CloudTrail

5 resource kinds. Generated from the operator's CRD schemas.

API Group: aws.konfig.io/v1alpha1

CloudTrailChannel # CLOUD CONTROL · AWS::CloudTrail::Channel

CloudTrailChannel manages AWS::CloudTrail::Channel through the AWS Cloud Control API.

kubectl get cloudtrailchannels · example on GitHub

Example

# CloudTrailChannel — CloudTrail
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/cloudtrail.html#cloudtrailchannel
apiVersion: aws.konfig.io/v1alpha1
kind: CloudTrailChannel
metadata:
  name: example-cloudtrailchannel
  namespace: default
spec:
  destinations:
  - location: example
    type: EVENT_DATA_STORE
  name: example-cloudtrailchannel
  providerRef:
    name: example-cloudtrailchannel
    region: us-east-1
  source: example
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`destinations`	array<object>	—	One or more resources to which events arriving through a channel are logged and stored.
`destinations[].location`	string	yes	The ARN of a resource that receives events from a channel.
`destinations[].type`	enum	yes	The type of destination for events arriving from a channel. Allowed: `EVENT_DATA_STORE`
`name`	string	—
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`source`	string	—	The ARN of an on-premises storage solution or application, or a partner event source.
`tags`	array<object>	—	An array of key-value pairs to apply to this resource.
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`channelArn`	string	—	Read-only: reported by AWS after creation.
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

CloudTrailDashboard # CLOUD CONTROL · AWS::CloudTrail::Dashboard

CloudTrailDashboard manages AWS::CloudTrail::Dashboard through the AWS Cloud Control API.

kubectl get cloudtraildashboards · example on GitHub

Example

# CloudTrailDashboard — CloudTrail
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/cloudtrail.html#cloudtraildashboard
apiVersion: aws.konfig.io/v1alpha1
kind: CloudTrailDashboard
metadata:
  name: example-cloudtraildashboard
  namespace: default
spec:
  name: example-cloudtraildashboard
  providerRef:
    name: example-cloudtraildashboard
    region: us-east-1
  refreshSchedule:
    frequency:
      unit: HOURS
      value: 1
    status: ENABLED
    timeOfDay: '2026-01-01T00:00:00Z'
  tags:
  - key: example
    value: example
  terminationProtectionEnabled: true
  widgets:
  - queryParameters:
    - example
    queryStatement: example
    viewProperties:
      key: value

Spec

Field	Type	Required	Description
`name`	string	—	The name of the dashboard.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`refreshSchedule`	object	—	Configures the automatic refresh schedule for the dashboard.
`refreshSchedule.frequency`	object	—	CloudTrailDashboardRefreshScheduleFrequency is a nested property type of AWS::CloudTrail::Dashboard.
`refreshSchedule.frequency.unit`	enum	yes	The frequency unit. Allowed: `HOURS, DAYS`
`refreshSchedule.frequency.value`	integer	yes	The frequency value.
`refreshSchedule.status`	enum	—	The status of the schedule. Allowed: `ENABLED, DISABLED`
`refreshSchedule.timeOfDay`	string	—	StartTime of the automatic schedule refresh.
`tags`	array<object>	—
`tags[].key`	string	yes
`tags[].value`	string	yes
`terminationProtectionEnabled`	boolean	—	Indicates whether the dashboard is protected from termination.
`widgets`	array<object>	—	List of widgets on the dashboard
`widgets[].queryParameters`	array<string>	—	The placeholder keys in the QueryStatement.
`widgets[].queryStatement`	string	yes	The SQL query statement on one or more event data stores.
`widgets[].viewProperties`	map<string>	—	The view properties of the widget.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`createdTimestamp`	string	—	The timestamp of the dashboard creation.
`dashboardArn`	string	—	The ARN of the dashboard.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`status`	enum	—	The status of the dashboard. Allowed: `CREATING, CREATED, UPDATING, UPDATED, DELETING`
`type`	enum	—	The type of the dashboard. Allowed: `MANAGED, CUSTOM`
`updatedTimestamp`	string	—	The timestamp showing when the dashboard was updated, if applicable.

CloudTrailEventDataStore # CLOUD CONTROL · AWS::CloudTrail::EventDataStore

CloudTrailEventDataStore manages AWS::CloudTrail::EventDataStore through the AWS Cloud Control API.

kubectl get cloudtraileventdatastores · example on GitHub

Example

# CloudTrailEventDataStore — CloudTrail
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/cloudtrail.html#cloudtraileventdatastore
apiVersion: aws.konfig.io/v1alpha1
kind: CloudTrailEventDataStore
metadata:
  name: example-cloudtraileventdatastore
  namespace: default
spec:
  advancedEventSelectors:
  - fieldSelectors:
    - endsWith:
      - example
      equals:
      - example
      field: example
      notEndsWith:
      - example
      notEquals:
      - example
      notStartsWith:
      - example
      startsWith:
      - example
    name: example-cloudtraileventdatastore
  billingMode: example
  contextKeySelectors:
  - equals:
    - example
    type: RequestContext
  federationEnabled: true
  federationRoleArn: arn:aws:iam::123456789012:role/example-role
  ingestionEnabled: true
  insightSelectors:
  - insightType: example
  insightsDestination: example
  kmsKeyId: arn:aws:kms:us-east-1:123456789012:key/1234abcd-12ab-34cd-56ef-1234567890ab
  maxEventSize: Standard
  multiRegionEnabled: true
  name: example-cloudtraileventdatastore
  organizationEnabled: true
  providerRef:
    name: example-cloudtraileventdatastore
    region: us-east-1
  retentionPeriod: 7
  tags:
  - key: example
    value: example
  terminationProtectionEnabled: true

Spec

Field	Type	Required	Description
`advancedEventSelectors`	array<object>	—	The advanced event selectors that were used to select events for the data store.
`advancedEventSelectors[].fieldSelectors`	array<object>	yes	Contains all selector statements in an advanced event selector.
`advancedEventSelectors[].fieldSelectors[].endsWith`	array<string>	—	An operator that includes events that match the last few characters of the event record field specified as the value of Field.
`advancedEventSelectors[].fieldSelectors[].equals`	array<string>	—	An operator that includes events that match the exact value of the event record field specified as the value of Field.
`advancedEventSelectors[].fieldSelectors[].field`	string	yes	A field in an event record on which to filter events to be logged.
`advancedEventSelectors[].fieldSelectors[].notEndsWith`	array<string>	—	An operator that excludes events that match the last few characters of the event record field specified as the value of Field.
`advancedEventSelectors[].fieldSelectors[].notEquals`	array<string>	—	An operator that excludes events that match the exact value of the event record field specified as the value of Field.
`advancedEventSelectors[].fieldSelectors[].notStartsWith`	array<string>	—	An operator that excludes events that match the first few characters of the event record field specified as the value of Field.
`advancedEventSelectors[].fieldSelectors[].startsWith`	array<string>	—	An operator that includes events that match the first few characters of the event record field specified as the value of Field.
`advancedEventSelectors[].name`	string	—	An optional, descriptive name for an advanced event selector, such as "Log data events for only two S3 buckets".
`billingMode`	string	—	The mode that the event data store will use to charge for event storage.
`contextKeySelectors`	array<object>	—	An array that enriches event records in an existing event data store by including additional information specified in individual ContexKeySelector entries.
`contextKeySelectors[].equals`	array<string>	yes	An operator that includes events that match the exact value of the event record field specified in Type.
`contextKeySelectors[].type`	enum	yes	Specifies the type of the event record field in ContextKeySelector. Allowed: `RequestContext, TagContext`
`federationEnabled`	boolean	—	Indicates whether federation is enabled on an event data store.
`federationRoleArn`	string	—	The ARN of the role used for event data store federation.
`ingestionEnabled`	boolean	—	Indicates whether the event data store is ingesting events.
`insightSelectors`	array<object>	—	Lets you enable Insights event logging by specifying the Insights selectors that you want to enable on an existing event data store.
`insightSelectors[].insightType`	string	—	The type of Insights to log on an event data store.
`insightsDestination`	string	—	Specifies the ARN of the event data store that will collect Insights events.
`kmsKeyId`	string	—	Specifies the KMS key ID to use to encrypt the events delivered by CloudTrail.
`maxEventSize`	enum	—	Specifies the maximum size allowed for the event. Allowed: `Standard, Large`
`multiRegionEnabled`	boolean	—	Indicates whether the event data store includes events from all regions, or only from the region in which it was created.
`name`	string	—	The name of the event data store.
`organizationEnabled`	boolean	—	Indicates that an event data store is collecting logged events for an organization.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`retentionPeriod`	integer	—	The retention period, in days.
`tags`	array<object>	—
`tags[].key`	string	yes
`tags[].value`	string	yes
`terminationProtectionEnabled`	boolean	—	Indicates whether the event data store is protected from termination.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`createdTimestamp`	string	—	The timestamp of the event data store's creation.
`eventDataStoreArn`	string	—	The ARN of the event data store.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`status`	string	—	The status of an event data store.
`updatedTimestamp`	string	—	The timestamp showing when an event data store was updated, if applicable.

CloudTrailResourcePolicy # CLOUD CONTROL · AWS::CloudTrail::ResourcePolicy

CloudTrailResourcePolicy manages AWS::CloudTrail::ResourcePolicy through the AWS Cloud Control API.

kubectl get cloudtrailresourcepolicies · example on GitHub

Example

# CloudTrailResourcePolicy — CloudTrail
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/cloudtrail.html#cloudtrailresourcepolicy
apiVersion: aws.konfig.io/v1alpha1
kind: CloudTrailResourcePolicy
metadata:
  name: example-cloudtrailresourcepolicy
  namespace: default
spec:
  providerRef:
    name: example-cloudtrailresourcepolicy
    region: us-east-1
  resourceArn: arn:aws:iam::123456789012:role/example-role

Spec

Field	Type	Required	Description
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`resourceArn`	string	yes	The ARN of the AWS CloudTrail resource to which the policy applies.
`resourcePolicy`	object	yes	A policy document containing permissions to add to the specified resource.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

Trail # GA

Trail is the Schema for managing CloudTrail trails.

kubectl get trails · example on GitHub

Example

# Trail — CloudTrail
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/cloudtrail.html#trail
apiVersion: aws.konfig.io/v1alpha1
kind: Trail
metadata:
  name: example-trail
  namespace: default
spec:
  cloudWatchLogsLogGroupArn: arn:aws:iam::123456789012:role/example-role
  cloudWatchLogsRoleArn: arn:aws:iam::123456789012:role/example-role
  enableLogFileValidation: true
  enableLogging: true
  includeGlobalServiceEvents: false
  isMultiRegionTrail: false
  kmsKeyId: arn:aws:kms:us-east-1:123456789012:key/1234abcd-12ab-34cd-56ef-1234567890ab
  providerRef:
    name: example-trail
    region: us-east-1
  s3BucketName: example-trail
  s3KeyPrefix: example
  tags:
    environment: dev
    team: platform
  trailName: example-trail

Spec

Field	Type	Required	Description
`cloudWatchLogsLogGroupArn`	string	—	CloudWatchLogsLogGroupArn is the log group ARN to which CloudTrail logs are delivered.
`cloudWatchLogsRoleArn`	string	—	CloudWatchLogsRoleArn is the role for the CloudWatch Logs endpoint to assume to write to the log group.
`enableLogFileValidation`	boolean	—	EnableLogFileValidation enables log file integrity validation.
`enableLogging`	boolean	—	EnableLogging starts (true) or stops (false) recording of API calls.
`includeGlobalServiceEvents`	boolean	—	IncludeGlobalServiceEvents publishes events from global services such as IAM.
`isMultiRegionTrail`	boolean	—	IsMultiRegionTrail creates the trail in all Regions.
`kmsKeyId`	string	—	KMSKeyID is the KMS key ID/ARN/alias used to encrypt delivered logs.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`s3BucketName`	string	yes	S3BucketName is the S3 bucket designated for publishing log files.
`s3KeyPrefix`	string	—	S3KeyPrefix is the S3 key prefix that follows the bucket name.
`tags`	map<string>	—	Tags are AWS resource tags to apply to the trail.
`trailName`	string	yes	TrailName is the name of the trail.

Status

Field	Type	Required	Description
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`isLogging`	boolean	—	IsLogging reports whether the trail is currently logging.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.
`trailArn`	string	—	TrailARN is the ARN of the trail.