailName = "string",
EventSelectors = list(
list(
ReadWriteType = "ReadOnly"|"WriteOnly"|"All",
IncludeManagementEvents = TRUE|FALSE,
DataResources = list(
list(
Type = "string",
Values = list(
"string"
)
)
),
ExcludeManagementEventSources = list(
"string"
)
)
),
AdvancedEventSelectors = list(
list(
Name = "string",
FieldSelectors = list(
list(
Field = "string",
Equals = list(
"string"
),
StartsWith = list(
"string"
),
EndsWith = list(
"string"
),
NotEquals = list(
"string"
),
NotStartsWith = list(
"string"
),
NotEndsWith = list(
"string"
)
)
)
)
)
)