CloudWatch Logs

16 resource kinds. Generated from the operator's CRD schemas.

API Group: aws.konfig.io/v1alpha1

LogGroup # GA

LogGroup is the Schema for managing CloudWatch Log Groups.

kubectl get loggroups · example on GitHub

Example

# LogGroup — CloudWatch Logs
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/cloudwatchlogs.html#loggroup
apiVersion: aws.konfig.io/v1alpha1
kind: LogGroup
metadata:
  name: example-loggroup
  namespace: default
spec:
  kmsKeyArn: arn:aws:iam::123456789012:role/example-role
  logGroupName: example-loggroup
  providerRef:
    name: example-loggroup
    region: us-east-1
  retentionInDays: 7
  tags:
    environment: dev
    team: platform

Spec

FieldTypeRequiredDescription
kmsKeyArnstring—KMSKeyARN is the KMS key ARN for encrypting log data.
logGroupNamestringyesLogGroupName is the name of the log group.
providerRefobject—ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
providerRef.namestringyesName of a cluster-scoped AWSProvider.
providerRef.regionstring—Region overrides the provider's region for this resource only.
retentionInDaysenum—RetentionInDays sets the log retention period. Allowed: 0, 1, 3, 5, 7, 14, 30, 60…
tagsmap<string>—Tags are AWS resource tags to apply.

Status

FieldTypeRequiredDescription
arnstring—ARN is the ARN of the log group.
awsProviderobject—AWSProvider confirms the account and region this resource was reconciled against.
awsProvider.accountIdstring—AccountID the resource lives in.
awsProvider.namestring—Name of the AWSProvider used; empty when the operator's own credentials were used.
awsProvider.regionstring—Region the resource lives in (empty for global services).
conditionsarray<object>—Conditions describe the current state of the resource.
conditions[].lastTransitionTimestringyeslastTransitionTime is the last time the condition transitioned from one status to another.
conditions[].messagestringyesmessage is a human readable message indicating details about the transition.
conditions[].observedGenerationinteger—observedGeneration represents the .metadata.generation that the condition was set based upon.
conditions[].reasonstringyesreason contains a programmatic identifier indicating the reason for the condition's last transition.
conditions[].statusenumyesstatus of the condition, one of True, False, Unknown. Allowed: True, False, Unknown
conditions[].typestringyestype of condition in CamelCase or in foo.example.com/CamelCase.
lastSyncTimestring—LastSyncTime is when the resource was last successfully reconciled.
observedGenerationinteger—ObservedGeneration is the most recent .metadata.generation reconciled.

LogsAccountPolicy # CLOUD CONTROL · AWS::Logs::AccountPolicy ⚠ DESTRUCTIVE SCOPE

Caution, destructive scope: account-wide CloudWatch Logs policy applied to every log group. Provided for completeness; do not use from application namespaces. Restrict with AWSProvider.allowedNamespaces and RBAC. LogsAccountPolicy manages AWS::Logs::AccountPolicy through the AWS Cloud Control API.

kubectl get logsaccountpolicies · example on GitHub

Example

# LogsAccountPolicy — CloudWatch Logs
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/cloudwatchlogs.html#logsaccountpolicy
apiVersion: aws.konfig.io/v1alpha1
kind: LogsAccountPolicy
metadata:
  name: example-logsaccountpolicy
  namespace: default
spec:
  policyDocument: '{"Version": "2012-10-17", "Statement": [{"Effect": "Allow", "Action": ["s3:GetObject"],
    "Resource": "*"}]}'
  policyName: example-logsaccountpolicy
  policyType: DATA_PROTECTION_POLICY
  providerRef:
    name: example-logsaccountpolicy
    region: us-east-1
  scope: ALL
  selectionCriteria: example

Spec

FieldTypeRequiredDescription
policyDocumentstringyesThe body of the policy document you want to use for this topic.
policyNamestringyesThe name of the account policy Create-only in AWS: changing it requires replacing the resource.
policyTypeenumyesType of the policy. Allowed: DATA_PROTECTION_POLICY, SUBSCRIPTION_FILTER_POLICY, FIELD_INDEX_POLICY, TRANSFORMER_POLICY, METRIC_EXTRACTION_POLICY
providerRefobject—ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
providerRef.namestringyesName of a cluster-scoped AWSProvider.
providerRef.regionstring—Region overrides the provider's region for this resource only.
scopeenum—Scope for policy application Allowed: ALL
selectionCriteriastring—Log group selection criteria to apply policy only to a subset of log groups.

Status

FieldTypeRequiredDescription
accountIdstring—User account id Read-only: reported by AWS after creation.
attemptinteger—Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
awsProviderobject—AWSProvider confirms the account and region this resource was reconciled against.
awsProvider.accountIdstring—AccountID the resource lives in.
awsProvider.namestring—Name of the AWSProvider used; empty when the operator's own credentials were used.
awsProvider.regionstring—Region the resource lives in (empty for global services).
conditionsarray<object>—Conditions describe the current state of the resource.
conditions[].lastTransitionTimestringyeslastTransitionTime is the last time the condition transitioned from one status to another.
conditions[].messagestringyesmessage is a human readable message indicating details about the transition.
conditions[].observedGenerationinteger—observedGeneration represents the .metadata.generation that the condition was set based upon.
conditions[].reasonstringyesreason contains a programmatic identifier indicating the reason for the condition's last transition.
conditions[].statusenumyesstatus of the condition, one of True, False, Unknown. Allowed: True, False, Unknown
conditions[].typestringyestype of condition in CamelCase or in foo.example.com/CamelCase.
identifierstring—Identifier is the Cloud Control primary identifier of the resource.
lastSyncTimestring—
observedGenerationinteger—
operationstring—Operation is the in-flight operation (CREATE, UPDATE, DELETE).
operationStatusstring—OperationStatus is the last reported operation status.
requestTokenstring—RequestToken tracks an in-flight asynchronous operation.

LogsDelivery # CLOUD CONTROL · AWS::Logs::Delivery

LogsDelivery manages AWS::Logs::Delivery through the AWS Cloud Control API.

kubectl get logsdeliveries · example on GitHub

Example

# LogsDelivery — CloudWatch Logs
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/cloudwatchlogs.html#logsdelivery
apiVersion: aws.konfig.io/v1alpha1
kind: LogsDelivery
metadata:
  name: example-logsdelivery
  namespace: default
spec:
  deliveryDestinationArn: arn:aws:iam::123456789012:role/example-role
  deliverySourceName: example-logsdelivery
  fieldDelimiter: examp
  providerRef:
    name: example-logsdelivery
    region: us-east-1
  recordFields:
  - example
  s3EnableHiveCompatiblePath: true
  s3SuffixPath: example
  tags:
  - key: example
    value: example

Spec

FieldTypeRequiredDescription
deliveryDestinationArnstringyesThe ARN of the delivery destination that is associated with this delivery.
deliverySourceNamestringyesThe name of the delivery source that is associated with this delivery.
fieldDelimiterstring—The field delimiter to use between record fields when the final output format of a delivery is in Plain , W3C , or Raw format.
providerRefobject—ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
providerRef.namestringyesName of a cluster-scoped AWSProvider.
providerRef.regionstring—Region overrides the provider's region for this resource only.
recordFieldsarray<string>—The list of record fields to be delivered to the destination, in order.
s3EnableHiveCompatiblePathboolean—This parameter causes the S3 objects that contain delivered logs to use a prefix structure that allows for integration with Apache Hive.
s3SuffixPathstring—This string allows re-configuring the S3 object prefix to contain either static or variable sections.
tagsarray<object>—The tags that have been assigned to this delivery.
tags[].keystringyes
tags[].valuestringyes

Status

FieldTypeRequiredDescription
arnstring—The Amazon Resource Name (ARN) that uniquely identifies this delivery.
attemptinteger—Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
awsProviderobject—AWSProvider confirms the account and region this resource was reconciled against.
awsProvider.accountIdstring—AccountID the resource lives in.
awsProvider.namestring—Name of the AWSProvider used; empty when the operator's own credentials were used.
awsProvider.regionstring—Region the resource lives in (empty for global services).
conditionsarray<object>—Conditions describe the current state of the resource.
conditions[].lastTransitionTimestringyeslastTransitionTime is the last time the condition transitioned from one status to another.
conditions[].messagestringyesmessage is a human readable message indicating details about the transition.
conditions[].observedGenerationinteger—observedGeneration represents the .metadata.generation that the condition was set based upon.
conditions[].reasonstringyesreason contains a programmatic identifier indicating the reason for the condition's last transition.
conditions[].statusenumyesstatus of the condition, one of True, False, Unknown. Allowed: True, False, Unknown
conditions[].typestringyestype of condition in CamelCase or in foo.example.com/CamelCase.
deliveryDestinationTypestring—Displays whether the delivery destination associated with this delivery is CloudWatch Logs, Amazon S3, or Kinesis Data Firehose.
deliveryIdstring—The unique ID that identifies this delivery in your account.
identifierstring—Identifier is the Cloud Control primary identifier of the resource.
lastSyncTimestring—
observedGenerationinteger—
operationstring—Operation is the in-flight operation (CREATE, UPDATE, DELETE).
operationStatusstring—OperationStatus is the last reported operation status.
requestTokenstring—RequestToken tracks an in-flight asynchronous operation.

LogsDeliveryDestination # CLOUD CONTROL · AWS::Logs::DeliveryDestination

LogsDeliveryDestination manages AWS::Logs::DeliveryDestination through the AWS Cloud Control API.

kubectl get logsdeliverydestinations · example on GitHub

Example

# LogsDeliveryDestination — CloudWatch Logs
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/cloudwatchlogs.html#logsdeliverydestination
apiVersion: aws.konfig.io/v1alpha1
kind: LogsDeliveryDestination
metadata:
  name: example-logsdeliverydestination
  namespace: default
spec:
  deliveryDestinationPolicy:
    deliveryDestinationName: example-logsdeliverydestination
  deliveryDestinationType: example
  destinationResourceArn: arn:aws:iam::123456789012:role/example-role
  name: example-logsdeliverydestination
  outputFormat: example
  providerRef:
    name: example-logsdeliverydestination
    region: us-east-1
  tags:
  - key: example
    value: example

Spec

FieldTypeRequiredDescription
deliveryDestinationPolicyobject—IAM policy that grants permissions to CloudWatch Logs to deliver logs cross-account to a specified destination in this account.
deliveryDestinationPolicy.deliveryDestinationNamestring—The name of the delivery destination to assign this policy to
deliveryDestinationPolicy.deliveryDestinationPolicyobject—The contents of the policy attached to the delivery destination
deliveryDestinationTypestring—Displays whether this delivery destination is CloudWatch Logs, Amazon S3, Kinesis Data Firehose, or XRay.
destinationResourceArnstring—The ARN of the Amazon Web Services destination that this delivery destination represents.
namestringyesThe name of this delivery destination.
outputFormatstring—The format of the logs that are sent to this delivery destination.
providerRefobject—ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
providerRef.namestringyesName of a cluster-scoped AWSProvider.
providerRef.regionstring—Region overrides the provider's region for this resource only.
tagsarray<object>—The tags that have been assigned to this delivery destination.
tags[].keystringyes
tags[].valuestringyes

Status

FieldTypeRequiredDescription
arnstring—The Amazon Resource Name (ARN) that uniquely identifies this delivery destination.
attemptinteger—Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
awsProviderobject—AWSProvider confirms the account and region this resource was reconciled against.
awsProvider.accountIdstring—AccountID the resource lives in.
awsProvider.namestring—Name of the AWSProvider used; empty when the operator's own credentials were used.
awsProvider.regionstring—Region the resource lives in (empty for global services).
conditionsarray<object>—Conditions describe the current state of the resource.
conditions[].lastTransitionTimestringyeslastTransitionTime is the last time the condition transitioned from one status to another.
conditions[].messagestringyesmessage is a human readable message indicating details about the transition.
conditions[].observedGenerationinteger—observedGeneration represents the .metadata.generation that the condition was set based upon.
conditions[].reasonstringyesreason contains a programmatic identifier indicating the reason for the condition's last transition.
conditions[].statusenumyesstatus of the condition, one of True, False, Unknown. Allowed: True, False, Unknown
conditions[].typestringyestype of condition in CamelCase or in foo.example.com/CamelCase.
identifierstring—Identifier is the Cloud Control primary identifier of the resource.
lastSyncTimestring—
observedGenerationinteger—
operationstring—Operation is the in-flight operation (CREATE, UPDATE, DELETE).
operationStatusstring—OperationStatus is the last reported operation status.
requestTokenstring—RequestToken tracks an in-flight asynchronous operation.

LogsDeliverySource # CLOUD CONTROL · AWS::Logs::DeliverySource

LogsDeliverySource manages AWS::Logs::DeliverySource through the AWS Cloud Control API.

kubectl get logsdeliverysources · example on GitHub

Example

# LogsDeliverySource — CloudWatch Logs
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/cloudwatchlogs.html#logsdeliverysource
apiVersion: aws.konfig.io/v1alpha1
kind: LogsDeliverySource
metadata:
  name: example-logsdeliverysource
  namespace: default
spec:
  deliverySourceConfiguration:
    key: value
  logType: example
  name: example-logsdeliverysource
  providerRef:
    name: example-logsdeliverysource
    region: us-east-1
  resourceArn: arn:aws:iam::123456789012:role/example-role
  tags:
  - key: example
    value: example

Spec

FieldTypeRequiredDescription
deliverySourceConfigurationmap<string>—A map of key-value pairs to configure the delivery source.
logTypestring—The type of logs being delivered.
namestringyesThe unique name of the Log source.
providerRefobject—ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
providerRef.namestringyesName of a cluster-scoped AWSProvider.
providerRef.regionstring—Region overrides the provider's region for this resource only.
resourceArnstring—The ARN of the resource that will be sending the logs.
tagsarray<object>—The tags that have been assigned to this delivery source.
tags[].keystringyes
tags[].valuestringyes

Status

FieldTypeRequiredDescription
arnstring—The Amazon Resource Name (ARN) that uniquely identifies this delivery source.
attemptinteger—Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
awsProviderobject—AWSProvider confirms the account and region this resource was reconciled against.
awsProvider.accountIdstring—AccountID the resource lives in.
awsProvider.namestring—Name of the AWSProvider used; empty when the operator's own credentials were used.
awsProvider.regionstring—Region the resource lives in (empty for global services).
conditionsarray<object>—Conditions describe the current state of the resource.
conditions[].lastTransitionTimestringyeslastTransitionTime is the last time the condition transitioned from one status to another.
conditions[].messagestringyesmessage is a human readable message indicating details about the transition.
conditions[].observedGenerationinteger—observedGeneration represents the .metadata.generation that the condition was set based upon.
conditions[].reasonstringyesreason contains a programmatic identifier indicating the reason for the condition's last transition.
conditions[].statusenumyesstatus of the condition, one of True, False, Unknown. Allowed: True, False, Unknown
conditions[].typestringyestype of condition in CamelCase or in foo.example.com/CamelCase.
identifierstring—Identifier is the Cloud Control primary identifier of the resource.
lastSyncTimestring—
observedGenerationinteger—
operationstring—Operation is the in-flight operation (CREATE, UPDATE, DELETE).
operationStatusstring—OperationStatus is the last reported operation status.
requestTokenstring—RequestToken tracks an in-flight asynchronous operation.
resourceArnsarray<string>—This array contains the ARN of the AWS resource that sends logs and is represented by this delivery source.
servicestring—The AWS service that is sending logs.
statusenum—The status of this delivery source. Allowed: ACTIVE, INACTIVE
statusReasonenum—The reason for the status of this delivery source, such as RESOURCE_DELETED. Allowed: RESOURCE_DELETED

LogsDestination # CLOUD CONTROL · AWS::Logs::Destination

LogsDestination manages AWS::Logs::Destination through the AWS Cloud Control API.

kubectl get logsdestinations · example on GitHub

Example

# LogsDestination — CloudWatch Logs
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/cloudwatchlogs.html#logsdestination
apiVersion: aws.konfig.io/v1alpha1
kind: LogsDestination
metadata:
  name: example-logsdestination
  namespace: default
spec:
  destinationName: example-logsdestination
  destinationPolicy: example
  providerRef:
    name: example-logsdestination
    region: us-east-1
  roleArn: arn:aws:iam::123456789012:role/example-role
  tags:
  - key: example
    value: example
  targetArn: arn:aws:iam::123456789012:role/example-role

Spec

FieldTypeRequiredDescription
destinationNamestringyesThe name of the destination resource Create-only in AWS: changing it requires replacing the resource.
destinationPolicystring—An IAM policy document that governs which AWS accounts can create subscription filters against this destination.
providerRefobject—ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
providerRef.namestringyesName of a cluster-scoped AWSProvider.
providerRef.regionstring—Region overrides the provider's region for this resource only.
roleArnstringyesThe ARN of an IAM role that permits CloudWatch Logs to send data to the specified AWS resource
tagsarray<object>—An array of key-value pairs to apply to this resource.
tags[].keystringyes
tags[].valuestringyes
targetArnstringyesThe ARN of the physical target where the log events are delivered (for example, a Kinesis stream)

Status

FieldTypeRequiredDescription
arnstring—Read-only: reported by AWS after creation.
attemptinteger—Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
awsProviderobject—AWSProvider confirms the account and region this resource was reconciled against.
awsProvider.accountIdstring—AccountID the resource lives in.
awsProvider.namestring—Name of the AWSProvider used; empty when the operator's own credentials were used.
awsProvider.regionstring—Region the resource lives in (empty for global services).
conditionsarray<object>—Conditions describe the current state of the resource.
conditions[].lastTransitionTimestringyeslastTransitionTime is the last time the condition transitioned from one status to another.
conditions[].messagestringyesmessage is a human readable message indicating details about the transition.
conditions[].observedGenerationinteger—observedGeneration represents the .metadata.generation that the condition was set based upon.
conditions[].reasonstringyesreason contains a programmatic identifier indicating the reason for the condition's last transition.
conditions[].statusenumyesstatus of the condition, one of True, False, Unknown. Allowed: True, False, Unknown
conditions[].typestringyestype of condition in CamelCase or in foo.example.com/CamelCase.
identifierstring—Identifier is the Cloud Control primary identifier of the resource.
lastSyncTimestring—
observedGenerationinteger—
operationstring—Operation is the in-flight operation (CREATE, UPDATE, DELETE).
operationStatusstring—OperationStatus is the last reported operation status.
requestTokenstring—RequestToken tracks an in-flight asynchronous operation.

LogsIntegration # CLOUD CONTROL · AWS::Logs::Integration

LogsIntegration manages AWS::Logs::Integration through the AWS Cloud Control API.

kubectl get logsintegrations · example on GitHub

Example

# LogsIntegration — CloudWatch Logs
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/cloudwatchlogs.html#logsintegration
apiVersion: aws.konfig.io/v1alpha1
kind: LogsIntegration
metadata:
  name: example-logsintegration
  namespace: default
spec:
  integrationName: example-logsintegration
  integrationType: OPENSEARCH
  providerRef:
    name: example-logsintegration
    region: us-east-1
  resourceConfig:
    openSearchResourceConfig:
      applicationARN: arn:aws:iam::123456789012:role/example-role
      dashboardViewerPrincipals:
      - example
      dataSourceRoleArn: arn:aws:iam::123456789012:role/example-role
      kmsKeyArn: arn:aws:iam::123456789012:role/example-role
      retentionDays: 1

Spec

FieldTypeRequiredDescription
integrationNamestringyesUser provided identifier for integration, unique to the user account.
integrationTypeenumyesThe type of the Integration. Allowed: OPENSEARCH
providerRefobject—ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
providerRef.namestringyesName of a cluster-scoped AWSProvider.
providerRef.regionstring—Region overrides the provider's region for this resource only.
resourceConfigobjectyesOpenSearchResourceConfig for the given Integration Create-only in AWS: changing it requires replacing the resource.
resourceConfig.openSearchResourceConfigobject—LogsIntegrationOpenSearchResourceConfig is a nested property type of AWS::Logs::Integration.
resourceConfig.openSearchResourceConfig.applicationARNstring—
resourceConfig.openSearchResourceConfig.dashboardViewerPrincipalsarray<string>yes
resourceConfig.openSearchResourceConfig.dataSourceRoleArnstringyes
resourceConfig.openSearchResourceConfig.kmsKeyArnstring—
resourceConfig.openSearchResourceConfig.retentionDaysinteger—

Status

FieldTypeRequiredDescription
attemptinteger—Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
awsProviderobject—AWSProvider confirms the account and region this resource was reconciled against.
awsProvider.accountIdstring—AccountID the resource lives in.
awsProvider.namestring—Name of the AWSProvider used; empty when the operator's own credentials were used.
awsProvider.regionstring—Region the resource lives in (empty for global services).
conditionsarray<object>—Conditions describe the current state of the resource.
conditions[].lastTransitionTimestringyeslastTransitionTime is the last time the condition transitioned from one status to another.
conditions[].messagestringyesmessage is a human readable message indicating details about the transition.
conditions[].observedGenerationinteger—observedGeneration represents the .metadata.generation that the condition was set based upon.
conditions[].reasonstringyesreason contains a programmatic identifier indicating the reason for the condition's last transition.
conditions[].statusenumyesstatus of the condition, one of True, False, Unknown. Allowed: True, False, Unknown
conditions[].typestringyestype of condition in CamelCase or in foo.example.com/CamelCase.
identifierstring—Identifier is the Cloud Control primary identifier of the resource.
integrationStatusenum—Status of creation for the Integration and its resources Read-only: reported by AWS after creation. Allowed: PROVISIONING, ACTIVE, FAILED
lastSyncTimestring—
observedGenerationinteger—
operationstring—Operation is the in-flight operation (CREATE, UPDATE, DELETE).
operationStatusstring—OperationStatus is the last reported operation status.
requestTokenstring—RequestToken tracks an in-flight asynchronous operation.

LogsLogAnomalyDetector # CLOUD CONTROL · AWS::Logs::LogAnomalyDetector

LogsLogAnomalyDetector manages AWS::Logs::LogAnomalyDetector through the AWS Cloud Control API.

kubectl get logsloganomalydetectors · example on GitHub

Example

# LogsLogAnomalyDetector — CloudWatch Logs
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/cloudwatchlogs.html#logsloganomalydetector
apiVersion: aws.konfig.io/v1alpha1
kind: LogsLogAnomalyDetector
metadata:
  name: example-logsloganomalydetector
  namespace: default
spec:
  accountId: '123456789012'
  anomalyVisibilityTime: 1
  detectorName: example-logsloganomalydetector
  evaluationFrequency: FIVE_MIN
  filterPattern: example
  kmsKeyId: arn:aws:kms:us-east-1:123456789012:key/1234abcd-12ab-34cd-56ef-1234567890ab
  logGroupArnList:
  - example
  providerRef:
    name: example-logsloganomalydetector
    region: us-east-1

Spec

FieldTypeRequiredDescription
accountIdstring—Account ID for owner of detector
anomalyVisibilityTimenumber—
detectorNamestring—Name of detector
evaluationFrequencyenum—How often log group is evaluated Allowed: FIVE_MIN, TEN_MIN, FIFTEEN_MIN, THIRTY_MIN, ONE_HOUR
filterPatternstring—
kmsKeyIdstring—The Amazon Resource Name (ARN) of the CMK to use when encrypting log data.
logGroupArnListarray<string>—List of Arns for the given log group
providerRefobject—ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
providerRef.namestringyesName of a cluster-scoped AWSProvider.
providerRef.regionstring—Region overrides the provider's region for this resource only.

Status

FieldTypeRequiredDescription
anomalyDetectorArnstring—ARN of LogAnomalyDetector Read-only: reported by AWS after creation.
anomalyDetectorStatusstring—Current status of detector.
attemptinteger—Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
awsProviderobject—AWSProvider confirms the account and region this resource was reconciled against.
awsProvider.accountIdstring—AccountID the resource lives in.
awsProvider.namestring—Name of the AWSProvider used; empty when the operator's own credentials were used.
awsProvider.regionstring—Region the resource lives in (empty for global services).
conditionsarray<object>—Conditions describe the current state of the resource.
conditions[].lastTransitionTimestringyeslastTransitionTime is the last time the condition transitioned from one status to another.
conditions[].messagestringyesmessage is a human readable message indicating details about the transition.
conditions[].observedGenerationinteger—observedGeneration represents the .metadata.generation that the condition was set based upon.
conditions[].reasonstringyesreason contains a programmatic identifier indicating the reason for the condition's last transition.
conditions[].statusenumyesstatus of the condition, one of True, False, Unknown. Allowed: True, False, Unknown
conditions[].typestringyestype of condition in CamelCase or in foo.example.com/CamelCase.
creationTimeStampnumber—When detector was created.
identifierstring—Identifier is the Cloud Control primary identifier of the resource.
lastModifiedTimeStampnumber—When detector was lsat modified.
lastSyncTimestring—
observedGenerationinteger—
operationstring—Operation is the in-flight operation (CREATE, UPDATE, DELETE).
operationStatusstring—OperationStatus is the last reported operation status.
requestTokenstring—RequestToken tracks an in-flight asynchronous operation.

LogsLogStream # CLOUD CONTROL · AWS::Logs::LogStream

LogsLogStream manages AWS::Logs::LogStream through the AWS Cloud Control API.

kubectl get logslogstreams · example on GitHub

Example

# LogsLogStream — CloudWatch Logs
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/cloudwatchlogs.html#logslogstream
apiVersion: aws.konfig.io/v1alpha1
kind: LogsLogStream
metadata:
  name: example-logslogstream
  namespace: default
spec:
  logGroupName: example-logslogstream
  logStreamName: example-logslogstream
  providerRef:
    name: example-logslogstream
    region: us-east-1

Spec

FieldTypeRequiredDescription
logGroupNamestringyesThe name of the log group where the log stream is created.
logStreamNamestring—The name of the log stream.
providerRefobject—ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
providerRef.namestringyesName of a cluster-scoped AWSProvider.
providerRef.regionstring—Region overrides the provider's region for this resource only.

Status

FieldTypeRequiredDescription
attemptinteger—Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
awsProviderobject—AWSProvider confirms the account and region this resource was reconciled against.
awsProvider.accountIdstring—AccountID the resource lives in.
awsProvider.namestring—Name of the AWSProvider used; empty when the operator's own credentials were used.
awsProvider.regionstring—Region the resource lives in (empty for global services).
conditionsarray<object>—Conditions describe the current state of the resource.
conditions[].lastTransitionTimestringyeslastTransitionTime is the last time the condition transitioned from one status to another.
conditions[].messagestringyesmessage is a human readable message indicating details about the transition.
conditions[].observedGenerationinteger—observedGeneration represents the .metadata.generation that the condition was set based upon.
conditions[].reasonstringyesreason contains a programmatic identifier indicating the reason for the condition's last transition.
conditions[].statusenumyesstatus of the condition, one of True, False, Unknown. Allowed: True, False, Unknown
conditions[].typestringyestype of condition in CamelCase or in foo.example.com/CamelCase.
identifierstring—Identifier is the Cloud Control primary identifier of the resource.
lastSyncTimestring—
observedGenerationinteger—
operationstring—Operation is the in-flight operation (CREATE, UPDATE, DELETE).
operationStatusstring—OperationStatus is the last reported operation status.
requestTokenstring—RequestToken tracks an in-flight asynchronous operation.

LogsQueryDefinition # CLOUD CONTROL · AWS::Logs::QueryDefinition

LogsQueryDefinition manages AWS::Logs::QueryDefinition through the AWS Cloud Control API.

kubectl get logsquerydefinitions · example on GitHub

Example

# LogsQueryDefinition — CloudWatch Logs
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/cloudwatchlogs.html#logsquerydefinition
apiVersion: aws.konfig.io/v1alpha1
kind: LogsQueryDefinition
metadata:
  name: example-logsquerydefinition
  namespace: default
spec:
  logGroupNames:
  - example
  name: example-logsquerydefinition
  parameters:
  - defaultValue: example
    description: Managed by konfig-konector
    name: example-logsquerydefinition
  providerRef:
    name: example-logsquerydefinition
    region: us-east-1
  queryLanguage: CWLI
  queryString: example

Spec

FieldTypeRequiredDescription
logGroupNamesarray<string>—Optionally define specific log groups as part of your query definition
namestringyesA name for the saved query definition
parametersarray<object>—Use this parameter to include specific query parameters as part of your query definition.
parameters[].defaultValuestring—The default value to use for this query parameter if no value is supplied at execution time.
parameters[].descriptionstring—A description of the query parameter that explains its purpose or expected values.
parameters[].namestringyesThe name of the query parameter.
providerRefobject—ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
providerRef.namestringyesName of a cluster-scoped AWSProvider.
providerRef.regionstring—Region overrides the provider's region for this resource only.
queryLanguageenum—Query language of the query string. Allowed: CWLI, SQL, PPL
queryStringstringyesThe query string to use for this definition

Status

FieldTypeRequiredDescription
attemptinteger—Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
awsProviderobject—AWSProvider confirms the account and region this resource was reconciled against.
awsProvider.accountIdstring—AccountID the resource lives in.
awsProvider.namestring—Name of the AWSProvider used; empty when the operator's own credentials were used.
awsProvider.regionstring—Region the resource lives in (empty for global services).
conditionsarray<object>—Conditions describe the current state of the resource.
conditions[].lastTransitionTimestringyeslastTransitionTime is the last time the condition transitioned from one status to another.
conditions[].messagestringyesmessage is a human readable message indicating details about the transition.
conditions[].observedGenerationinteger—observedGeneration represents the .metadata.generation that the condition was set based upon.
conditions[].reasonstringyesreason contains a programmatic identifier indicating the reason for the condition's last transition.
conditions[].statusenumyesstatus of the condition, one of True, False, Unknown. Allowed: True, False, Unknown
conditions[].typestringyestype of condition in CamelCase or in foo.example.com/CamelCase.
identifierstring—Identifier is the Cloud Control primary identifier of the resource.
lastSyncTimestring—
observedGenerationinteger—
operationstring—Operation is the in-flight operation (CREATE, UPDATE, DELETE).
operationStatusstring—OperationStatus is the last reported operation status.
queryDefinitionIdstring—Unique identifier of a query definition Read-only: reported by AWS after creation.
requestTokenstring—RequestToken tracks an in-flight asynchronous operation.

LogsResourcePolicy # CLOUD CONTROL · AWS::Logs::ResourcePolicy

LogsResourcePolicy manages AWS::Logs::ResourcePolicy through the AWS Cloud Control API.

kubectl get logsresourcepolicies · example on GitHub

Example

# LogsResourcePolicy — CloudWatch Logs
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/cloudwatchlogs.html#logsresourcepolicy
apiVersion: aws.konfig.io/v1alpha1
kind: LogsResourcePolicy
metadata:
  name: example-logsresourcepolicy
  namespace: default
spec:
  policyName: example-logsresourcepolicy
  providerRef:
    name: example-logsresourcepolicy
    region: us-east-1

Spec

FieldTypeRequiredDescription
policyDocumentobjectyesThe policy document
policyNamestringyesA name for resource policy Create-only in AWS: changing it requires replacing the resource.
providerRefobject—ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
providerRef.namestringyesName of a cluster-scoped AWSProvider.
providerRef.regionstring—Region overrides the provider's region for this resource only.

Status

FieldTypeRequiredDescription
attemptinteger—Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
awsProviderobject—AWSProvider confirms the account and region this resource was reconciled against.
awsProvider.accountIdstring—AccountID the resource lives in.
awsProvider.namestring—Name of the AWSProvider used; empty when the operator's own credentials were used.
awsProvider.regionstring—Region the resource lives in (empty for global services).
conditionsarray<object>—Conditions describe the current state of the resource.
conditions[].lastTransitionTimestringyeslastTransitionTime is the last time the condition transitioned from one status to another.
conditions[].messagestringyesmessage is a human readable message indicating details about the transition.
conditions[].observedGenerationinteger—observedGeneration represents the .metadata.generation that the condition was set based upon.
conditions[].reasonstringyesreason contains a programmatic identifier indicating the reason for the condition's last transition.
conditions[].statusenumyesstatus of the condition, one of True, False, Unknown. Allowed: True, False, Unknown
conditions[].typestringyestype of condition in CamelCase or in foo.example.com/CamelCase.
identifierstring—Identifier is the Cloud Control primary identifier of the resource.
lastSyncTimestring—
observedGenerationinteger—
operationstring—Operation is the in-flight operation (CREATE, UPDATE, DELETE).
operationStatusstring—OperationStatus is the last reported operation status.
requestTokenstring—RequestToken tracks an in-flight asynchronous operation.

LogsScheduledQuery # CLOUD CONTROL · AWS::Logs::ScheduledQuery

LogsScheduledQuery manages AWS::Logs::ScheduledQuery through the AWS Cloud Control API.

kubectl get logsscheduledqueries · example on GitHub

Example

# LogsScheduledQuery — CloudWatch Logs
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/cloudwatchlogs.html#logsscheduledquery
apiVersion: aws.konfig.io/v1alpha1
kind: LogsScheduledQuery
metadata:
  name: example-logsscheduledquery
  namespace: default
spec:
  description: Managed by konfig-konector
  destinationConfiguration:
    s3Configuration:
      destinationIdentifier: example
      roleArn: arn:aws:iam::123456789012:role/example-role
  executionRoleArn: arn:aws:iam::123456789012:role/example-role
  logGroupIdentifiers:
  - example
  name: example-logsscheduledquery
  providerRef:
    name: example-logsscheduledquery
    region: us-east-1
  queryLanguage: example
  queryString: example
  scheduleEndTime: 1
  scheduleExpression: example
  scheduleStartTime: 1
  startTimeOffset: 1
  state: ENABLED
  tags:
  - key: example
    value: example
  timezone: example

Spec

FieldTypeRequiredDescription
descriptionstring—
destinationConfigurationobject—LogsScheduledQueryDestinationConfiguration is a nested property type of AWS::Logs::ScheduledQuery.
destinationConfiguration.s3Configurationobject—LogsScheduledQueryS3Configuration is a nested property type of AWS::Logs::ScheduledQuery.
destinationConfiguration.s3Configuration.destinationIdentifierstringyes
destinationConfiguration.s3Configuration.roleArnstringyes
executionRoleArnstringyes
logGroupIdentifiersarray<string>—
namestringyesCreate-only in AWS: changing it requires replacing the resource.
providerRefobject—ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
providerRef.namestringyesName of a cluster-scoped AWSProvider.
providerRef.regionstring—Region overrides the provider's region for this resource only.
queryLanguagestringyes
queryStringstringyes
scheduleEndTimenumber—
scheduleExpressionstringyes
scheduleStartTimenumber—
startTimeOffsetinteger—
stateenum—Allowed: ENABLED, DISABLED
tagsarray<object>—
tags[].keystringyes
tags[].valuestringyes
timezonestring—

Status

FieldTypeRequiredDescription
attemptinteger—Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
awsProviderobject—AWSProvider confirms the account and region this resource was reconciled against.
awsProvider.accountIdstring—AccountID the resource lives in.
awsProvider.namestring—Name of the AWSProvider used; empty when the operator's own credentials were used.
awsProvider.regionstring—Region the resource lives in (empty for global services).
conditionsarray<object>—Conditions describe the current state of the resource.
conditions[].lastTransitionTimestringyeslastTransitionTime is the last time the condition transitioned from one status to another.
conditions[].messagestringyesmessage is a human readable message indicating details about the transition.
conditions[].observedGenerationinteger—observedGeneration represents the .metadata.generation that the condition was set based upon.
conditions[].reasonstringyesreason contains a programmatic identifier indicating the reason for the condition's last transition.
conditions[].statusenumyesstatus of the condition, one of True, False, Unknown. Allowed: True, False, Unknown
conditions[].typestringyestype of condition in CamelCase or in foo.example.com/CamelCase.
creationTimenumber—Read-only: reported by AWS after creation.
identifierstring—Identifier is the Cloud Control primary identifier of the resource.
lastExecutionStatusenum—Read-only: reported by AWS after creation. Allowed: Pending, InvalidQuery, Complete, Failed, Timeout
lastSyncTimestring—
lastTriggeredTimenumber—Read-only: reported by AWS after creation.
lastUpdatedTimenumber—Read-only: reported by AWS after creation.
observedGenerationinteger—
operationstring—Operation is the in-flight operation (CREATE, UPDATE, DELETE).
operationStatusstring—OperationStatus is the last reported operation status.
requestTokenstring—RequestToken tracks an in-flight asynchronous operation.
scheduledQueryArnstring—Read-only: reported by AWS after creation.

LogsStorageTierPolicy # CLOUD CONTROL · AWS::Logs::StorageTierPolicy

LogsStorageTierPolicy manages AWS::Logs::StorageTierPolicy through the AWS Cloud Control API.

kubectl get logsstoragetierpolicies · example on GitHub

Example

# LogsStorageTierPolicy — CloudWatch Logs
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/cloudwatchlogs.html#logsstoragetierpolicy
apiVersion: aws.konfig.io/v1alpha1
kind: LogsStorageTierPolicy
metadata:
  name: example-logsstoragetierpolicy
  namespace: default
spec:
  providerRef:
    name: example-logsstoragetierpolicy
    region: us-east-1
  storageTier: INTELLIGENT_TIERING

Spec

FieldTypeRequiredDescription
providerRefobject—ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
providerRef.namestringyesName of a cluster-scoped AWSProvider.
providerRef.regionstring—Region overrides the provider's region for this resource only.
storageTierenumyesThe storage tier to apply. Allowed: INTELLIGENT_TIERING

Status

FieldTypeRequiredDescription
accountIdstring—The AWS account ID that owns this storage tier policy.
attemptinteger—Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
awsProviderobject—AWSProvider confirms the account and region this resource was reconciled against.
awsProvider.accountIdstring—AccountID the resource lives in.
awsProvider.namestring—Name of the AWSProvider used; empty when the operator's own credentials were used.
awsProvider.regionstring—Region the resource lives in (empty for global services).
conditionsarray<object>—Conditions describe the current state of the resource.
conditions[].lastTransitionTimestringyeslastTransitionTime is the last time the condition transitioned from one status to another.
conditions[].messagestringyesmessage is a human readable message indicating details about the transition.
conditions[].observedGenerationinteger—observedGeneration represents the .metadata.generation that the condition was set based upon.
conditions[].reasonstringyesreason contains a programmatic identifier indicating the reason for the condition's last transition.
conditions[].statusenumyesstatus of the condition, one of True, False, Unknown. Allowed: True, False, Unknown
conditions[].typestringyestype of condition in CamelCase or in foo.example.com/CamelCase.
identifierstring—Identifier is the Cloud Control primary identifier of the resource.
lastSyncTimestring—
lastUpdatedTimenumber—Timestamp (milliseconds after Jan 1, 1970 00:00:00 UTC) when the storage tier policy was last updated.
observedGenerationinteger—
operationstring—Operation is the in-flight operation (CREATE, UPDATE, DELETE).
operationStatusstring—OperationStatus is the last reported operation status.
requestTokenstring—RequestToken tracks an in-flight asynchronous operation.

LogsTransformer # CLOUD CONTROL · AWS::Logs::Transformer

LogsTransformer manages AWS::Logs::Transformer through the AWS Cloud Control API.

kubectl get logstransformers · example on GitHub

Example

# LogsTransformer — CloudWatch Logs
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/cloudwatchlogs.html#logstransformer
apiVersion: aws.konfig.io/v1alpha1
kind: LogsTransformer
metadata:
  name: example-logstransformer
  namespace: default
spec:
  logGroupIdentifier: example
  providerRef:
    name: example-logstransformer
    region: us-east-1
  transformerConfig:
  - addKeys:
      entries:
      - key: example
        overwriteIfExists: false
        value: example
    copyValue:
      entries:
      - overwriteIfExists: false
        source: example
        target: example
    csv:
      columns:
      - example
      delimiter: ex
      quoteCharacter: e
      source: example
    dateTimeConverter:
      locale: example
      matchPatterns:
      - example
      source: example
      sourceTimezone: example
      target: example
      targetFormat: example
      targetTimezone: example
    deleteKeys:
      withKeys:
      - example
    grok:
      match: example
      source: example
    listToMap:
      flatten: false
      flattenedElement: first
      key: example
      source: example
      target: example
      valueKey: example
    lowerCaseString:
      withKeys:
      - example
    moveKeys:
      entries:
      - overwriteIfExists: false
        source: example
        target: example
    parseCloudfront:
      source: example
    parseJSON:
      destination: example
      source: example
    parseKeyValue:
      destination: example
      fieldDelimiter: example
      keyPrefix: example
      keyValueDelimiter: example
      nonMatchValue: example
      overwriteIfExists: false
      source: example
    parsePostgres:
      source: example
    parseRoute53:
      source: example
    parseToOCSF:
      eventSource: CloudTrail
      mappingVersion: '1.0'
      ocsfVersion: V1.1
      source: example
    parseVPC:
      source: example
    parseWAF:
      source: example
    renameKeys:
      entries:
      - key: example
        overwriteIfExists: false
        renameTo: example
    splitString:
      entries:
      - delimiter: example
        source: example
    substituteString:
      entries:
      - from: example
        source: example
        to: example
    trimString:
      withKeys:
      - example
    typeConverter:
      entries:
      - key: example
        type: boolean
    upperCaseString:
      withKeys:
      - example

Spec

FieldTypeRequiredDescription
logGroupIdentifierstringyesExisting log group that you want to associate with this transformer.
providerRefobject—ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
providerRef.namestringyesName of a cluster-scoped AWSProvider.
providerRef.regionstring—Region overrides the provider's region for this resource only.
transformerConfigarray<object>yesList of processors in a transformer
transformerConfig[].addKeysobject—LogsTransformerProcessorAddKeys is a nested property type of AWS::Logs::Transformer.
transformerConfig[].addKeys.entriesarray<object>yes
transformerConfig[].addKeys.entries[].keystringyes
transformerConfig[].addKeys.entries[].overwriteIfExistsboolean—
transformerConfig[].addKeys.entries[].valuestringyes
transformerConfig[].copyValueobject—LogsTransformerProcessorCopyValue is a nested property type of AWS::Logs::Transformer.
transformerConfig[].copyValue.entriesarray<object>yes
transformerConfig[].copyValue.entries[].overwriteIfExistsboolean—
transformerConfig[].copyValue.entries[].sourcestringyes
transformerConfig[].copyValue.entries[].targetstringyes
transformerConfig[].csvobject—LogsTransformerProcessorCsv is a nested property type of AWS::Logs::Transformer.
transformerConfig[].csv.columnsarray<string>—
transformerConfig[].csv.delimiterstring—
transformerConfig[].csv.quoteCharacterstring—
transformerConfig[].csv.sourcestring—
transformerConfig[].dateTimeConverterobject—LogsTransformerProcessorDateTimeConverter is a nested property type of AWS::Logs::Transformer.
transformerConfig[].dateTimeConverter.localestring—
transformerConfig[].dateTimeConverter.matchPatternsarray<string>yes
transformerConfig[].dateTimeConverter.sourcestringyes
transformerConfig[].dateTimeConverter.sourceTimezonestring—
transformerConfig[].dateTimeConverter.targetstringyes
transformerConfig[].dateTimeConverter.targetFormatstring—
transformerConfig[].dateTimeConverter.targetTimezonestring—
transformerConfig[].deleteKeysobject—LogsTransformerProcessorDeleteKeys is a nested property type of AWS::Logs::Transformer.
transformerConfig[].deleteKeys.withKeysarray<string>yes
transformerConfig[].grokobject—LogsTransformerProcessorGrok is a nested property type of AWS::Logs::Transformer.
transformerConfig[].grok.matchstringyes
transformerConfig[].grok.sourcestring—
transformerConfig[].listToMapobject—LogsTransformerProcessorListToMap is a nested property type of AWS::Logs::Transformer.
transformerConfig[].listToMap.flattenboolean—
transformerConfig[].listToMap.flattenedElementenum—Allowed: first, last
transformerConfig[].listToMap.keystringyes
transformerConfig[].listToMap.sourcestringyes
transformerConfig[].listToMap.targetstring—
transformerConfig[].listToMap.valueKeystring—
transformerConfig[].lowerCaseStringobject—LogsTransformerProcessorLowerCaseString is a nested property type of AWS::Logs::Transformer.
transformerConfig[].lowerCaseString.withKeysarray<string>yes
transformerConfig[].moveKeysobject—LogsTransformerProcessorMoveKeys is a nested property type of AWS::Logs::Transformer.
transformerConfig[].moveKeys.entriesarray<object>yes
transformerConfig[].moveKeys.entries[].overwriteIfExistsboolean—
transformerConfig[].moveKeys.entries[].sourcestringyes
transformerConfig[].moveKeys.entries[].targetstringyes
transformerConfig[].parseCloudfrontobject—LogsTransformerParseCloudfront is a nested property type of AWS::Logs::Transformer.
transformerConfig[].parseCloudfront.sourcestring—
transformerConfig[].parseJSONobject—LogsTransformerProcessorParseJSON is a nested property type of AWS::Logs::Transformer.
transformerConfig[].parseJSON.destinationstring—
transformerConfig[].parseJSON.sourcestring—
transformerConfig[].parseKeyValueobject—LogsTransformerProcessorParseKeyValue is a nested property type of AWS::Logs::Transformer.
transformerConfig[].parseKeyValue.destinationstring—
transformerConfig[].parseKeyValue.fieldDelimiterstring—
transformerConfig[].parseKeyValue.keyPrefixstring—
transformerConfig[].parseKeyValue.keyValueDelimiterstring—
transformerConfig[].parseKeyValue.nonMatchValuestring—
transformerConfig[].parseKeyValue.overwriteIfExistsboolean—
transformerConfig[].parseKeyValue.sourcestring—
transformerConfig[].parsePostgresobject—LogsTransformerParsePostgres is a nested property type of AWS::Logs::Transformer.
transformerConfig[].parsePostgres.sourcestring—
transformerConfig[].parseRoute53object—LogsTransformerParseRoute53 is a nested property type of AWS::Logs::Transformer.
transformerConfig[].parseRoute53.sourcestring—
transformerConfig[].parseToOCSFobject—LogsTransformerParseToOCSF is a nested property type of AWS::Logs::Transformer.
transformerConfig[].parseToOCSF.eventSourceenumyesAllowed: CloudTrail, Route53Resolver, VPCFlow, EKSAudit, AWSWAF
transformerConfig[].parseToOCSF.mappingVersionstring—
transformerConfig[].parseToOCSF.ocsfVersionenumyesAllowed: V1.1, V1.5
transformerConfig[].parseToOCSF.sourcestring—
transformerConfig[].parseVPCobject—LogsTransformerParseVPC is a nested property type of AWS::Logs::Transformer.
transformerConfig[].parseVPC.sourcestring—
transformerConfig[].parseWAFobject—LogsTransformerParseWAF is a nested property type of AWS::Logs::Transformer.
transformerConfig[].parseWAF.sourcestring—
transformerConfig[].renameKeysobject—LogsTransformerProcessorRenameKeys is a nested property type of AWS::Logs::Transformer.
transformerConfig[].renameKeys.entriesarray<object>yes
transformerConfig[].renameKeys.entries[].keystringyes
transformerConfig[].renameKeys.entries[].overwriteIfExistsboolean—
transformerConfig[].renameKeys.entries[].renameTostringyes
transformerConfig[].splitStringobject—LogsTransformerProcessorSplitString is a nested property type of AWS::Logs::Transformer.
transformerConfig[].splitString.entriesarray<object>yes
transformerConfig[].splitString.entries[].delimiterstringyes
transformerConfig[].splitString.entries[].sourcestringyes
transformerConfig[].substituteStringobject—LogsTransformerProcessorSubstituteString is a nested property type of AWS::Logs::Transformer.
transformerConfig[].substituteString.entriesarray<object>yes
transformerConfig[].substituteString.entries[].fromstringyes
transformerConfig[].substituteString.entries[].sourcestringyes
transformerConfig[].substituteString.entries[].tostringyes
transformerConfig[].trimStringobject—LogsTransformerProcessorTrimString is a nested property type of AWS::Logs::Transformer.
transformerConfig[].trimString.withKeysarray<string>yes
transformerConfig[].typeConverterobject—LogsTransformerProcessorTypeConverter is a nested property type of AWS::Logs::Transformer.
transformerConfig[].typeConverter.entriesarray<object>yes
transformerConfig[].typeConverter.entries[].keystringyes
transformerConfig[].typeConverter.entries[].typeenumyesAllowed: boolean, integer, double, string
transformerConfig[].upperCaseStringobject—LogsTransformerProcessorUpperCaseString is a nested property type of AWS::Logs::Transformer.
transformerConfig[].upperCaseString.withKeysarray<string>yes

Status

FieldTypeRequiredDescription
attemptinteger—Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
awsProviderobject—AWSProvider confirms the account and region this resource was reconciled against.
awsProvider.accountIdstring—AccountID the resource lives in.
awsProvider.namestring—Name of the AWSProvider used; empty when the operator's own credentials were used.
awsProvider.regionstring—Region the resource lives in (empty for global services).
conditionsarray<object>—Conditions describe the current state of the resource.
conditions[].lastTransitionTimestringyeslastTransitionTime is the last time the condition transitioned from one status to another.
conditions[].messagestringyesmessage is a human readable message indicating details about the transition.
conditions[].observedGenerationinteger—observedGeneration represents the .metadata.generation that the condition was set based upon.
conditions[].reasonstringyesreason contains a programmatic identifier indicating the reason for the condition's last transition.
conditions[].statusenumyesstatus of the condition, one of True, False, Unknown. Allowed: True, False, Unknown
conditions[].typestringyestype of condition in CamelCase or in foo.example.com/CamelCase.
identifierstring—Identifier is the Cloud Control primary identifier of the resource.
lastSyncTimestring—
observedGenerationinteger—
operationstring—Operation is the in-flight operation (CREATE, UPDATE, DELETE).
operationStatusstring—OperationStatus is the last reported operation status.
requestTokenstring—RequestToken tracks an in-flight asynchronous operation.

MetricFilter # GA

MetricFilter is the Schema for managing CloudWatch Logs Metric Filters.

kubectl get metricfilters · example on GitHub

Example

# MetricFilter — CloudWatch Logs
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/cloudwatchlogs.html#metricfilter
apiVersion: aws.konfig.io/v1alpha1
kind: MetricFilter
metadata:
  name: example-metricfilter
  namespace: default
spec:
  filterName: example-metricfilter
  filterPattern: example
  logGroupRef:
    logGroupName: example-metricfilter
    name: example-metricfilter
  metricTransformations:
  - defaultValue: 1
    metricName: example-metricfilter
    metricNamespace: example
    metricValue: example
  providerRef:
    name: example-metricfilter
    region: us-east-1

Spec

FieldTypeRequiredDescription
filterNamestringyesFilterName is the name of the metric filter.
filterPatternstringyesFilterPattern is the CloudWatch Logs filter pattern.
logGroupRefobjectyesLogGroupRef references the log group.
logGroupRef.logGroupNamestring—LogGroupName is a direct AWS log group name.
logGroupRef.namestring—Name of a LogGroup CR in the same namespace.
metricTransformationsarray<object>yesMetricTransformations are the transformations to apply.
metricTransformations[].defaultValuenumber—DefaultValue is the value to emit when no data matches.
metricTransformations[].metricNamestringyesMetricName is the name of the CloudWatch metric.
metricTransformations[].metricNamespacestringyesMetricNamespace is the namespace for the metric.
metricTransformations[].metricValuestringyesMetricValue is the value to publish when the filter pattern matches.
providerRefobject—ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
providerRef.namestringyesName of a cluster-scoped AWSProvider.
providerRef.regionstring—Region overrides the provider's region for this resource only.

Status

FieldTypeRequiredDescription
awsProviderobject—AWSProvider confirms the account and region this resource was reconciled against.
awsProvider.accountIdstring—AccountID the resource lives in.
awsProvider.namestring—Name of the AWSProvider used; empty when the operator's own credentials were used.
awsProvider.regionstring—Region the resource lives in (empty for global services).
conditionsarray<object>—Conditions describe the current state of the resource.
conditions[].lastTransitionTimestringyeslastTransitionTime is the last time the condition transitioned from one status to another.
conditions[].messagestringyesmessage is a human readable message indicating details about the transition.
conditions[].observedGenerationinteger—observedGeneration represents the .metadata.generation that the condition was set based upon.
conditions[].reasonstringyesreason contains a programmatic identifier indicating the reason for the condition's last transition.
conditions[].statusenumyesstatus of the condition, one of True, False, Unknown. Allowed: True, False, Unknown
conditions[].typestringyestype of condition in CamelCase or in foo.example.com/CamelCase.
lastSyncTimestring—LastSyncTime is when the resource was last successfully reconciled.
observedGenerationinteger—ObservedGeneration is the most recent .metadata.generation reconciled.

SubscriptionFilter # GA

SubscriptionFilter is the Schema for managing CloudWatch Logs Subscription Filters.

kubectl get subscriptionfilters · example on GitHub

Example

# SubscriptionFilter — CloudWatch Logs
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/cloudwatchlogs.html#subscriptionfilter
apiVersion: aws.konfig.io/v1alpha1
kind: SubscriptionFilter
metadata:
  name: example-subscriptionfilter
  namespace: default
spec:
  destinationArn: arn:aws:iam::123456789012:role/example-role
  filterName: example-subscriptionfilter
  filterPattern: example
  logGroupRef:
    logGroupName: example-subscriptionfilter
    name: example-subscriptionfilter
  providerRef:
    name: example-subscriptionfilter
    region: us-east-1
  roleArn: arn:aws:iam::123456789012:role/example-role

Spec

FieldTypeRequiredDescription
destinationArnstringyesDestinationARN is the ARN of the destination (Kinesis, Lambda, or Firehose).
filterNamestringyesFilterName is the name of the subscription filter.
filterPatternstringyesFilterPattern is the CloudWatch Logs filter pattern.
logGroupRefobjectyesLogGroupRef references the log group.
logGroupRef.logGroupNamestring—LogGroupName is a direct AWS log group name.
logGroupRef.namestring—Name of a LogGroup CR in the same namespace.
providerRefobject—ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
providerRef.namestringyesName of a cluster-scoped AWSProvider.
providerRef.regionstring—Region overrides the provider's region for this resource only.
roleArnstring—RoleARN is the IAM role ARN for delivering logs to the destination (Kinesis only).

Status

FieldTypeRequiredDescription
awsProviderobject—AWSProvider confirms the account and region this resource was reconciled against.
awsProvider.accountIdstring—AccountID the resource lives in.
awsProvider.namestring—Name of the AWSProvider used; empty when the operator's own credentials were used.
awsProvider.regionstring—Region the resource lives in (empty for global services).
conditionsarray<object>—Conditions describe the current state of the resource.
conditions[].lastTransitionTimestringyeslastTransitionTime is the last time the condition transitioned from one status to another.
conditions[].messagestringyesmessage is a human readable message indicating details about the transition.
conditions[].observedGenerationinteger—observedGeneration represents the .metadata.generation that the condition was set based upon.
conditions[].reasonstringyesreason contains a programmatic identifier indicating the reason for the condition's last transition.
conditions[].statusenumyesstatus of the condition, one of True, False, Unknown. Allowed: True, False, Unknown
conditions[].typestringyestype of condition in CamelCase or in foo.example.com/CamelCase.
lastSyncTimestring—LastSyncTime is when the resource was last successfully reconciled.
observedGenerationinteger—ObservedGeneration is the most recent .metadata.generation reconciled.