Resource: aws_cloudtrail_event_data_store

Provides a CloudTrail Event Data Store.

More information about event data stores can be found in the Event Data Store User Guide.

Example Usage

Basic

The most simple event data store configuration requires us to only set the name attribute. The event data store will automatically capture all management events. To capture management events from all the regions, multi_region_enabled must be true.

resource "aws_cloudtrail_event_data_store" "example" {
  name = "example-event-data-store"
}

Data Event Logging

CloudTrail can log Data Events for certain services such as S3 bucket objects and Lambda function invocations. Additional information about data event configuration can be found in the following links:

Log all DynamoDB PutEvent actions for a specific DynamoDB table

data "aws_dynamodb_table" "table" {
  name = "not-important-dynamodb-table"
}

resource "aws_cloudtrail_event_data_store" "example" {
  # ... other configuration ...

  advanced_event_selector {
    name = "Log all DynamoDB PutEvent actions for a specific DynamoDB table"

    field_selector {
      field  = "eventCategory"
      equals = ["Data"]
    }

    field_selector {
      field = "resources.type"

      equals = [
        "AWS::DynamoDB::Table"
      ]
    }

    field_selector {
      field  = "eventName"
      equals = ["PutItem"]
    }

    field_selector {
      field = "resources.ARN"

      equals = [
        data.aws_dynamodb_table.table.arn
      ]
    }
  }
}

Argument Reference

This resource supports the following arguments:

Advanced Event Selector Arguments

advanced_event_selector supports the following arguments:

Field Selector Arguments

field_selector supports the following arguments:

Attribute Reference

This resource exports the following attributes in addition to the arguments above:

Import

In Terraform v1.5.0 and later, use an import block to import event data stores using their arn. For example:

import {
  to = aws_cloudtrail_event_data_store.example
  id = "arn:aws:cloudtrail:us-east-1:123456789123:eventdatastore/22333815-4414-412c-b155-dd254033gfhf"
}

Using terraform import, import event data stores using their arn. For example:

% terraform import aws_cloudtrail_event_data_store.example arn:aws:cloudtrail:us-east-1:123456789123:eventdatastore/22333815-4414-412c-b155-dd254033gfhf