Aws/cloudtrail
@swamp/aws/cloudtrailv2026.10.25.1
01README
AWS CLOUDTRAIL infrastructure models
02Release Notes
- Updated: dashboard
03Behaviors
@swamp/aws/cloudtrail/channelv2026.10.23.1channel.ts
Global Arguments
| Argument | Type | Description |
|---|---|---|
| name | string | Instance name for this resource (used as the unique identifier in the factory pattern) |
| accessKeyId? | string | AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| secretAccessKey? | string | AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| sessionToken? | string | AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| region? | string | AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1. |
| Name? | string | The name of the channel. |
| Source? | string | The ARN of an on-premises storage solution or application, or a partner event source. |
| Destinations? | array | One or more resources to which events arriving through a channel are logged and stored. |
| Tags? | array | An array of key-value pairs to apply to this resource. |
fn create()
Create a CloudTrail Channel
fn get(identifier: string)
Get a CloudTrail Channel
| Argument | Type | Description |
|---|---|---|
| identifier | string | The primary identifier of the CloudTrail Channel |
fn update()
Update a CloudTrail Channel
fn delete(identifier: string)
Delete a CloudTrail Channel
| Argument | Type | Description |
|---|---|---|
| identifier | string | The primary identifier of the CloudTrail Channel |
fn sync()
Sync CloudTrail Channel state from AWS
fn list(maxPages?: number, resourceModel?: string)
List CloudTrail Channel resources
| Argument | Type | Description |
|---|---|---|
| maxPages? | number | Maximum number of pages to fetch (default: 10) |
| resourceModel? | string | JSON resource model for parent-scoped listing (e.g. parent identifier) |
Resources
state(infinite)— CloudTrail Channel resource state
@swamp/aws/cloudtrail/dashboardv2026.10.25.1dashboard.ts
Global Arguments
| Argument | Type | Description |
|---|---|---|
| name | string | Instance name for this resource (used as the unique identifier in the factory pattern) |
| accessKeyId? | string | AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| secretAccessKey? | string | AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| sessionToken? | string | AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| region? | string | AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1. |
| Widgets? | array | List of widgets on the dashboard |
| RefreshSchedule? | object | Configures the automatic refresh schedule for the dashboard. Includes the frequency unit (DAYS or HOURS) and value, as well as the status (ENABLED or DISABLED) of the refresh schedule. |
| Name? | string | The name of the dashboard. |
| TerminationProtectionEnabled? | boolean | Indicates whether the dashboard is protected from termination. |
| Tags? | array |
fn create()
Create a CloudTrail Dashboard
fn get(identifier: string)
Get a CloudTrail Dashboard
| Argument | Type | Description |
|---|---|---|
| identifier | string | The primary identifier of the CloudTrail Dashboard |
fn update()
Update a CloudTrail Dashboard
fn delete(identifier: string)
Delete a CloudTrail Dashboard
| Argument | Type | Description |
|---|---|---|
| identifier | string | The primary identifier of the CloudTrail Dashboard |
fn sync()
Sync CloudTrail Dashboard state from AWS
fn list(maxPages?: number, resourceModel?: string)
List CloudTrail Dashboard resources
| Argument | Type | Description |
|---|---|---|
| maxPages? | number | Maximum number of pages to fetch (default: 10) |
| resourceModel? | string | JSON resource model for parent-scoped listing (e.g. parent identifier) |
Resources
state(infinite)— CloudTrail Dashboard resource state
@swamp/aws/cloudtrail/event-data-storev2026.10.23.1event_data_store.ts
Global Arguments
| Argument | Type | Description |
|---|---|---|
| name | string | Instance name for this resource (used as the unique identifier in the factory pattern) |
| accessKeyId? | string | AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| secretAccessKey? | string | AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| sessionToken? | string | AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| region? | string | AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1. |
| AdvancedEventSelectors? | array | The advanced event selectors that were used to select events for the data store. |
| FederationEnabled? | boolean | Indicates whether federation is enabled on an event data store. |
| FederationRoleArn? | string | The ARN of the role used for event data store federation. |
| MultiRegionEnabled? | boolean | Indicates whether the event data store includes events from all regions, or only from the region in which it was created. |
| Name? | string | The name of the event data store. |
| OrganizationEnabled? | boolean | Indicates that an event data store is collecting logged events for an organization. |
| BillingMode? | string | The mode that the event data store will use to charge for event storage. |
| RetentionPeriod? | number | The retention period, in days. |
| TerminationProtectionEnabled? | boolean | Indicates whether the event data store is protected from termination. |
| KmsKeyId? | string | Specifies the KMS key ID to use to encrypt the events delivered by CloudTrail. The value can be an alias name prefixed by 'alias/', a fully specified ARN to an alias, a fully specified ARN to a key, or a globally unique identifier. |
| Tags? | array | |
| InsightSelectors? | array | Lets you enable Insights event logging by specifying the Insights selectors that you want to enable on an existing event data store. Both InsightSelectors and InsightsDestination need to have a value in order to enable Insights events on an event data store. |
| InsightsDestination? | string | Specifies the ARN of the event data store that will collect Insights events. Both InsightSelectors and InsightsDestination need to have a value in order to enable Insights events on an event data store |
| MaxEventSize? | enum | Specifies the maximum size allowed for the event. Valid values are Standard and Large. If you add ContextKeySelectors, this value must be set to Large. |
| ContextKeySelectors? | array | An array that enriches event records in an existing event data store by including additional information specified in individual ContexKeySelector entries. If you add ContextKeySelectors, you must set MaxEventSize to Large. |
| IngestionEnabled? | boolean | Indicates whether the event data store is ingesting events. |
fn create()
Create a CloudTrail EventDataStore
fn get(identifier: string)
Get a CloudTrail EventDataStore
| Argument | Type | Description |
|---|---|---|
| identifier | string | The primary identifier of the CloudTrail EventDataStore |
fn update()
Update a CloudTrail EventDataStore
fn delete(identifier: string)
Delete a CloudTrail EventDataStore
| Argument | Type | Description |
|---|---|---|
| identifier | string | The primary identifier of the CloudTrail EventDataStore |
fn sync()
Sync CloudTrail EventDataStore state from AWS
fn list(maxPages?: number, resourceModel?: string)
List CloudTrail EventDataStore resources
| Argument | Type | Description |
|---|---|---|
| maxPages? | number | Maximum number of pages to fetch (default: 10) |
| resourceModel? | string | JSON resource model for parent-scoped listing (e.g. parent identifier) |
Resources
state(infinite)— CloudTrail EventDataStore resource state
@swamp/aws/cloudtrail/resource-policyv2026.10.23.1resource_policy.ts
Global Arguments
| Argument | Type | Description |
|---|---|---|
| accessKeyId? | string | AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| secretAccessKey? | string | AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| sessionToken? | string | AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| region? | string | AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1. |
| ResourceArn | string | The ARN of the AWS CloudTrail resource to which the policy applies. |
| ResourcePolicy | record | A policy document containing permissions to add to the specified resource. In IAM, you must provide policy documents in JSON format. However, in CloudFormation you can provide the policy in JSON or YAML format because CloudFormation converts YAML to JSON before submitting it to IAM. |
fn create()
Create a CloudTrail ResourcePolicy
fn get(identifier: string)
Get a CloudTrail ResourcePolicy
| Argument | Type | Description |
|---|---|---|
| identifier | string | The primary identifier of the CloudTrail ResourcePolicy |
fn update()
Update a CloudTrail ResourcePolicy
fn delete(identifier: string)
Delete a CloudTrail ResourcePolicy
| Argument | Type | Description |
|---|---|---|
| identifier | string | The primary identifier of the CloudTrail ResourcePolicy |
fn sync()
Sync CloudTrail ResourcePolicy state from AWS
Resources
state(infinite)— CloudTrail ResourcePolicy resource state
@swamp/aws/cloudtrail/trailv2026.10.23.1trail.ts
Global Arguments
| Argument | Type | Description |
|---|---|---|
| accessKeyId? | string | AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| secretAccessKey? | string | AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| sessionToken? | string | AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| region? | string | AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1. |
| CloudWatchLogsLogGroupArn? | string | Specifies a log group name using an Amazon Resource Name (ARN), a unique identifier that represents the log group to which CloudTrail logs will be delivered. Not required unless you specify CloudWatchLogsRoleArn. |
| CloudWatchLogsRoleArn? | string | Specifies the role for the CloudWatch Logs endpoint to assume to write to a user's log group. |
| EnableLogFileValidation? | boolean | Specifies whether log file validation is enabled. The default is false. |
| AdvancedEventSelectors? | array | The advanced event selectors that were used to select events for the data store. |
| EventSelectors? | array | Use event selectors to further specify the management and data event settings for your trail. By default, trails created without specific event selectors will be configured to log all read and write management events, and no data events. When an event occurs in your account, CloudTrail evaluates the event selector for all trails. For each trail, if the event matches any event selector, the trail processes and logs the event. If the event doesn't match any event selector, the trail doesn't log th |
| IncludeGlobalServiceEvents? | boolean | Specifies whether the trail is publishing events from global services such as IAM to the log files. |
| IsLogging | boolean | Whether the CloudTrail is currently logging AWS API calls. |
| IsMultiRegionTrail? | boolean | Specifies whether the trail applies only to the current region or to all regions. The default is false. If the trail exists only in the current region and this value is set to true, shadow trails (replications of the trail) will be created in the other regions. If the trail exists in all regions and this value is set to false, the trail will remain in the region where it was created, and its shadow trails in other regions will be deleted. As a best practice, consider using trails that log events |
| IsOrganizationTrail? | boolean | Specifies whether the trail is created for all accounts in an organization in AWS Organizations, or only for the current AWS account. The default is false, and cannot be true unless the call is made on behalf of an AWS account that is the master account for an organization in AWS Organizations. |
| KMSKeyId? | string | Specifies the KMS key ID to use to encrypt the logs delivered by CloudTrail. The value can be an alias name prefixed by 'alias/', a fully specified ARN to an alias, a fully specified ARN to a key, or a globally unique identifier. |
| S3BucketName | string | Specifies the name of the Amazon S3 bucket designated for publishing log files. See Amazon S3 Bucket Naming Requirements. |
| S3KeyPrefix? | string | Specifies the Amazon S3 key prefix that comes after the name of the bucket you have designated for log file delivery. For more information, see Finding Your CloudTrail Log Files. The maximum length is 200 characters. |
| SnsTopicName? | string | Specifies the name of the Amazon SNS topic defined for notification of log file delivery. The maximum length is 256 characters. |
| Tags? | array | |
| TrailName? | string | |
| InsightSelectors? | array | Lets you enable Insights event logging by specifying the Insights selectors that you want to enable on an existing trail. |
| AggregationConfigurations? | array | Specifies the aggregation configuration to aggregate CloudTrail Events. A maximum of 1 aggregation configuration is allowed. |
fn create()
Create a CloudTrail Trail
fn get(identifier: string)
Get a CloudTrail Trail
| Argument | Type | Description |
|---|---|---|
| identifier | string | The primary identifier of the CloudTrail Trail |
fn update()
Update a CloudTrail Trail
fn delete(identifier: string)
Delete a CloudTrail Trail
| Argument | Type | Description |
|---|---|---|
| identifier | string | The primary identifier of the CloudTrail Trail |
fn sync()
Sync CloudTrail Trail state from AWS
fn list(maxPages?: number, resourceModel?: string)
List CloudTrail Trail resources
| Argument | Type | Description |
|---|---|---|
| maxPages? | number | Maximum number of pages to fetch (default: 10) |
| resourceModel? | string | JSON resource model for parent-scoped listing (e.g. parent identifier) |
Resources
state(infinite)— CloudTrail Trail resource state
04Previous Versions
2026.10.24.1AGPL-3.0-or-later
2026.10.23.1AGPL-3.0-or-later(was none)
- Updated: channel, dashboard, event_data_store, resource_policy, trail
2026.10.13.1
- Updated: channel, dashboard, event_data_store, resource_policy, trail
2026.10.08.1
2026.10.06.1
2026.10.04.1
2026.10.03.1
2026.10.02.1
2026.10.01.1
2026.09.30.1
2026.09.29.1
2026.09.28.1
2026.09.27.1
2026.09.26.1
2026.09.25.1
2026.09.24.1
2026.09.23.1
2026.09.21.1
2026.09.20.1
05Stats
A
100 / 100
Downloads
81
Archive size
1.0 MB
Verified by Swamp
- Has README or module doc2/2earned
- README has a code example1/1earned
- README is substantive1/1earned
- Most symbols documented1/1earned
- No slow types (deprecated)1/1earned
- Dependencies pass trust audit2/2earned
- Docs keep secrets in a vault1/1earned
- Has description1/1earned
- Platform support declared (or universal)2/2earned
- License2/2earned
- Verified public repository2/2earned
06Platforms
07Labels