CloudWatch Logs
16 resource kinds. Generated from the operator's CRD schemas.
aws.konfig.io/v1alpha1
LogGroup # GA
LogGroup is the Schema for managing CloudWatch Log Groups.
kubectl get loggroups · example on GitHub
Example
# LogGroup — CloudWatch Logs
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/cloudwatchlogs.html#loggroup
apiVersion: aws.konfig.io/v1alpha1
kind: LogGroup
metadata:
name: example-loggroup
namespace: default
spec:
kmsKeyArn: arn:aws:iam::123456789012:role/example-role
logGroupName: example-loggroup
providerRef:
name: example-loggroup
region: us-east-1
retentionInDays: 7
tags:
environment: dev
team: platform
Spec
| Field | Type | Required | Description |
|---|---|---|---|
kmsKeyArn | string | — | KMSKeyARN is the KMS key ARN for encrypting log data. |
logGroupName | string | yes | LogGroupName is the name of the log group. |
providerRef | object | — | ProviderRef selects the AWSProvider (account/region) this resource is reconciled against. |
providerRef.name | string | yes | Name of a cluster-scoped AWSProvider. |
providerRef.region | string | — | Region overrides the provider's region for this resource only. |
retentionInDays | enum | — | RetentionInDays sets the log retention period. Allowed: 0, 1, 3, 5, 7, 14, 30, 60… |
tags | map<string> | — | Tags are AWS resource tags to apply. |
Status
| Field | Type | Required | Description |
|---|---|---|---|
arn | string | — | ARN is the ARN of the log group. |
awsProvider | object | — | AWSProvider confirms the account and region this resource was reconciled against. |
awsProvider.accountId | string | — | AccountID the resource lives in. |
awsProvider.name | string | — | Name of the AWSProvider used; empty when the operator's own credentials were used. |
awsProvider.region | string | — | Region the resource lives in (empty for global services). |
conditions | array<object> | — | Conditions describe the current state of the resource. |
conditions[].lastTransitionTime | string | yes | lastTransitionTime is the last time the condition transitioned from one status to another. |
conditions[].message | string | yes | message is a human readable message indicating details about the transition. |
conditions[].observedGeneration | integer | — | observedGeneration represents the .metadata.generation that the condition was set based upon. |
conditions[].reason | string | yes | reason contains a programmatic identifier indicating the reason for the condition's last transition. |
conditions[].status | enum | yes | status of the condition, one of True, False, Unknown. Allowed: True, False, Unknown |
conditions[].type | string | yes | type of condition in CamelCase or in foo.example.com/CamelCase. |
lastSyncTime | string | — | LastSyncTime is when the resource was last successfully reconciled. |
observedGeneration | integer | — | ObservedGeneration is the most recent .metadata.generation reconciled. |
LogsAccountPolicy # CLOUD CONTROL · AWS::Logs::AccountPolicy ⚠ DESTRUCTIVE SCOPE
Caution, destructive scope: account-wide CloudWatch Logs policy applied to every log group. Provided for completeness; do not use from application namespaces. Restrict with AWSProvider.allowedNamespaces and RBAC. LogsAccountPolicy manages AWS::Logs::AccountPolicy through the AWS Cloud Control API.
kubectl get logsaccountpolicies · example on GitHub
Example
# LogsAccountPolicy — CloudWatch Logs
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/cloudwatchlogs.html#logsaccountpolicy
apiVersion: aws.konfig.io/v1alpha1
kind: LogsAccountPolicy
metadata:
name: example-logsaccountpolicy
namespace: default
spec:
policyDocument: '{"Version": "2012-10-17", "Statement": [{"Effect": "Allow", "Action": ["s3:GetObject"],
"Resource": "*"}]}'
policyName: example-logsaccountpolicy
policyType: DATA_PROTECTION_POLICY
providerRef:
name: example-logsaccountpolicy
region: us-east-1
scope: ALL
selectionCriteria: example
Spec
| Field | Type | Required | Description |
|---|---|---|---|
policyDocument | string | yes | The body of the policy document you want to use for this topic. |
policyName | string | yes | The name of the account policy Create-only in AWS: changing it requires replacing the resource. |
policyType | enum | yes | Type of the policy. Allowed: DATA_PROTECTION_POLICY, SUBSCRIPTION_FILTER_POLICY, FIELD_INDEX_POLICY, TRANSFORMER_POLICY, METRIC_EXTRACTION_POLICY |
providerRef | object | — | ProviderRef selects the AWSProvider (account/region) this resource is reconciled against. |
providerRef.name | string | yes | Name of a cluster-scoped AWSProvider. |
providerRef.region | string | — | Region overrides the provider's region for this resource only. |
scope | enum | — | Scope for policy application Allowed: ALL |
selectionCriteria | string | — | Log group selection criteria to apply policy only to a subset of log groups. |
Status
| Field | Type | Required | Description |
|---|---|---|---|
accountId | string | — | User account id Read-only: reported by AWS after creation. |
attempt | integer | — | Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure. |
awsProvider | object | — | AWSProvider confirms the account and region this resource was reconciled against. |
awsProvider.accountId | string | — | AccountID the resource lives in. |
awsProvider.name | string | — | Name of the AWSProvider used; empty when the operator's own credentials were used. |
awsProvider.region | string | — | Region the resource lives in (empty for global services). |
conditions | array<object> | — | Conditions describe the current state of the resource. |
conditions[].lastTransitionTime | string | yes | lastTransitionTime is the last time the condition transitioned from one status to another. |
conditions[].message | string | yes | message is a human readable message indicating details about the transition. |
conditions[].observedGeneration | integer | — | observedGeneration represents the .metadata.generation that the condition was set based upon. |
conditions[].reason | string | yes | reason contains a programmatic identifier indicating the reason for the condition's last transition. |
conditions[].status | enum | yes | status of the condition, one of True, False, Unknown. Allowed: True, False, Unknown |
conditions[].type | string | yes | type of condition in CamelCase or in foo.example.com/CamelCase. |
identifier | string | — | Identifier is the Cloud Control primary identifier of the resource. |
lastSyncTime | string | — | |
observedGeneration | integer | — | |
operation | string | — | Operation is the in-flight operation (CREATE, UPDATE, DELETE). |
operationStatus | string | — | OperationStatus is the last reported operation status. |
requestToken | string | — | RequestToken tracks an in-flight asynchronous operation. |
LogsDelivery # CLOUD CONTROL · AWS::Logs::Delivery
LogsDelivery manages AWS::Logs::Delivery through the AWS Cloud Control API.
kubectl get logsdeliveries · example on GitHub
Example
# LogsDelivery — CloudWatch Logs
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/cloudwatchlogs.html#logsdelivery
apiVersion: aws.konfig.io/v1alpha1
kind: LogsDelivery
metadata:
name: example-logsdelivery
namespace: default
spec:
deliveryDestinationArn: arn:aws:iam::123456789012:role/example-role
deliverySourceName: example-logsdelivery
fieldDelimiter: examp
providerRef:
name: example-logsdelivery
region: us-east-1
recordFields:
- example
s3EnableHiveCompatiblePath: true
s3SuffixPath: example
tags:
- key: example
value: example
Spec
| Field | Type | Required | Description |
|---|---|---|---|
deliveryDestinationArn | string | yes | The ARN of the delivery destination that is associated with this delivery. |
deliverySourceName | string | yes | The name of the delivery source that is associated with this delivery. |
fieldDelimiter | string | — | The field delimiter to use between record fields when the final output format of a delivery is in Plain , W3C , or Raw format. |
providerRef | object | — | ProviderRef selects the AWSProvider (account/region) this resource is reconciled against. |
providerRef.name | string | yes | Name of a cluster-scoped AWSProvider. |
providerRef.region | string | — | Region overrides the provider's region for this resource only. |
recordFields | array<string> | — | The list of record fields to be delivered to the destination, in order. |
s3EnableHiveCompatiblePath | boolean | — | This parameter causes the S3 objects that contain delivered logs to use a prefix structure that allows for integration with Apache Hive. |
s3SuffixPath | string | — | This string allows re-configuring the S3 object prefix to contain either static or variable sections. |
tags | array<object> | — | The tags that have been assigned to this delivery. |
tags[].key | string | yes | |
tags[].value | string | yes |
Status
| Field | Type | Required | Description |
|---|---|---|---|
arn | string | — | The Amazon Resource Name (ARN) that uniquely identifies this delivery. |
attempt | integer | — | Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure. |
awsProvider | object | — | AWSProvider confirms the account and region this resource was reconciled against. |
awsProvider.accountId | string | — | AccountID the resource lives in. |
awsProvider.name | string | — | Name of the AWSProvider used; empty when the operator's own credentials were used. |
awsProvider.region | string | — | Region the resource lives in (empty for global services). |
conditions | array<object> | — | Conditions describe the current state of the resource. |
conditions[].lastTransitionTime | string | yes | lastTransitionTime is the last time the condition transitioned from one status to another. |
conditions[].message | string | yes | message is a human readable message indicating details about the transition. |
conditions[].observedGeneration | integer | — | observedGeneration represents the .metadata.generation that the condition was set based upon. |
conditions[].reason | string | yes | reason contains a programmatic identifier indicating the reason for the condition's last transition. |
conditions[].status | enum | yes | status of the condition, one of True, False, Unknown. Allowed: True, False, Unknown |
conditions[].type | string | yes | type of condition in CamelCase or in foo.example.com/CamelCase. |
deliveryDestinationType | string | — | Displays whether the delivery destination associated with this delivery is CloudWatch Logs, Amazon S3, or Kinesis Data Firehose. |
deliveryId | string | — | The unique ID that identifies this delivery in your account. |
identifier | string | — | Identifier is the Cloud Control primary identifier of the resource. |
lastSyncTime | string | — | |
observedGeneration | integer | — | |
operation | string | — | Operation is the in-flight operation (CREATE, UPDATE, DELETE). |
operationStatus | string | — | OperationStatus is the last reported operation status. |
requestToken | string | — | RequestToken tracks an in-flight asynchronous operation. |
LogsDeliveryDestination # CLOUD CONTROL · AWS::Logs::DeliveryDestination
LogsDeliveryDestination manages AWS::Logs::DeliveryDestination through the AWS Cloud Control API.
kubectl get logsdeliverydestinations · example on GitHub
Example
# LogsDeliveryDestination — CloudWatch Logs
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/cloudwatchlogs.html#logsdeliverydestination
apiVersion: aws.konfig.io/v1alpha1
kind: LogsDeliveryDestination
metadata:
name: example-logsdeliverydestination
namespace: default
spec:
deliveryDestinationPolicy:
deliveryDestinationName: example-logsdeliverydestination
deliveryDestinationType: example
destinationResourceArn: arn:aws:iam::123456789012:role/example-role
name: example-logsdeliverydestination
outputFormat: example
providerRef:
name: example-logsdeliverydestination
region: us-east-1
tags:
- key: example
value: example
Spec
| Field | Type | Required | Description |
|---|---|---|---|
deliveryDestinationPolicy | object | — | IAM policy that grants permissions to CloudWatch Logs to deliver logs cross-account to a specified destination in this account. |
deliveryDestinationPolicy.deliveryDestinationName | string | — | The name of the delivery destination to assign this policy to |
deliveryDestinationPolicy.deliveryDestinationPolicy | object | — | The contents of the policy attached to the delivery destination |
deliveryDestinationType | string | — | Displays whether this delivery destination is CloudWatch Logs, Amazon S3, Kinesis Data Firehose, or XRay. |
destinationResourceArn | string | — | The ARN of the Amazon Web Services destination that this delivery destination represents. |
name | string | yes | The name of this delivery destination. |
outputFormat | string | — | The format of the logs that are sent to this delivery destination. |
providerRef | object | — | ProviderRef selects the AWSProvider (account/region) this resource is reconciled against. |
providerRef.name | string | yes | Name of a cluster-scoped AWSProvider. |
providerRef.region | string | — | Region overrides the provider's region for this resource only. |
tags | array<object> | — | The tags that have been assigned to this delivery destination. |
tags[].key | string | yes | |
tags[].value | string | yes |
Status
| Field | Type | Required | Description |
|---|---|---|---|
arn | string | — | The Amazon Resource Name (ARN) that uniquely identifies this delivery destination. |
attempt | integer | — | Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure. |
awsProvider | object | — | AWSProvider confirms the account and region this resource was reconciled against. |
awsProvider.accountId | string | — | AccountID the resource lives in. |
awsProvider.name | string | — | Name of the AWSProvider used; empty when the operator's own credentials were used. |
awsProvider.region | string | — | Region the resource lives in (empty for global services). |
conditions | array<object> | — | Conditions describe the current state of the resource. |
conditions[].lastTransitionTime | string | yes | lastTransitionTime is the last time the condition transitioned from one status to another. |
conditions[].message | string | yes | message is a human readable message indicating details about the transition. |
conditions[].observedGeneration | integer | — | observedGeneration represents the .metadata.generation that the condition was set based upon. |
conditions[].reason | string | yes | reason contains a programmatic identifier indicating the reason for the condition's last transition. |
conditions[].status | enum | yes | status of the condition, one of True, False, Unknown. Allowed: True, False, Unknown |
conditions[].type | string | yes | type of condition in CamelCase or in foo.example.com/CamelCase. |
identifier | string | — | Identifier is the Cloud Control primary identifier of the resource. |
lastSyncTime | string | — | |
observedGeneration | integer | — | |
operation | string | — | Operation is the in-flight operation (CREATE, UPDATE, DELETE). |
operationStatus | string | — | OperationStatus is the last reported operation status. |
requestToken | string | — | RequestToken tracks an in-flight asynchronous operation. |
LogsDeliverySource # CLOUD CONTROL · AWS::Logs::DeliverySource
LogsDeliverySource manages AWS::Logs::DeliverySource through the AWS Cloud Control API.
kubectl get logsdeliverysources · example on GitHub
Example
# LogsDeliverySource — CloudWatch Logs
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/cloudwatchlogs.html#logsdeliverysource
apiVersion: aws.konfig.io/v1alpha1
kind: LogsDeliverySource
metadata:
name: example-logsdeliverysource
namespace: default
spec:
deliverySourceConfiguration:
key: value
logType: example
name: example-logsdeliverysource
providerRef:
name: example-logsdeliverysource
region: us-east-1
resourceArn: arn:aws:iam::123456789012:role/example-role
tags:
- key: example
value: example
Spec
| Field | Type | Required | Description |
|---|---|---|---|
deliverySourceConfiguration | map<string> | — | A map of key-value pairs to configure the delivery source. |
logType | string | — | The type of logs being delivered. |
name | string | yes | The unique name of the Log source. |
providerRef | object | — | ProviderRef selects the AWSProvider (account/region) this resource is reconciled against. |
providerRef.name | string | yes | Name of a cluster-scoped AWSProvider. |
providerRef.region | string | — | Region overrides the provider's region for this resource only. |
resourceArn | string | — | The ARN of the resource that will be sending the logs. |
tags | array<object> | — | The tags that have been assigned to this delivery source. |
tags[].key | string | yes | |
tags[].value | string | yes |
Status
| Field | Type | Required | Description |
|---|---|---|---|
arn | string | — | The Amazon Resource Name (ARN) that uniquely identifies this delivery source. |
attempt | integer | — | Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure. |
awsProvider | object | — | AWSProvider confirms the account and region this resource was reconciled against. |
awsProvider.accountId | string | — | AccountID the resource lives in. |
awsProvider.name | string | — | Name of the AWSProvider used; empty when the operator's own credentials were used. |
awsProvider.region | string | — | Region the resource lives in (empty for global services). |
conditions | array<object> | — | Conditions describe the current state of the resource. |
conditions[].lastTransitionTime | string | yes | lastTransitionTime is the last time the condition transitioned from one status to another. |
conditions[].message | string | yes | message is a human readable message indicating details about the transition. |
conditions[].observedGeneration | integer | — | observedGeneration represents the .metadata.generation that the condition was set based upon. |
conditions[].reason | string | yes | reason contains a programmatic identifier indicating the reason for the condition's last transition. |
conditions[].status | enum | yes | status of the condition, one of True, False, Unknown. Allowed: True, False, Unknown |
conditions[].type | string | yes | type of condition in CamelCase or in foo.example.com/CamelCase. |
identifier | string | — | Identifier is the Cloud Control primary identifier of the resource. |
lastSyncTime | string | — | |
observedGeneration | integer | — | |
operation | string | — | Operation is the in-flight operation (CREATE, UPDATE, DELETE). |
operationStatus | string | — | OperationStatus is the last reported operation status. |
requestToken | string | — | RequestToken tracks an in-flight asynchronous operation. |
resourceArns | array<string> | — | This array contains the ARN of the AWS resource that sends logs and is represented by this delivery source. |
service | string | — | The AWS service that is sending logs. |
status | enum | — | The status of this delivery source. Allowed: ACTIVE, INACTIVE |
statusReason | enum | — | The reason for the status of this delivery source, such as RESOURCE_DELETED. Allowed: RESOURCE_DELETED |
LogsDestination # CLOUD CONTROL · AWS::Logs::Destination
LogsDestination manages AWS::Logs::Destination through the AWS Cloud Control API.
kubectl get logsdestinations · example on GitHub
Example
# LogsDestination — CloudWatch Logs
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/cloudwatchlogs.html#logsdestination
apiVersion: aws.konfig.io/v1alpha1
kind: LogsDestination
metadata:
name: example-logsdestination
namespace: default
spec:
destinationName: example-logsdestination
destinationPolicy: example
providerRef:
name: example-logsdestination
region: us-east-1
roleArn: arn:aws:iam::123456789012:role/example-role
tags:
- key: example
value: example
targetArn: arn:aws:iam::123456789012:role/example-role
Spec
| Field | Type | Required | Description |
|---|---|---|---|
destinationName | string | yes | The name of the destination resource Create-only in AWS: changing it requires replacing the resource. |
destinationPolicy | string | — | An IAM policy document that governs which AWS accounts can create subscription filters against this destination. |
providerRef | object | — | ProviderRef selects the AWSProvider (account/region) this resource is reconciled against. |
providerRef.name | string | yes | Name of a cluster-scoped AWSProvider. |
providerRef.region | string | — | Region overrides the provider's region for this resource only. |
roleArn | string | yes | The ARN of an IAM role that permits CloudWatch Logs to send data to the specified AWS resource |
tags | array<object> | — | An array of key-value pairs to apply to this resource. |
tags[].key | string | yes | |
tags[].value | string | yes | |
targetArn | string | yes | The ARN of the physical target where the log events are delivered (for example, a Kinesis stream) |
Status
| Field | Type | Required | Description |
|---|---|---|---|
arn | string | — | Read-only: reported by AWS after creation. |
attempt | integer | — | Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure. |
awsProvider | object | — | AWSProvider confirms the account and region this resource was reconciled against. |
awsProvider.accountId | string | — | AccountID the resource lives in. |
awsProvider.name | string | — | Name of the AWSProvider used; empty when the operator's own credentials were used. |
awsProvider.region | string | — | Region the resource lives in (empty for global services). |
conditions | array<object> | — | Conditions describe the current state of the resource. |
conditions[].lastTransitionTime | string | yes | lastTransitionTime is the last time the condition transitioned from one status to another. |
conditions[].message | string | yes | message is a human readable message indicating details about the transition. |
conditions[].observedGeneration | integer | — | observedGeneration represents the .metadata.generation that the condition was set based upon. |
conditions[].reason | string | yes | reason contains a programmatic identifier indicating the reason for the condition's last transition. |
conditions[].status | enum | yes | status of the condition, one of True, False, Unknown. Allowed: True, False, Unknown |
conditions[].type | string | yes | type of condition in CamelCase or in foo.example.com/CamelCase. |
identifier | string | — | Identifier is the Cloud Control primary identifier of the resource. |
lastSyncTime | string | — | |
observedGeneration | integer | — | |
operation | string | — | Operation is the in-flight operation (CREATE, UPDATE, DELETE). |
operationStatus | string | — | OperationStatus is the last reported operation status. |
requestToken | string | — | RequestToken tracks an in-flight asynchronous operation. |
LogsIntegration # CLOUD CONTROL · AWS::Logs::Integration
LogsIntegration manages AWS::Logs::Integration through the AWS Cloud Control API.
kubectl get logsintegrations · example on GitHub
Example
# LogsIntegration — CloudWatch Logs
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/cloudwatchlogs.html#logsintegration
apiVersion: aws.konfig.io/v1alpha1
kind: LogsIntegration
metadata:
name: example-logsintegration
namespace: default
spec:
integrationName: example-logsintegration
integrationType: OPENSEARCH
providerRef:
name: example-logsintegration
region: us-east-1
resourceConfig:
openSearchResourceConfig:
applicationARN: arn:aws:iam::123456789012:role/example-role
dashboardViewerPrincipals:
- example
dataSourceRoleArn: arn:aws:iam::123456789012:role/example-role
kmsKeyArn: arn:aws:iam::123456789012:role/example-role
retentionDays: 1
Spec
| Field | Type | Required | Description |
|---|---|---|---|
integrationName | string | yes | User provided identifier for integration, unique to the user account. |
integrationType | enum | yes | The type of the Integration. Allowed: OPENSEARCH |
providerRef | object | — | ProviderRef selects the AWSProvider (account/region) this resource is reconciled against. |
providerRef.name | string | yes | Name of a cluster-scoped AWSProvider. |
providerRef.region | string | — | Region overrides the provider's region for this resource only. |
resourceConfig | object | yes | OpenSearchResourceConfig for the given Integration Create-only in AWS: changing it requires replacing the resource. |
resourceConfig.openSearchResourceConfig | object | — | LogsIntegrationOpenSearchResourceConfig is a nested property type of AWS::Logs::Integration. |
resourceConfig.openSearchResourceConfig.applicationARN | string | — | |
resourceConfig.openSearchResourceConfig.dashboardViewerPrincipals | array<string> | yes | |
resourceConfig.openSearchResourceConfig.dataSourceRoleArn | string | yes | |
resourceConfig.openSearchResourceConfig.kmsKeyArn | string | — | |
resourceConfig.openSearchResourceConfig.retentionDays | integer | — |
Status
| Field | Type | Required | Description |
|---|---|---|---|
attempt | integer | — | Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure. |
awsProvider | object | — | AWSProvider confirms the account and region this resource was reconciled against. |
awsProvider.accountId | string | — | AccountID the resource lives in. |
awsProvider.name | string | — | Name of the AWSProvider used; empty when the operator's own credentials were used. |
awsProvider.region | string | — | Region the resource lives in (empty for global services). |
conditions | array<object> | — | Conditions describe the current state of the resource. |
conditions[].lastTransitionTime | string | yes | lastTransitionTime is the last time the condition transitioned from one status to another. |
conditions[].message | string | yes | message is a human readable message indicating details about the transition. |
conditions[].observedGeneration | integer | — | observedGeneration represents the .metadata.generation that the condition was set based upon. |
conditions[].reason | string | yes | reason contains a programmatic identifier indicating the reason for the condition's last transition. |
conditions[].status | enum | yes | status of the condition, one of True, False, Unknown. Allowed: True, False, Unknown |
conditions[].type | string | yes | type of condition in CamelCase or in foo.example.com/CamelCase. |
identifier | string | — | Identifier is the Cloud Control primary identifier of the resource. |
integrationStatus | enum | — | Status of creation for the Integration and its resources Read-only: reported by AWS after creation. Allowed: PROVISIONING, ACTIVE, FAILED |
lastSyncTime | string | — | |
observedGeneration | integer | — | |
operation | string | — | Operation is the in-flight operation (CREATE, UPDATE, DELETE). |
operationStatus | string | — | OperationStatus is the last reported operation status. |
requestToken | string | — | RequestToken tracks an in-flight asynchronous operation. |
LogsLogAnomalyDetector # CLOUD CONTROL · AWS::Logs::LogAnomalyDetector
LogsLogAnomalyDetector manages AWS::Logs::LogAnomalyDetector through the AWS Cloud Control API.
kubectl get logsloganomalydetectors · example on GitHub
Example
# LogsLogAnomalyDetector — CloudWatch Logs
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/cloudwatchlogs.html#logsloganomalydetector
apiVersion: aws.konfig.io/v1alpha1
kind: LogsLogAnomalyDetector
metadata:
name: example-logsloganomalydetector
namespace: default
spec:
accountId: '123456789012'
anomalyVisibilityTime: 1
detectorName: example-logsloganomalydetector
evaluationFrequency: FIVE_MIN
filterPattern: example
kmsKeyId: arn:aws:kms:us-east-1:123456789012:key/1234abcd-12ab-34cd-56ef-1234567890ab
logGroupArnList:
- example
providerRef:
name: example-logsloganomalydetector
region: us-east-1
Spec
| Field | Type | Required | Description |
|---|---|---|---|
accountId | string | — | Account ID for owner of detector |
anomalyVisibilityTime | number | — | |
detectorName | string | — | Name of detector |
evaluationFrequency | enum | — | How often log group is evaluated Allowed: FIVE_MIN, TEN_MIN, FIFTEEN_MIN, THIRTY_MIN, ONE_HOUR |
filterPattern | string | — | |
kmsKeyId | string | — | The Amazon Resource Name (ARN) of the CMK to use when encrypting log data. |
logGroupArnList | array<string> | — | List of Arns for the given log group |
providerRef | object | — | ProviderRef selects the AWSProvider (account/region) this resource is reconciled against. |
providerRef.name | string | yes | Name of a cluster-scoped AWSProvider. |
providerRef.region | string | — | Region overrides the provider's region for this resource only. |
Status
| Field | Type | Required | Description |
|---|---|---|---|
anomalyDetectorArn | string | — | ARN of LogAnomalyDetector Read-only: reported by AWS after creation. |
anomalyDetectorStatus | string | — | Current status of detector. |
attempt | integer | — | Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure. |
awsProvider | object | — | AWSProvider confirms the account and region this resource was reconciled against. |
awsProvider.accountId | string | — | AccountID the resource lives in. |
awsProvider.name | string | — | Name of the AWSProvider used; empty when the operator's own credentials were used. |
awsProvider.region | string | — | Region the resource lives in (empty for global services). |
conditions | array<object> | — | Conditions describe the current state of the resource. |
conditions[].lastTransitionTime | string | yes | lastTransitionTime is the last time the condition transitioned from one status to another. |
conditions[].message | string | yes | message is a human readable message indicating details about the transition. |
conditions[].observedGeneration | integer | — | observedGeneration represents the .metadata.generation that the condition was set based upon. |
conditions[].reason | string | yes | reason contains a programmatic identifier indicating the reason for the condition's last transition. |
conditions[].status | enum | yes | status of the condition, one of True, False, Unknown. Allowed: True, False, Unknown |
conditions[].type | string | yes | type of condition in CamelCase or in foo.example.com/CamelCase. |
creationTimeStamp | number | — | When detector was created. |
identifier | string | — | Identifier is the Cloud Control primary identifier of the resource. |
lastModifiedTimeStamp | number | — | When detector was lsat modified. |
lastSyncTime | string | — | |
observedGeneration | integer | — | |
operation | string | — | Operation is the in-flight operation (CREATE, UPDATE, DELETE). |
operationStatus | string | — | OperationStatus is the last reported operation status. |
requestToken | string | — | RequestToken tracks an in-flight asynchronous operation. |
LogsLogStream # CLOUD CONTROL · AWS::Logs::LogStream
LogsLogStream manages AWS::Logs::LogStream through the AWS Cloud Control API.
kubectl get logslogstreams · example on GitHub
Example
# LogsLogStream — CloudWatch Logs
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/cloudwatchlogs.html#logslogstream
apiVersion: aws.konfig.io/v1alpha1
kind: LogsLogStream
metadata:
name: example-logslogstream
namespace: default
spec:
logGroupName: example-logslogstream
logStreamName: example-logslogstream
providerRef:
name: example-logslogstream
region: us-east-1
Spec
| Field | Type | Required | Description |
|---|---|---|---|
logGroupName | string | yes | The name of the log group where the log stream is created. |
logStreamName | string | — | The name of the log stream. |
providerRef | object | — | ProviderRef selects the AWSProvider (account/region) this resource is reconciled against. |
providerRef.name | string | yes | Name of a cluster-scoped AWSProvider. |
providerRef.region | string | — | Region overrides the provider's region for this resource only. |
Status
| Field | Type | Required | Description |
|---|---|---|---|
attempt | integer | — | Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure. |
awsProvider | object | — | AWSProvider confirms the account and region this resource was reconciled against. |
awsProvider.accountId | string | — | AccountID the resource lives in. |
awsProvider.name | string | — | Name of the AWSProvider used; empty when the operator's own credentials were used. |
awsProvider.region | string | — | Region the resource lives in (empty for global services). |
conditions | array<object> | — | Conditions describe the current state of the resource. |
conditions[].lastTransitionTime | string | yes | lastTransitionTime is the last time the condition transitioned from one status to another. |
conditions[].message | string | yes | message is a human readable message indicating details about the transition. |
conditions[].observedGeneration | integer | — | observedGeneration represents the .metadata.generation that the condition was set based upon. |
conditions[].reason | string | yes | reason contains a programmatic identifier indicating the reason for the condition's last transition. |
conditions[].status | enum | yes | status of the condition, one of True, False, Unknown. Allowed: True, False, Unknown |
conditions[].type | string | yes | type of condition in CamelCase or in foo.example.com/CamelCase. |
identifier | string | — | Identifier is the Cloud Control primary identifier of the resource. |
lastSyncTime | string | — | |
observedGeneration | integer | — | |
operation | string | — | Operation is the in-flight operation (CREATE, UPDATE, DELETE). |
operationStatus | string | — | OperationStatus is the last reported operation status. |
requestToken | string | — | RequestToken tracks an in-flight asynchronous operation. |
LogsQueryDefinition # CLOUD CONTROL · AWS::Logs::QueryDefinition
LogsQueryDefinition manages AWS::Logs::QueryDefinition through the AWS Cloud Control API.
kubectl get logsquerydefinitions · example on GitHub
Example
# LogsQueryDefinition — CloudWatch Logs
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/cloudwatchlogs.html#logsquerydefinition
apiVersion: aws.konfig.io/v1alpha1
kind: LogsQueryDefinition
metadata:
name: example-logsquerydefinition
namespace: default
spec:
logGroupNames:
- example
name: example-logsquerydefinition
parameters:
- defaultValue: example
description: Managed by konfig-konector
name: example-logsquerydefinition
providerRef:
name: example-logsquerydefinition
region: us-east-1
queryLanguage: CWLI
queryString: example
Spec
| Field | Type | Required | Description |
|---|---|---|---|
logGroupNames | array<string> | — | Optionally define specific log groups as part of your query definition |
name | string | yes | A name for the saved query definition |
parameters | array<object> | — | Use this parameter to include specific query parameters as part of your query definition. |
parameters[].defaultValue | string | — | The default value to use for this query parameter if no value is supplied at execution time. |
parameters[].description | string | — | A description of the query parameter that explains its purpose or expected values. |
parameters[].name | string | yes | The name of the query parameter. |
providerRef | object | — | ProviderRef selects the AWSProvider (account/region) this resource is reconciled against. |
providerRef.name | string | yes | Name of a cluster-scoped AWSProvider. |
providerRef.region | string | — | Region overrides the provider's region for this resource only. |
queryLanguage | enum | — | Query language of the query string. Allowed: CWLI, SQL, PPL |
queryString | string | yes | The query string to use for this definition |
Status
| Field | Type | Required | Description |
|---|---|---|---|
attempt | integer | — | Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure. |
awsProvider | object | — | AWSProvider confirms the account and region this resource was reconciled against. |
awsProvider.accountId | string | — | AccountID the resource lives in. |
awsProvider.name | string | — | Name of the AWSProvider used; empty when the operator's own credentials were used. |
awsProvider.region | string | — | Region the resource lives in (empty for global services). |
conditions | array<object> | — | Conditions describe the current state of the resource. |
conditions[].lastTransitionTime | string | yes | lastTransitionTime is the last time the condition transitioned from one status to another. |
conditions[].message | string | yes | message is a human readable message indicating details about the transition. |
conditions[].observedGeneration | integer | — | observedGeneration represents the .metadata.generation that the condition was set based upon. |
conditions[].reason | string | yes | reason contains a programmatic identifier indicating the reason for the condition's last transition. |
conditions[].status | enum | yes | status of the condition, one of True, False, Unknown. Allowed: True, False, Unknown |
conditions[].type | string | yes | type of condition in CamelCase or in foo.example.com/CamelCase. |
identifier | string | — | Identifier is the Cloud Control primary identifier of the resource. |
lastSyncTime | string | — | |
observedGeneration | integer | — | |
operation | string | — | Operation is the in-flight operation (CREATE, UPDATE, DELETE). |
operationStatus | string | — | OperationStatus is the last reported operation status. |
queryDefinitionId | string | — | Unique identifier of a query definition Read-only: reported by AWS after creation. |
requestToken | string | — | RequestToken tracks an in-flight asynchronous operation. |
LogsResourcePolicy # CLOUD CONTROL · AWS::Logs::ResourcePolicy
LogsResourcePolicy manages AWS::Logs::ResourcePolicy through the AWS Cloud Control API.
kubectl get logsresourcepolicies · example on GitHub
Example
# LogsResourcePolicy — CloudWatch Logs
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/cloudwatchlogs.html#logsresourcepolicy
apiVersion: aws.konfig.io/v1alpha1
kind: LogsResourcePolicy
metadata:
name: example-logsresourcepolicy
namespace: default
spec:
policyName: example-logsresourcepolicy
providerRef:
name: example-logsresourcepolicy
region: us-east-1
Spec
| Field | Type | Required | Description |
|---|---|---|---|
policyDocument | object | yes | The policy document |
policyName | string | yes | A name for resource policy Create-only in AWS: changing it requires replacing the resource. |
providerRef | object | — | ProviderRef selects the AWSProvider (account/region) this resource is reconciled against. |
providerRef.name | string | yes | Name of a cluster-scoped AWSProvider. |
providerRef.region | string | — | Region overrides the provider's region for this resource only. |
Status
| Field | Type | Required | Description |
|---|---|---|---|
attempt | integer | — | Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure. |
awsProvider | object | — | AWSProvider confirms the account and region this resource was reconciled against. |
awsProvider.accountId | string | — | AccountID the resource lives in. |
awsProvider.name | string | — | Name of the AWSProvider used; empty when the operator's own credentials were used. |
awsProvider.region | string | — | Region the resource lives in (empty for global services). |
conditions | array<object> | — | Conditions describe the current state of the resource. |
conditions[].lastTransitionTime | string | yes | lastTransitionTime is the last time the condition transitioned from one status to another. |
conditions[].message | string | yes | message is a human readable message indicating details about the transition. |
conditions[].observedGeneration | integer | — | observedGeneration represents the .metadata.generation that the condition was set based upon. |
conditions[].reason | string | yes | reason contains a programmatic identifier indicating the reason for the condition's last transition. |
conditions[].status | enum | yes | status of the condition, one of True, False, Unknown. Allowed: True, False, Unknown |
conditions[].type | string | yes | type of condition in CamelCase or in foo.example.com/CamelCase. |
identifier | string | — | Identifier is the Cloud Control primary identifier of the resource. |
lastSyncTime | string | — | |
observedGeneration | integer | — | |
operation | string | — | Operation is the in-flight operation (CREATE, UPDATE, DELETE). |
operationStatus | string | — | OperationStatus is the last reported operation status. |
requestToken | string | — | RequestToken tracks an in-flight asynchronous operation. |
LogsScheduledQuery # CLOUD CONTROL · AWS::Logs::ScheduledQuery
LogsScheduledQuery manages AWS::Logs::ScheduledQuery through the AWS Cloud Control API.
kubectl get logsscheduledqueries · example on GitHub
Example
# LogsScheduledQuery — CloudWatch Logs
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/cloudwatchlogs.html#logsscheduledquery
apiVersion: aws.konfig.io/v1alpha1
kind: LogsScheduledQuery
metadata:
name: example-logsscheduledquery
namespace: default
spec:
description: Managed by konfig-konector
destinationConfiguration:
s3Configuration:
destinationIdentifier: example
roleArn: arn:aws:iam::123456789012:role/example-role
executionRoleArn: arn:aws:iam::123456789012:role/example-role
logGroupIdentifiers:
- example
name: example-logsscheduledquery
providerRef:
name: example-logsscheduledquery
region: us-east-1
queryLanguage: example
queryString: example
scheduleEndTime: 1
scheduleExpression: example
scheduleStartTime: 1
startTimeOffset: 1
state: ENABLED
tags:
- key: example
value: example
timezone: example
Spec
| Field | Type | Required | Description |
|---|---|---|---|
description | string | — | |
destinationConfiguration | object | — | LogsScheduledQueryDestinationConfiguration is a nested property type of AWS::Logs::ScheduledQuery. |
destinationConfiguration.s3Configuration | object | — | LogsScheduledQueryS3Configuration is a nested property type of AWS::Logs::ScheduledQuery. |
destinationConfiguration.s3Configuration.destinationIdentifier | string | yes | |
destinationConfiguration.s3Configuration.roleArn | string | yes | |
executionRoleArn | string | yes | |
logGroupIdentifiers | array<string> | — | |
name | string | yes | Create-only in AWS: changing it requires replacing the resource. |
providerRef | object | — | ProviderRef selects the AWSProvider (account/region) this resource is reconciled against. |
providerRef.name | string | yes | Name of a cluster-scoped AWSProvider. |
providerRef.region | string | — | Region overrides the provider's region for this resource only. |
queryLanguage | string | yes | |
queryString | string | yes | |
scheduleEndTime | number | — | |
scheduleExpression | string | yes | |
scheduleStartTime | number | — | |
startTimeOffset | integer | — | |
state | enum | — | Allowed: ENABLED, DISABLED |
tags | array<object> | — | |
tags[].key | string | yes | |
tags[].value | string | yes | |
timezone | string | — |
Status
| Field | Type | Required | Description |
|---|---|---|---|
attempt | integer | — | Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure. |
awsProvider | object | — | AWSProvider confirms the account and region this resource was reconciled against. |
awsProvider.accountId | string | — | AccountID the resource lives in. |
awsProvider.name | string | — | Name of the AWSProvider used; empty when the operator's own credentials were used. |
awsProvider.region | string | — | Region the resource lives in (empty for global services). |
conditions | array<object> | — | Conditions describe the current state of the resource. |
conditions[].lastTransitionTime | string | yes | lastTransitionTime is the last time the condition transitioned from one status to another. |
conditions[].message | string | yes | message is a human readable message indicating details about the transition. |
conditions[].observedGeneration | integer | — | observedGeneration represents the .metadata.generation that the condition was set based upon. |
conditions[].reason | string | yes | reason contains a programmatic identifier indicating the reason for the condition's last transition. |
conditions[].status | enum | yes | status of the condition, one of True, False, Unknown. Allowed: True, False, Unknown |
conditions[].type | string | yes | type of condition in CamelCase or in foo.example.com/CamelCase. |
creationTime | number | — | Read-only: reported by AWS after creation. |
identifier | string | — | Identifier is the Cloud Control primary identifier of the resource. |
lastExecutionStatus | enum | — | Read-only: reported by AWS after creation. Allowed: Pending, InvalidQuery, Complete, Failed, Timeout |
lastSyncTime | string | — | |
lastTriggeredTime | number | — | Read-only: reported by AWS after creation. |
lastUpdatedTime | number | — | Read-only: reported by AWS after creation. |
observedGeneration | integer | — | |
operation | string | — | Operation is the in-flight operation (CREATE, UPDATE, DELETE). |
operationStatus | string | — | OperationStatus is the last reported operation status. |
requestToken | string | — | RequestToken tracks an in-flight asynchronous operation. |
scheduledQueryArn | string | — | Read-only: reported by AWS after creation. |
LogsStorageTierPolicy # CLOUD CONTROL · AWS::Logs::StorageTierPolicy
LogsStorageTierPolicy manages AWS::Logs::StorageTierPolicy through the AWS Cloud Control API.
kubectl get logsstoragetierpolicies · example on GitHub
Example
# LogsStorageTierPolicy — CloudWatch Logs
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/cloudwatchlogs.html#logsstoragetierpolicy
apiVersion: aws.konfig.io/v1alpha1
kind: LogsStorageTierPolicy
metadata:
name: example-logsstoragetierpolicy
namespace: default
spec:
providerRef:
name: example-logsstoragetierpolicy
region: us-east-1
storageTier: INTELLIGENT_TIERING
Spec
| Field | Type | Required | Description |
|---|---|---|---|
providerRef | object | — | ProviderRef selects the AWSProvider (account/region) this resource is reconciled against. |
providerRef.name | string | yes | Name of a cluster-scoped AWSProvider. |
providerRef.region | string | — | Region overrides the provider's region for this resource only. |
storageTier | enum | yes | The storage tier to apply. Allowed: INTELLIGENT_TIERING |
Status
| Field | Type | Required | Description |
|---|---|---|---|
accountId | string | — | The AWS account ID that owns this storage tier policy. |
attempt | integer | — | Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure. |
awsProvider | object | — | AWSProvider confirms the account and region this resource was reconciled against. |
awsProvider.accountId | string | — | AccountID the resource lives in. |
awsProvider.name | string | — | Name of the AWSProvider used; empty when the operator's own credentials were used. |
awsProvider.region | string | — | Region the resource lives in (empty for global services). |
conditions | array<object> | — | Conditions describe the current state of the resource. |
conditions[].lastTransitionTime | string | yes | lastTransitionTime is the last time the condition transitioned from one status to another. |
conditions[].message | string | yes | message is a human readable message indicating details about the transition. |
conditions[].observedGeneration | integer | — | observedGeneration represents the .metadata.generation that the condition was set based upon. |
conditions[].reason | string | yes | reason contains a programmatic identifier indicating the reason for the condition's last transition. |
conditions[].status | enum | yes | status of the condition, one of True, False, Unknown. Allowed: True, False, Unknown |
conditions[].type | string | yes | type of condition in CamelCase or in foo.example.com/CamelCase. |
identifier | string | — | Identifier is the Cloud Control primary identifier of the resource. |
lastSyncTime | string | — | |
lastUpdatedTime | number | — | Timestamp (milliseconds after Jan 1, 1970 00:00:00 UTC) when the storage tier policy was last updated. |
observedGeneration | integer | — | |
operation | string | — | Operation is the in-flight operation (CREATE, UPDATE, DELETE). |
operationStatus | string | — | OperationStatus is the last reported operation status. |
requestToken | string | — | RequestToken tracks an in-flight asynchronous operation. |
LogsTransformer # CLOUD CONTROL · AWS::Logs::Transformer
LogsTransformer manages AWS::Logs::Transformer through the AWS Cloud Control API.
kubectl get logstransformers · example on GitHub
Example
# LogsTransformer — CloudWatch Logs
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/cloudwatchlogs.html#logstransformer
apiVersion: aws.konfig.io/v1alpha1
kind: LogsTransformer
metadata:
name: example-logstransformer
namespace: default
spec:
logGroupIdentifier: example
providerRef:
name: example-logstransformer
region: us-east-1
transformerConfig:
- addKeys:
entries:
- key: example
overwriteIfExists: false
value: example
copyValue:
entries:
- overwriteIfExists: false
source: example
target: example
csv:
columns:
- example
delimiter: ex
quoteCharacter: e
source: example
dateTimeConverter:
locale: example
matchPatterns:
- example
source: example
sourceTimezone: example
target: example
targetFormat: example
targetTimezone: example
deleteKeys:
withKeys:
- example
grok:
match: example
source: example
listToMap:
flatten: false
flattenedElement: first
key: example
source: example
target: example
valueKey: example
lowerCaseString:
withKeys:
- example
moveKeys:
entries:
- overwriteIfExists: false
source: example
target: example
parseCloudfront:
source: example
parseJSON:
destination: example
source: example
parseKeyValue:
destination: example
fieldDelimiter: example
keyPrefix: example
keyValueDelimiter: example
nonMatchValue: example
overwriteIfExists: false
source: example
parsePostgres:
source: example
parseRoute53:
source: example
parseToOCSF:
eventSource: CloudTrail
mappingVersion: '1.0'
ocsfVersion: V1.1
source: example
parseVPC:
source: example
parseWAF:
source: example
renameKeys:
entries:
- key: example
overwriteIfExists: false
renameTo: example
splitString:
entries:
- delimiter: example
source: example
substituteString:
entries:
- from: example
source: example
to: example
trimString:
withKeys:
- example
typeConverter:
entries:
- key: example
type: boolean
upperCaseString:
withKeys:
- example
Spec
| Field | Type | Required | Description |
|---|---|---|---|
logGroupIdentifier | string | yes | Existing log group that you want to associate with this transformer. |
providerRef | object | — | ProviderRef selects the AWSProvider (account/region) this resource is reconciled against. |
providerRef.name | string | yes | Name of a cluster-scoped AWSProvider. |
providerRef.region | string | — | Region overrides the provider's region for this resource only. |
transformerConfig | array<object> | yes | List of processors in a transformer |
transformerConfig[].addKeys | object | — | LogsTransformerProcessorAddKeys is a nested property type of AWS::Logs::Transformer. |
transformerConfig[].addKeys.entries | array<object> | yes | |
transformerConfig[].addKeys.entries[].key | string | yes | |
transformerConfig[].addKeys.entries[].overwriteIfExists | boolean | — | |
transformerConfig[].addKeys.entries[].value | string | yes | |
transformerConfig[].copyValue | object | — | LogsTransformerProcessorCopyValue is a nested property type of AWS::Logs::Transformer. |
transformerConfig[].copyValue.entries | array<object> | yes | |
transformerConfig[].copyValue.entries[].overwriteIfExists | boolean | — | |
transformerConfig[].copyValue.entries[].source | string | yes | |
transformerConfig[].copyValue.entries[].target | string | yes | |
transformerConfig[].csv | object | — | LogsTransformerProcessorCsv is a nested property type of AWS::Logs::Transformer. |
transformerConfig[].csv.columns | array<string> | — | |
transformerConfig[].csv.delimiter | string | — | |
transformerConfig[].csv.quoteCharacter | string | — | |
transformerConfig[].csv.source | string | — | |
transformerConfig[].dateTimeConverter | object | — | LogsTransformerProcessorDateTimeConverter is a nested property type of AWS::Logs::Transformer. |
transformerConfig[].dateTimeConverter.locale | string | — | |
transformerConfig[].dateTimeConverter.matchPatterns | array<string> | yes | |
transformerConfig[].dateTimeConverter.source | string | yes | |
transformerConfig[].dateTimeConverter.sourceTimezone | string | — | |
transformerConfig[].dateTimeConverter.target | string | yes | |
transformerConfig[].dateTimeConverter.targetFormat | string | — | |
transformerConfig[].dateTimeConverter.targetTimezone | string | — | |
transformerConfig[].deleteKeys | object | — | LogsTransformerProcessorDeleteKeys is a nested property type of AWS::Logs::Transformer. |
transformerConfig[].deleteKeys.withKeys | array<string> | yes | |
transformerConfig[].grok | object | — | LogsTransformerProcessorGrok is a nested property type of AWS::Logs::Transformer. |
transformerConfig[].grok.match | string | yes | |
transformerConfig[].grok.source | string | — | |
transformerConfig[].listToMap | object | — | LogsTransformerProcessorListToMap is a nested property type of AWS::Logs::Transformer. |
transformerConfig[].listToMap.flatten | boolean | — | |
transformerConfig[].listToMap.flattenedElement | enum | — | Allowed: first, last |
transformerConfig[].listToMap.key | string | yes | |
transformerConfig[].listToMap.source | string | yes | |
transformerConfig[].listToMap.target | string | — | |
transformerConfig[].listToMap.valueKey | string | — | |
transformerConfig[].lowerCaseString | object | — | LogsTransformerProcessorLowerCaseString is a nested property type of AWS::Logs::Transformer. |
transformerConfig[].lowerCaseString.withKeys | array<string> | yes | |
transformerConfig[].moveKeys | object | — | LogsTransformerProcessorMoveKeys is a nested property type of AWS::Logs::Transformer. |
transformerConfig[].moveKeys.entries | array<object> | yes | |
transformerConfig[].moveKeys.entries[].overwriteIfExists | boolean | — | |
transformerConfig[].moveKeys.entries[].source | string | yes | |
transformerConfig[].moveKeys.entries[].target | string | yes | |
transformerConfig[].parseCloudfront | object | — | LogsTransformerParseCloudfront is a nested property type of AWS::Logs::Transformer. |
transformerConfig[].parseCloudfront.source | string | — | |
transformerConfig[].parseJSON | object | — | LogsTransformerProcessorParseJSON is a nested property type of AWS::Logs::Transformer. |
transformerConfig[].parseJSON.destination | string | — | |
transformerConfig[].parseJSON.source | string | — | |
transformerConfig[].parseKeyValue | object | — | LogsTransformerProcessorParseKeyValue is a nested property type of AWS::Logs::Transformer. |
transformerConfig[].parseKeyValue.destination | string | — | |
transformerConfig[].parseKeyValue.fieldDelimiter | string | — | |
transformerConfig[].parseKeyValue.keyPrefix | string | — | |
transformerConfig[].parseKeyValue.keyValueDelimiter | string | — | |
transformerConfig[].parseKeyValue.nonMatchValue | string | — | |
transformerConfig[].parseKeyValue.overwriteIfExists | boolean | — | |
transformerConfig[].parseKeyValue.source | string | — | |
transformerConfig[].parsePostgres | object | — | LogsTransformerParsePostgres is a nested property type of AWS::Logs::Transformer. |
transformerConfig[].parsePostgres.source | string | — | |
transformerConfig[].parseRoute53 | object | — | LogsTransformerParseRoute53 is a nested property type of AWS::Logs::Transformer. |
transformerConfig[].parseRoute53.source | string | — | |
transformerConfig[].parseToOCSF | object | — | LogsTransformerParseToOCSF is a nested property type of AWS::Logs::Transformer. |
transformerConfig[].parseToOCSF.eventSource | enum | yes | Allowed: CloudTrail, Route53Resolver, VPCFlow, EKSAudit, AWSWAF |
transformerConfig[].parseToOCSF.mappingVersion | string | — | |
transformerConfig[].parseToOCSF.ocsfVersion | enum | yes | Allowed: V1.1, V1.5 |
transformerConfig[].parseToOCSF.source | string | — | |
transformerConfig[].parseVPC | object | — | LogsTransformerParseVPC is a nested property type of AWS::Logs::Transformer. |
transformerConfig[].parseVPC.source | string | — | |
transformerConfig[].parseWAF | object | — | LogsTransformerParseWAF is a nested property type of AWS::Logs::Transformer. |
transformerConfig[].parseWAF.source | string | — | |
transformerConfig[].renameKeys | object | — | LogsTransformerProcessorRenameKeys is a nested property type of AWS::Logs::Transformer. |
transformerConfig[].renameKeys.entries | array<object> | yes | |
transformerConfig[].renameKeys.entries[].key | string | yes | |
transformerConfig[].renameKeys.entries[].overwriteIfExists | boolean | — | |
transformerConfig[].renameKeys.entries[].renameTo | string | yes | |
transformerConfig[].splitString | object | — | LogsTransformerProcessorSplitString is a nested property type of AWS::Logs::Transformer. |
transformerConfig[].splitString.entries | array<object> | yes | |
transformerConfig[].splitString.entries[].delimiter | string | yes | |
transformerConfig[].splitString.entries[].source | string | yes | |
transformerConfig[].substituteString | object | — | LogsTransformerProcessorSubstituteString is a nested property type of AWS::Logs::Transformer. |
transformerConfig[].substituteString.entries | array<object> | yes | |
transformerConfig[].substituteString.entries[].from | string | yes | |
transformerConfig[].substituteString.entries[].source | string | yes | |
transformerConfig[].substituteString.entries[].to | string | yes | |
transformerConfig[].trimString | object | — | LogsTransformerProcessorTrimString is a nested property type of AWS::Logs::Transformer. |
transformerConfig[].trimString.withKeys | array<string> | yes | |
transformerConfig[].typeConverter | object | — | LogsTransformerProcessorTypeConverter is a nested property type of AWS::Logs::Transformer. |
transformerConfig[].typeConverter.entries | array<object> | yes | |
transformerConfig[].typeConverter.entries[].key | string | yes | |
transformerConfig[].typeConverter.entries[].type | enum | yes | Allowed: boolean, integer, double, string |
transformerConfig[].upperCaseString | object | — | LogsTransformerProcessorUpperCaseString is a nested property type of AWS::Logs::Transformer. |
transformerConfig[].upperCaseString.withKeys | array<string> | yes |
Status
| Field | Type | Required | Description |
|---|---|---|---|
attempt | integer | — | Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure. |
awsProvider | object | — | AWSProvider confirms the account and region this resource was reconciled against. |
awsProvider.accountId | string | — | AccountID the resource lives in. |
awsProvider.name | string | — | Name of the AWSProvider used; empty when the operator's own credentials were used. |
awsProvider.region | string | — | Region the resource lives in (empty for global services). |
conditions | array<object> | — | Conditions describe the current state of the resource. |
conditions[].lastTransitionTime | string | yes | lastTransitionTime is the last time the condition transitioned from one status to another. |
conditions[].message | string | yes | message is a human readable message indicating details about the transition. |
conditions[].observedGeneration | integer | — | observedGeneration represents the .metadata.generation that the condition was set based upon. |
conditions[].reason | string | yes | reason contains a programmatic identifier indicating the reason for the condition's last transition. |
conditions[].status | enum | yes | status of the condition, one of True, False, Unknown. Allowed: True, False, Unknown |
conditions[].type | string | yes | type of condition in CamelCase or in foo.example.com/CamelCase. |
identifier | string | — | Identifier is the Cloud Control primary identifier of the resource. |
lastSyncTime | string | — | |
observedGeneration | integer | — | |
operation | string | — | Operation is the in-flight operation (CREATE, UPDATE, DELETE). |
operationStatus | string | — | OperationStatus is the last reported operation status. |
requestToken | string | — | RequestToken tracks an in-flight asynchronous operation. |
MetricFilter # GA
MetricFilter is the Schema for managing CloudWatch Logs Metric Filters.
kubectl get metricfilters · example on GitHub
Example
# MetricFilter — CloudWatch Logs
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/cloudwatchlogs.html#metricfilter
apiVersion: aws.konfig.io/v1alpha1
kind: MetricFilter
metadata:
name: example-metricfilter
namespace: default
spec:
filterName: example-metricfilter
filterPattern: example
logGroupRef:
logGroupName: example-metricfilter
name: example-metricfilter
metricTransformations:
- defaultValue: 1
metricName: example-metricfilter
metricNamespace: example
metricValue: example
providerRef:
name: example-metricfilter
region: us-east-1
Spec
| Field | Type | Required | Description |
|---|---|---|---|
filterName | string | yes | FilterName is the name of the metric filter. |
filterPattern | string | yes | FilterPattern is the CloudWatch Logs filter pattern. |
logGroupRef | object | yes | LogGroupRef references the log group. |
logGroupRef.logGroupName | string | — | LogGroupName is a direct AWS log group name. |
logGroupRef.name | string | — | Name of a LogGroup CR in the same namespace. |
metricTransformations | array<object> | yes | MetricTransformations are the transformations to apply. |
metricTransformations[].defaultValue | number | — | DefaultValue is the value to emit when no data matches. |
metricTransformations[].metricName | string | yes | MetricName is the name of the CloudWatch metric. |
metricTransformations[].metricNamespace | string | yes | MetricNamespace is the namespace for the metric. |
metricTransformations[].metricValue | string | yes | MetricValue is the value to publish when the filter pattern matches. |
providerRef | object | — | ProviderRef selects the AWSProvider (account/region) this resource is reconciled against. |
providerRef.name | string | yes | Name of a cluster-scoped AWSProvider. |
providerRef.region | string | — | Region overrides the provider's region for this resource only. |
Status
| Field | Type | Required | Description |
|---|---|---|---|
awsProvider | object | — | AWSProvider confirms the account and region this resource was reconciled against. |
awsProvider.accountId | string | — | AccountID the resource lives in. |
awsProvider.name | string | — | Name of the AWSProvider used; empty when the operator's own credentials were used. |
awsProvider.region | string | — | Region the resource lives in (empty for global services). |
conditions | array<object> | — | Conditions describe the current state of the resource. |
conditions[].lastTransitionTime | string | yes | lastTransitionTime is the last time the condition transitioned from one status to another. |
conditions[].message | string | yes | message is a human readable message indicating details about the transition. |
conditions[].observedGeneration | integer | — | observedGeneration represents the .metadata.generation that the condition was set based upon. |
conditions[].reason | string | yes | reason contains a programmatic identifier indicating the reason for the condition's last transition. |
conditions[].status | enum | yes | status of the condition, one of True, False, Unknown. Allowed: True, False, Unknown |
conditions[].type | string | yes | type of condition in CamelCase or in foo.example.com/CamelCase. |
lastSyncTime | string | — | LastSyncTime is when the resource was last successfully reconciled. |
observedGeneration | integer | — | ObservedGeneration is the most recent .metadata.generation reconciled. |
SubscriptionFilter # GA
SubscriptionFilter is the Schema for managing CloudWatch Logs Subscription Filters.
kubectl get subscriptionfilters · example on GitHub
Example
# SubscriptionFilter — CloudWatch Logs
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/cloudwatchlogs.html#subscriptionfilter
apiVersion: aws.konfig.io/v1alpha1
kind: SubscriptionFilter
metadata:
name: example-subscriptionfilter
namespace: default
spec:
destinationArn: arn:aws:iam::123456789012:role/example-role
filterName: example-subscriptionfilter
filterPattern: example
logGroupRef:
logGroupName: example-subscriptionfilter
name: example-subscriptionfilter
providerRef:
name: example-subscriptionfilter
region: us-east-1
roleArn: arn:aws:iam::123456789012:role/example-role
Spec
| Field | Type | Required | Description |
|---|---|---|---|
destinationArn | string | yes | DestinationARN is the ARN of the destination (Kinesis, Lambda, or Firehose). |
filterName | string | yes | FilterName is the name of the subscription filter. |
filterPattern | string | yes | FilterPattern is the CloudWatch Logs filter pattern. |
logGroupRef | object | yes | LogGroupRef references the log group. |
logGroupRef.logGroupName | string | — | LogGroupName is a direct AWS log group name. |
logGroupRef.name | string | — | Name of a LogGroup CR in the same namespace. |
providerRef | object | — | ProviderRef selects the AWSProvider (account/region) this resource is reconciled against. |
providerRef.name | string | yes | Name of a cluster-scoped AWSProvider. |
providerRef.region | string | — | Region overrides the provider's region for this resource only. |
roleArn | string | — | RoleARN is the IAM role ARN for delivering logs to the destination (Kinesis only). |
Status
| Field | Type | Required | Description |
|---|---|---|---|
awsProvider | object | — | AWSProvider confirms the account and region this resource was reconciled against. |
awsProvider.accountId | string | — | AccountID the resource lives in. |
awsProvider.name | string | — | Name of the AWSProvider used; empty when the operator's own credentials were used. |
awsProvider.region | string | — | Region the resource lives in (empty for global services). |
conditions | array<object> | — | Conditions describe the current state of the resource. |
conditions[].lastTransitionTime | string | yes | lastTransitionTime is the last time the condition transitioned from one status to another. |
conditions[].message | string | yes | message is a human readable message indicating details about the transition. |
conditions[].observedGeneration | integer | — | observedGeneration represents the .metadata.generation that the condition was set based upon. |
conditions[].reason | string | yes | reason contains a programmatic identifier indicating the reason for the condition's last transition. |
conditions[].status | enum | yes | status of the condition, one of True, False, Unknown. Allowed: True, False, Unknown |
conditions[].type | string | yes | type of condition in CamelCase or in foo.example.com/CamelCase. |
lastSyncTime | string | — | LastSyncTime is when the resource was last successfully reconciled. |
observedGeneration | integer | — | ObservedGeneration is the most recent .metadata.generation reconciled. |