Class EventSelector

java.lang.Object
software.amazon.awssdk.services.cloudtrail.model.EventSelector
All Implemented Interfaces:
Serializable, SdkPojo, ToCopyableBuilder<EventSelector.Builder,EventSelector>
@Generated("software.amazon.awssdk:codegen") public final class EventSelector extends Object implements SdkPojo, Serializable, ToCopyableBuilder<EventSelector.Builder,EventSelector>

Use event selectors to further specify the management and data event settings for your trail. By default, trails created without specific event selectors will be configured to log all read and write management events, and no data events. When an event occurs in your account, CloudTrail evaluates the event selector for all trails. For each trail, if the event matches any event selector, the trail processes and logs the event. If the event doesn't match any event selector, the trail doesn't log the event.

You can configure up to five event selectors for a trail.

You cannot apply both event selectors and advanced event selectors to a trail.

See Also:

  • Method Details

    • readWriteType

      public final ReadWriteType readWriteType()

      Specify if you want your trail to log read-only events, write-only events, or all. For example, the EC2 GetConsoleOutput is a read-only API operation and RunInstances is a write-only API operation.

      By default, the value is All.

      If the service returns an enum value that is not available in the current SDK version, readWriteType will return ReadWriteType.UNKNOWN_TO_SDK_VERSION. The raw value returned by the service is available from readWriteTypeAsString().

      Returns:
      Specify if you want your trail to log read-only events, write-only events, or all. For example, the EC2 GetConsoleOutput is a read-only API operation and RunInstances is a write-only API operation.

      By default, the value is All.

      See Also:

    • readWriteTypeAsString

      public final String readWriteTypeAsString()

      Specify if you want your trail to log read-only events, write-only events, or all. For example, the EC2 GetConsoleOutput is a read-only API operation and RunInstances is a write-only API operation.

      By default, the value is All.

      If the service returns an enum value that is not available in the current SDK version, readWriteType will return ReadWriteType.UNKNOWN_TO_SDK_VERSION. The raw value returned by the service is available from readWriteTypeAsString().

      Returns:
      Specify if you want your trail to log read-only events, write-only events, or all. For example, the EC2 GetConsoleOutput is a read-only API operation and RunInstances is a write-only API operation.

      By default, the value is All.

      See Also:

    • includeManagementEvents

      public final Boolean includeManagementEvents()

      Specify if you want your event selector to include management events for your trail.

      For more information, see Management Events in the CloudTrail User Guide.

      By default, the value is true.

      The first copy of management events is free. You are charged for additional copies of management events that you are logging on any subsequent trail in the same Region. For more information about CloudTrail pricing, see CloudTrail Pricing.

      Returns:
      Specify if you want your event selector to include management events for your trail.

      For more information, see Management Events in the CloudTrail User Guide.

      By default, the value is true.

      The first copy of management events is free. You are charged for additional copies of management events that you are logging on any subsequent trail in the same Region. For more information about CloudTrail pricing, see CloudTrail Pricing.

    • hasDataResources

      public final boolean hasDataResources()
      For responses, this returns true if the service returned a value for the DataResources property. This DOES NOT check that the value is non-empty (for which, you should check the isEmpty() method on the property). This is useful because the SDK will never return a null collection or map, but you may need to differentiate between the service returning nothing (or null) and the service returning an empty collection or map. For requests, this returns true if a value for the property was specified in the request builder, and false if a value was not specified.

    • dataResources

      public final List<DataResource> dataResources()

      CloudTrail supports data event logging for Amazon S3 objects in standard S3 buckets, Lambda functions, and Amazon DynamoDB tables with basic event selectors. You can specify up to 250 resources for an individual event selector, but the total number of data resources cannot exceed 250 across all event selectors in a trail. This limit does not apply if you configure resource logging for all data events.

      For more information, see Data Events and Limits in CloudTrail in the CloudTrail User Guide.

      To log data events for all other resource types including objects stored in directory buckets, you must use AdvancedEventSelectors. You must also use AdvancedEventSelectors if you want to filter on the eventName field.

      Attempts to modify the collection returned by this method will result in an UnsupportedOperationException.

      This method will never return null. If you would like to know whether the service returned this field (so that you can differentiate between null and empty), you can use the hasDataResources() method.

      Returns:
      CloudTrail supports data event logging for Amazon S3 objects in standard S3 buckets, Lambda functions, and Amazon DynamoDB tables with basic event selectors. You can specify up to 250 resources for an individual event selector, but the total number of data resources cannot exceed 250 across all event selectors in a trail. This limit does not apply if you configure resource logging for all data events.

      For more information, see Data Events and Limits in CloudTrail in the CloudTrail User Guide.

      To log data events for all other resource types including objects stored in directory buckets, you must use AdvancedEventSelectors. You must also use AdvancedEventSelectors if you want to filter on the eventName field.

    • hasExcludeManagementEventSources

      public final boolean hasExcludeManagementEventSources()
      For responses, this returns true if the service returned a value for the ExcludeManagementEventSources property. This DOES NOT check that the value is non-empty (for which, you should check the isEmpty() method on the property). This is useful because the SDK will never return a null collection or map, but you may need to differentiate between the service returning nothing (or null) and the service returning an empty collection or map. For requests, this returns true if a value for the property was specified in the request builder, and false if a value was not specified.

    • excludeManagementEventSources

      public final List<String> excludeManagementEventSources()

      An optional list of service event sources from which you do not want management events to be logged on your trail. In this release, the list can be empty (disables the filter), or it can filter out Key Management Service or Amazon RDS Data API events by containing kms.amazonaws.com or rdsdata.amazonaws.com. By default, ExcludeManagementEventSources is empty, and KMS and Amazon RDS Data API events are logged to your trail. You can exclude management event sources only in Regions that support the event source.

      Attempts to modify the collection returned by this method will result in an UnsupportedOperationException.

      This method will never return null. If you would like to know whether the service returned this field (so that you can differentiate between null and empty), you can use the hasExcludeManagementEventSources() method.

      Returns:
      An optional list of service event sources from which you do not want management events to be logged on your trail. In this release, the list can be empty (disables the filter), or it can filter out Key Management Service or Amazon RDS Data API events by containing kms.amazonaws.com or rdsdata.amazonaws.com. By default, ExcludeManagementEventSources is empty, and KMS and Amazon RDS Data API events are logged to your trail. You can exclude management event sources only in Regions that support the event source.

    • toBuilder

      public EventSelector.Builder toBuilder()
      Description copied from interface: ToCopyableBuilder
      Take this object and create a builder that contains all of the current property values of this object.
      Specified by:
      toBuilder in interface ToCopyableBuilder<EventSelector.Builder,EventSelector>
      Returns:
      a builder for type T

    • builder

      public static EventSelector.Builder builder()

    • serializableBuilderClass

      public static Class<? extends EventSelector.Builder> serializableBuilderClass()

    • hashCode

      public final int hashCode()
      Overrides:
      hashCode in class Object

    • equals

      public final boolean equals(Object obj)
      Overrides:
      equals in class Object

    • equalsBySdkFields

      public final boolean equalsBySdkFields(Object obj)
      Description copied from interface: SdkPojo
      Indicates whether some other object is "equal to" this one by SDK fields. An SDK field is a modeled, non-inherited field in an SdkPojo class, and is generated based on a service model.

      If an SdkPojo class does not have any inherited fields, equalsBySdkFields and equals are essentially the same.

      Specified by:
      equalsBySdkFields in interface SdkPojo
      Parameters:
      obj - the object to be compared with
      Returns:
      true if the other object equals to this object by sdk fields, false otherwise.

    • toString

      public final String toString()
      Returns a string representation of this object. This is useful for testing and debugging. Sensitive data will be redacted from this string using a placeholder value.
      Overrides:
      toString in class Object

    • getValueForField

      public final <T> Optional<T> getValueForField(String fieldName, Class<T> clazz)

    • sdkFields

      public final List<SdkField<?>> sdkFields()
      Specified by:
      sdkFields in interface SdkPojo
      Returns:
      List of SdkField in this POJO. May be empty list but should never be null.