aws / aws/aws-cdk

(cloudtrail): Simplify advanced event selectors for trails

Open
#19,398 3 comments 0 reactions 0 assignees View on GitHub
@aws-cdk/aws-cloudtrail effort/medium feature-request feature/service-integration p3
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Description

It is currently difficult and overhead-prone to create a CloudTrail trail with an advanced event selector.

### Use Case

To easily be able to link Lambda functions to a trail by a substring of the ARN.

### Proposed Solution

The current implementation based on the linked Stack Overflow post:

```
endpoint_selectors_call_id = custom_resources.PhysicalResourceId.of(
"endpoint-function-selectors"
)
common_selectors = [
{"Field": "eventCategory", "Equals": ["Data"]},
{"Field": "resources.type", "Equals": ["AWS::Lambda::Function"]},
]
endpoint_selectors_call = custom_resources.AwsSdkCall(
service="CloudTrail",
action="putEventSelectors",
parameters={
"TrailName": trail.trail_arn,
"AdvancedEventSelectors": [
{
"Name": "Log 'dataset-versions' Lambda functions",
"FieldSelectors": [
*common_selectors,
{"Field": "resources.ARN", "EndsWith": ["dataset-versions"]},
],
},
{
"Name": "Log 'datasets' Lambda functions",
"FieldSelectors": [
*common_selectors,
{"Field": "resources.ARN", "EndsWith": ["datasets"]},
],
},
{
"Name": "Log 'import-status' Lambda functions",
"FieldSelectors": [
*common_selectors,
{"Field": "resources.ARN", "EndsWith": ["import-status"]},
],
},
],
},
physical_resource_id=endpoint_selectors_call_id,
)
endpoint_selectors_policy = custom_resources.AwsCustomResourcePolicy.from_sdk_calls(
resources=[trail.trail_arn]
)
custom_resources.AwsCustomResource(
self,
"endpoint-function-selectors",
on_create=endpoint_selectors_call,
policy=endpoint_selectors_policy,
)
```

As you can see the only interesting parts of the code above are the field selectors and their connection to the trail. A solution might enable specifying those without the overhead of the physical resource ID, policy, and magic strings like `putEventSelectors`.

### Other information

[How to link a trail to functions by partial name in CDK?](https://stackoverflow.com/questions/71462211/how-to-link-a-trail-to-functions-by-partial-name-in-cdk)

### Acknowledge

- [ ] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

Contributor guide

Open the contributing guide

Research direction

The issue names no repository files or tests. Start by locating the CloudTrail trail implementation and the custom_resources.AwsSdkCall and AwsCustomResource path shown in the example; done should allow advanced event selectors to be connected to a trail without manually supplying the physical resource ID, policy, and action string.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud, infrastructure
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.