# CfnEventDataStore

Creates a new event data store.

Extends: Construct › CfnElement › CfnRefElement › CfnResource › CfnEventDataStore
Implements: IInspectable, ITaggable, IEnvironmentAware, IEventDataStoreRef, IConstruct, IDependable

- CloudFormation: [`AWS::CloudTrail::EventDataStore`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-cloudtrail-eventdatastore.html)
- Source: Generated code
- Type last changed: v2.252.0 · 30 Apr 2026

## Example

```ts
// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import { aws_cloudtrail as cloudtrail } from 'aws-cdk-lib';
const cfnEventDataStore = new cloudtrail.CfnEventDataStore(this, 'MyCfnEventDataStore', /* all optional props */ {
  advancedEventSelectors: [{
    fieldSelectors: [{
      field: 'field',

      // the properties below are optional
      endsWith: ['endsWith'],
      equalTo: ['equalTo'],
      notEndsWith: ['notEndsWith'],
      notEquals: ['notEquals'],
      notStartsWith: ['notStartsWith'],
      startsWith: ['startsWith'],
    }],

    // the properties below are optional
    name: 'name',
  }],
  billingMode: 'billingMode',
  contextKeySelectors: [{
    equalTo: ['equalTo'],
    type: 'type',
  }],
  federationEnabled: false,
  federationRoleArn: 'federationRoleArn',
  ingestionEnabled: false,
  insightsDestination: 'insightsDestination',
  insightSelectors: [{
    insightType: 'insightType',
  }],
  kmsKeyId: 'kmsKeyId',
  maxEventSize: 'maxEventSize',
  multiRegionEnabled: false,
  name: 'name',
  organizationEnabled: false,
  retentionPeriod: 123,
  tags: [{
    key: 'key',
    value: 'value',
  }],
  terminationProtectionEnabled: false,
});
```

## Initializer

```ts
new CfnEventDataStore(scope: Construct, id: string, props?: CfnEventDataStoreProps)
```

## Construct Props

- `advancedEventSelectors`: [IResolvable](/cdk/api/v2/docs/aws-cdk-lib.IResolvable.html) | [IResolvable](/cdk/api/v2/docs/aws-cdk-lib.IResolvable.html) | [CfnEventDataStore.AdvancedEventSelectorProperty](/cdk/api/v2/docs/aws-cdk-lib.aws_cloudtrail.CfnEventDataStore.AdvancedEventSelectorProperty.html)[] — The advanced event selectors to use to select the events for the data store.

  You can configure up to five advanced event selectors for each event data store.

  For more information about how to use advanced event selectors to log CloudTrail events, see [Log events by using advanced event selectors](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html#creating-data-event-selectors-advanced) in the CloudTrail User Guide.

  For more information about how to use advanced event selectors to include AWS Config configuration items in your event data store, see [Create an event data store for AWS Config configuration items](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/lake-eds-cli.html#lake-cli-create-eds-config) in the CloudTrail User Guide.

  For more information about how to use advanced event selectors to include events outside of AWS events in your event data store, see [Create an integration to log events from outside AWS](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/lake-integrations-cli.html#lake-cli-create-integration) in the CloudTrail User Guide.

- `billingMode`: string — The billing mode for the event data store determines the cost for ingesting events and the default and maximum retention period for the event data store.

  The following are the possible values:

  - `EXTENDABLE_RETENTION_PRICING` - This billing mode is generally recommended if you want a flexible retention period of up to 3653 days (about 10 years). The default retention period for this billing mode is 366 days.
  - `FIXED_RETENTION_PRICING` - This billing mode is recommended if you expect to ingest more than 25 TB of event data per month and need a retention period of up to 2557 days (about 7 years). The default retention period for this billing mode is 2557 days.

  The default value is `EXTENDABLE_RETENTION_PRICING` .

  For more information about CloudTrail pricing, see [AWS CloudTrail Pricing](https://docs.aws.amazon.com/cloudtrail/pricing/) and [Managing CloudTrail Lake costs](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-lake-manage-costs.html) .

- `contextKeySelectors`: [IResolvable](/cdk/api/v2/docs/aws-cdk-lib.IResolvable.html) | [IResolvable](/cdk/api/v2/docs/aws-cdk-lib.IResolvable.html) | [CfnEventDataStore.ContextKeySelectorProperty](/cdk/api/v2/docs/aws-cdk-lib.aws_cloudtrail.CfnEventDataStore.ContextKeySelectorProperty.html)[] — The list of context key selectors that are configured for the event data store.

- `federationEnabled`: boolean | [IResolvable](/cdk/api/v2/docs/aws-cdk-lib.IResolvable.html) — Indicates if [Lake query federation](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/query-federation.html) is enabled. By default, Lake query federation is disabled. You cannot delete an event data store if Lake query federation is enabled.

- `federationRoleArn`: string — If Lake query federation is enabled, provides the ARN of the federation role used to access the resources for the federated event data store.

  The federation role must exist in your account and provide the [required minimum permissions](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/query-federation.html#query-federation-permissions-role) .

- `ingestionEnabled`: boolean | [IResolvable](/cdk/api/v2/docs/aws-cdk-lib.IResolvable.html) — Specifies whether the event data store should start ingesting live events.

  The default is true.

- `insightsDestination`: string — The ARN (or ID suffix of the ARN) of the destination event data store that logs Insights events.

  For more information, see [Create an event data store for CloudTrail Insights events](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/query-event-data-store-insights.html) .

- `insightSelectors`: [IResolvable](/cdk/api/v2/docs/aws-cdk-lib.IResolvable.html) | [IResolvable](/cdk/api/v2/docs/aws-cdk-lib.IResolvable.html) | [CfnEventDataStore.InsightSelectorProperty](/cdk/api/v2/docs/aws-cdk-lib.aws_cloudtrail.CfnEventDataStore.InsightSelectorProperty.html)[] — A JSON string that contains the Insights types you want to log on an event data store.

  `ApiCallRateInsight` and `ApiErrorRateInsight` are valid Insight types.

  The `ApiCallRateInsight` Insights type analyzes write-only management API calls that are aggregated per minute against a baseline API call volume.

  The `ApiErrorRateInsight` Insights type analyzes management API calls that result in error codes. The error is shown if the API call is unsuccessful.

- `kmsKeyId`: string — Specifies the AWS key ID to use to encrypt the events delivered by CloudTrail.

  The value can be an alias name prefixed by `alias/` , a fully specified ARN to an alias, a fully specified ARN to a key, or a globally unique identifier.

  > Disabling or deleting the KMS key, or removing CloudTrail permissions on the key, prevents CloudTrail from logging events to the event data store, and prevents users from querying the data in the event data store that was encrypted with the key. After you associate an event data store with a KMS key, the KMS key cannot be removed or changed. Before you disable or delete a KMS key that you are using with an event data store, delete or back up your event data store.

  CloudTrail also supports AWS  multi-Region keys. For more information about multi-Region keys, see [Using multi-Region keys](https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html) in the *AWS Key Management Service Developer Guide* .

  Examples:

  - `alias/MyAliasName`
  - `arn:aws:kms:us-east-2:123456789012:alias/MyAliasName`
  - `arn:aws:kms:us-east-2:123456789012:key/12345678-1234-1234-1234-123456789012`
  - `12345678-1234-1234-1234-123456789012`

- `maxEventSize`: string — The maximum allowed size for events to be stored in the specified event data store.

  If you are using context key selectors, MaxEventSize must be set to Large.

- `multiRegionEnabled`: boolean | [IResolvable](/cdk/api/v2/docs/aws-cdk-lib.IResolvable.html) — Specifies whether the event data store includes events from all Regions, or only from the Region in which the event data store is created.

- `name`: string — The name of the event data store.

- `organizationEnabled`: boolean | [IResolvable](/cdk/api/v2/docs/aws-cdk-lib.IResolvable.html) — Specifies whether an event data store collects events logged for an organization in AWS Organizations .

- `retentionPeriod`: number — The retention period of the event data store, in days.

  If `BillingMode` is set to `EXTENDABLE_RETENTION_PRICING` , you can set a retention period of up to 3653 days, the equivalent of 10 years. If `BillingMode` is set to `FIXED_RETENTION_PRICING` , you can set a retention period of up to 2557 days, the equivalent of seven years.

  CloudTrail Lake determines whether to retain an event by checking if the `eventTime` of the event is within the specified retention period. For example, if you set a retention period of 90 days, CloudTrail will remove events when the `eventTime` is older than 90 days.

  > If you plan to copy trail events to this event data store, we recommend that you consider both the age of the events that you want to copy as well as how long you want to keep the copied events in your event data store. For example, if you copy trail events that are 5 years old and specify a retention period of 7 years, the event data store will retain those events for two years.

- `tags`: [CfnTag](/cdk/api/v2/docs/aws-cdk-lib.CfnTag.html)[] — A list of tags.

- `terminationProtectionEnabled`: boolean | [IResolvable](/cdk/api/v2/docs/aws-cdk-lib.IResolvable.html) — Specifies whether termination protection is enabled for the event data store.

  If termination protection is enabled, you cannot delete the event data store until termination protection is disabled.

## Properties

- `advancedEventSelectors`: [IResolvable](/cdk/api/v2/docs/aws-cdk-lib.IResolvable.html) | [IResolvable](/cdk/api/v2/docs/aws-cdk-lib.IResolvable.html) | [CfnEventDataStore.AdvancedEventSelectorProperty](/cdk/api/v2/docs/aws-cdk-lib.aws_cloudtrail.CfnEventDataStore.AdvancedEventSelectorProperty.html)[] — The advanced event selectors to use to select the events for the data store.

- `attrCreatedTimestamp`: string — `Ref` returns the time stamp of the creation of the event data store, such as `1248496624` .

- `attrEventDataStoreArn`: string — `Ref` returns the ARN of the CloudTrail event data store, such as `arn:aws:cloudtrail:us-east-1:12345678910:eventdatastore/EXAMPLE-f852-4e8f-8bd1-bcf6cEXAMPLE` .

- `attrStatus`: string — `Ref` returns the status of the event data store, such as `ENABLED` .

- `attrUpdatedTimestamp`: string — `Ref` returns the time stamp that updates were made to an event data store, such as `1598296624` .

- `billingMode`: string — The billing mode for the event data store determines the cost for ingesting events and the default and maximum retention period for the event data store.

- `CFN_RESOURCE_TYPE_NAME`: string (static) — The CloudFormation resource type name for this resource class.

- `cfnOptions`: [ICfnResourceOptions](/cdk/api/v2/docs/aws-cdk-lib.ICfnResourceOptions.html) — Options for this resource, such as condition, update policy etc.

- `cfnResourceType`: string — AWS resource type.

- `contextKeySelectors`: [IResolvable](/cdk/api/v2/docs/aws-cdk-lib.IResolvable.html) | [IResolvable](/cdk/api/v2/docs/aws-cdk-lib.IResolvable.html) | [CfnEventDataStore.ContextKeySelectorProperty](/cdk/api/v2/docs/aws-cdk-lib.aws_cloudtrail.CfnEventDataStore.ContextKeySelectorProperty.html)[] — The list of context key selectors that are configured for the event data store.

- `creationStack`: string[]

- `env`: [ResourceEnvironment](/cdk/api/v2/docs/aws-cdk-lib.interfaces.ResourceEnvironment.html)

- `eventDataStoreRef`: [EventDataStoreReference](/cdk/api/v2/docs/aws-cdk-lib.interfaces.aws_cloudtrail.EventDataStoreReference.html) — A reference to a EventDataStore resource.

- `federationEnabled`: boolean | [IResolvable](/cdk/api/v2/docs/aws-cdk-lib.IResolvable.html) — Indicates if [Lake query federation](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/query-federation.html) is enabled. By default, Lake query federation is disabled. You cannot delete an event data store if Lake query federation is enabled.

- `federationRoleArn`: string — If Lake query federation is enabled, provides the ARN of the federation role used to access the resources for the federated event data store.

- `ingestionEnabled`: boolean | [IResolvable](/cdk/api/v2/docs/aws-cdk-lib.IResolvable.html) — Specifies whether the event data store should start ingesting live events.

- `insightsDestination`: string — The ARN (or ID suffix of the ARN) of the destination event data store that logs Insights events.

- `insightSelectors`: [IResolvable](/cdk/api/v2/docs/aws-cdk-lib.IResolvable.html) | [IResolvable](/cdk/api/v2/docs/aws-cdk-lib.IResolvable.html) | [CfnEventDataStore.InsightSelectorProperty](/cdk/api/v2/docs/aws-cdk-lib.aws_cloudtrail.CfnEventDataStore.InsightSelectorProperty.html)[] — A JSON string that contains the Insights types you want to log on an event data store.

- `kmsKeyId`: string — Specifies the AWS key ID to use to encrypt the events delivered by CloudTrail.

- `logicalId`: string — The logical ID for this CloudFormation stack element.

  The logical ID of the element
  is calculated from the path of the resource node in the construct tree.

  To override this value, use `overrideLogicalId(newLogicalId)`.

- `maxEventSize`: string — The maximum allowed size for events to be stored in the specified event data store.

- `multiRegionEnabled`: boolean | [IResolvable](/cdk/api/v2/docs/aws-cdk-lib.IResolvable.html) — Specifies whether the event data store includes events from all Regions, or only from the Region in which the event data store is created.

- `name`: string — The name of the event data store.

- `node`: [Node](/cdk/api/v2/docs/constructs.Node.html) — The tree node.

- `organizationEnabled`: boolean | [IResolvable](/cdk/api/v2/docs/aws-cdk-lib.IResolvable.html) — Specifies whether an event data store collects events logged for an organization in AWS Organizations .

- `ref`: string — Return a string that will be resolved to a CloudFormation `{ Ref }` for this element.

  If, by any chance, the intrinsic reference of a resource is not a string, you could
  coerce it to an IResolvable through `Lazy.any({ produce: resource.ref })`.

- `retentionPeriod`: number — The retention period of the event data store, in days.

- `stack`: [Stack](/cdk/api/v2/docs/aws-cdk-lib.Stack.html) — The stack in which this element is defined.

  CfnElements must be defined within a stack scope (directly or indirectly).

- `tags`: [TagManager](/cdk/api/v2/docs/aws-cdk-lib.TagManager.html) — Tag Manager which manages the tags for this resource.

- `tagsRaw`: [CfnTag](/cdk/api/v2/docs/aws-cdk-lib.CfnTag.html)[] — A list of tags.

- `terminationProtectionEnabled`: boolean | [IResolvable](/cdk/api/v2/docs/aws-cdk-lib.IResolvable.html) — Specifies whether termination protection is enabled for the event data store.

## Methods

- `addDeletionOverride(path: string): void` — Syntactic sugar for `addOverride(path, undefined)`.

  **Parameters**

  - `path` — The path of the value to delete.

- `addDependency(target: CfnResource): void` — Use `addResourceDependency` instead.

  This method has been renamed to `addResourceDependency` to more clearly
  set it apart from `construct.node.addDependency`. See the documentation
  of that function for more details.

- `addDependsOn(target: CfnResource): void` — Use `addResourceDependency` instead.

  This can be used for resources across stacks (or nested stack) boundaries
  and the dependency will automatically be transferred to the relevant scope.

  This method has been renamed to `addResourceDependency`, which makes it
  more clear that this method operates at a different level from the
  construct-level `construct.node.addDependency()` mechanism.

- `addMetadata(key: string, value: any): void` — Add a value to the CloudFormation Resource Metadata.

- `addOverride(path: string, value: any): void` — Adds an override to the synthesized CloudFormation resource.

  To add a
  property override, either use `addPropertyOverride` or prefix `path` with
  "Properties." (i.e. `Properties.TopicName`).

  If the override is nested, separate each nested level using a dot (.) in the path parameter.
  If there is an array as part of the nesting, specify the index in the path.

  To include a literal `.` in the property name, prefix with a `\`. In most
  programming languages you will need to write this as `"\\."` because the
  `\` itself will need to be escaped.

  For example,
  ```typescript
  cfnResource.addOverride('Properties.GlobalSecondaryIndexes.0.Projection.NonKeyAttributes', ['myattribute']);
  cfnResource.addOverride('Properties.GlobalSecondaryIndexes.1.ProjectionType', 'INCLUDE');
  ```
  would add the overrides
  ```json
  "Properties": {
    "GlobalSecondaryIndexes": [
      {
        "Projection": {
          "NonKeyAttributes": [ "myattribute" ]
          ...
        }
        ...
      },
      {
        "ProjectionType": "INCLUDE"
        ...
      },
    ]
    ...
  }
  ```

  The `value` argument to `addOverride` will not be processed or translated
  in any way. Pass raw JSON values in here with the correct capitalization
  for CloudFormation. If you pass CDK classes or structs, they will be
  rendered with lowercased key names, and CloudFormation will reject the
  template.

  **Parameters**

  - `path` — - The path of the property, you can use dot notation to override values in complex types.
  - `value` — - The value.

- `addPropertyDeletionOverride(propertyPath: string): void` — Adds an override that deletes the value of a property from the resource definition.

  **Parameters**

  - `propertyPath` — The path to the property.

- `addPropertyOverride(propertyPath: string, value: any): void` — Adds an override to a resource property.

  Syntactic sugar for `addOverride("Properties.<...>", value)`.

  **Parameters**

  - `propertyPath` — The path of the property.
  - `value` — The value.

- `addResourceDependency(target: CfnResource, reason?: string): void` — Indicates that this resource depends on another resource and cannot be provisioned unless the other resource has been successfully provisioned.

  This can be used for resources across stacks (or nested stack) boundaries
  and the dependency will automatically be transferred to the relevant scope.

  This method only adds dependencies between L1 resources. If you are
  looking for a generic construct-to-construct dependency mechanism that works
  for all constructs including L2s, use `construct.node.addDependency` instead.

- `applyCrossStackReferenceStrength(strength: ReferenceStrength): void` — Sets the cross-stack reference strength for this resource.

  When set, any cross-stack reference to this resource will use the specified
  strength instead of the global default from the consuming stack's context.

  **Parameters**

  - `strength` — - The reference strength to use for this resource.

- `applyRemovalPolicy(policy?: RemovalPolicy, options?: RemovalPolicyOptions): void` — Sets the deletion policy of the resource based on the removal policy specified.

  The Removal Policy controls what happens to this resource when it stops
  being managed by CloudFormation, either because you've removed it from the
  CDK application or because you've made a change that requires the resource
  to be replaced.

  The resource can be deleted (`RemovalPolicy.DESTROY`), or left in your AWS
  account for data recovery and cleanup later (`RemovalPolicy.RETAIN`). In some
  cases, a snapshot can be taken of the resource prior to deletion
  (`RemovalPolicy.SNAPSHOT`). A list of resources that support this policy
  can be found in the following link:

- `arnForEventDataStore(resource: IEventDataStoreRef): string` (static)

- `cfnPropertyName(cdkPropertyName: string): string`

- `getAtt(attributeName: string, typeHint?: ResolutionTypeHint): Reference` — Returns a token for an runtime attribute of this resource.

  Ideally, use generated attribute accessors (e.g. `resource.arn`), but this can be used for future compatibility
  in case there is no generated attribute.

  **Parameters**

  - `attributeName` — The name of the attribute.

- `getMetadata(key: string): any` — Retrieve a value value from the CloudFormation Resource Metadata.

- `inspect(inspector: TreeInspector): void` — Examines the CloudFormation resource and discloses attributes.

  **Parameters**

  - `inspector` — tree inspector to collect and process attributes.

- `isCfnElement(x: any): boolean` (static) — Returns `true` if a construct is a stack element (i.e. part of the synthesized cloudformation template).

  Uses duck-typing instead of `instanceof` to allow stack elements from different
  versions of this library to be included in the same stack.

  **Returns:** The construct as a stack element or undefined if it is not a stack element.

- `isCfnEventDataStore(x: any): boolean` (static) — Checks whether the given object is a CfnEventDataStore.

- `isCfnResource(x: any): boolean` (static) — Check whether the given object is a CfnResource.

- `isConstruct(x: any): boolean` (static) — Checks if `x` is a construct.

  Use this method instead of `instanceof` to properly detect `Construct`
  instances, even when the construct library is symlinked.

  Explanation: in JavaScript, multiple copies of the `constructs` library on
  disk are seen as independent, completely different libraries. As a
  consequence, the class `Construct` in each copy of the `constructs` library
  is seen as a different class, and an instance of one class will not test as
  `instanceof` the other class. `npm install` will not create installations
  like this, but users may manually symlink construct libraries together or
  use a monorepo tool: in those cases, multiple copies of the `constructs`
  library can be accidentally installed, and `instanceof` will behave
  unpredictably. It is safest to avoid using `instanceof`, and using
  this type-testing method instead.

  **Parameters**

  - `x` — Any object.

  **Returns:** true if `x` is an object created from a class which extends `Construct`.

- `obtainDependencies(): Stack | CfnResource[]` — Retrieves an array of resources and stacks this resource depends on.

  For resources depended on directly, returns the `CfnResource` object. For
  dependencies on other stacks, returns the `Stack` object. The order of the
  array is not guaranteed.

- `overrideLogicalId(newLogicalId: string): void` — Overrides the auto-generated logical ID with a specific ID.

  **Parameters**

  - `newLogicalId` — The new logical ID to use for this stack element.

- `removeDependency(target: CfnResource): void` — Use `removeResourceDependency` instead

  This can be used for resources across stacks (including nested stacks)
  and the dependency will automatically be removed from the relevant scope.

- `removeResourceDependency(target: CfnResource): void` — Indicates that this resource no longer depends on another resource.

  This can be used for resources across stacks (including nested stacks)
  and the dependency will automatically be removed from the relevant scope.

- `replaceDependency(target: CfnResource, newTarget: CfnResource): void` — Replaces one dependency with another.

  **Parameters**

  - `target` — The dependency to replace.
  - `newTarget` — The new dependency to add.

- `toString(): string` — Returns a string representation of this construct.

  **Returns:** a string representation of this resource

- `with(...mixins: IMixin[]): IConstruct` — Applies one or more mixins to this construct.

  Mixins are applied in order. The list of constructs is captured at the
  start of the call, so constructs added by a mixin will not be visited.
  Use multiple `with()` calls if subsequent mixins should apply to added
  constructs.