Package software.amazon.awscdk.services.cloudtrail

Class CfnTrail

java.lang.Object

software.amazon.jsii.JsiiObject

software.constructs.Construct

software.amazon.awscdk.CfnElement

software.amazon.awscdk.CfnRefElement

software.amazon.awscdk.CfnResource

software.amazon.awscdk.services.cloudtrail.CfnTrail

All Implemented Interfaces:

IInspectable, ITaggable, ITrailRef, software.amazon.jsii.JsiiSerializable, software.constructs.IConstruct, software.constructs.IDependable

@Generated(value="jsii-pacmak/1.113.0 (build fc68b25)",
           date="2025-10-14T12:28:06.998Z")
@Stability(Stable)
public class CfnTrail
extends CfnResource
implements IInspectable, ITrailRef, ITaggable

Creates a trail that specifies the settings for delivery of log data to an Amazon S3 bucket.

Example:

 // The code below shows an example of how to instantiate this type.
 // The values are placeholders you should change.
 import software.amazon.awscdk.services.cloudtrail.*;
 CfnTrail cfnTrail = CfnTrail.Builder.create(this, "MyCfnTrail")
         .isLogging(false)
         .s3BucketName("s3BucketName")
         // the properties below are optional
         .advancedEventSelectors(List.of(AdvancedEventSelectorProperty.builder()
                 .fieldSelectors(List.of(AdvancedFieldSelectorProperty.builder()
                         .field("field")
                         // the properties below are optional
                         .endsWith(List.of("endsWith"))
                         .equalTo(List.of("equalTo"))
                         .notEndsWith(List.of("notEndsWith"))
                         .notEquals(List.of("notEquals"))
                         .notStartsWith(List.of("notStartsWith"))
                         .startsWith(List.of("startsWith"))
                         .build()))
                 // the properties below are optional
                 .name("name")
                 .build()))
         .cloudWatchLogsLogGroupArn("cloudWatchLogsLogGroupArn")
         .cloudWatchLogsRoleArn("cloudWatchLogsRoleArn")
         .enableLogFileValidation(false)
         .eventSelectors(List.of(EventSelectorProperty.builder()
                 .dataResources(List.of(DataResourceProperty.builder()
                         .type("type")
                         // the properties below are optional
                         .values(List.of("values"))
                         .build()))
                 .excludeManagementEventSources(List.of("excludeManagementEventSources"))
                 .includeManagementEvents(false)
                 .readWriteType("readWriteType")
                 .build()))
         .includeGlobalServiceEvents(false)
         .insightSelectors(List.of(InsightSelectorProperty.builder()
                 .insightType("insightType")
                 .build()))
         .isMultiRegionTrail(false)
         .isOrganizationTrail(false)
         .kmsKeyId("kmsKeyId")
         .s3KeyPrefix("s3KeyPrefix")
         .snsTopicName("snsTopicName")
         .tags(List.of(CfnTag.builder()
                 .key("key")
                 .value("value")
                 .build()))
         .trailName("trailName")
         .build();
 

See Also:

• http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudtrail-trail.html

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static interface	CfnTrail.AdvancedEventSelectorProperty	Advanced event selectors let you create fine-grained selectors for AWS CloudTrail management, data, and network activity events.
static interface	CfnTrail.AdvancedFieldSelectorProperty	A single selector statement in an advanced event selector.
static final class	CfnTrail.Builder	A fluent builder for CfnTrail.
static interface	CfnTrail.DataResourceProperty	You can configure the DataResource in an EventSelector to log data events for the following three resource types:.
static interface	CfnTrail.EventSelectorProperty	Use event selectors to further specify the management and data event settings for your trail.
static interface	CfnTrail.InsightSelectorProperty	A JSON string that contains a list of Insights types that are logged on a trail.

Nested classes/interfaces inherited from class software.amazon.jsii.JsiiObject

software.amazon.jsii.JsiiObject.InitializationMode

Nested classes/interfaces inherited from interface software.constructs.IConstruct

software.constructs.IConstruct.Jsii$Default

Nested classes/interfaces inherited from interface software.amazon.awscdk.IInspectable

IInspectable.Jsii$Default, IInspectable.Jsii$Proxy

Nested classes/interfaces inherited from interface software.amazon.awscdk.ITaggable

ITaggable.Jsii$Default, ITaggable.Jsii$Proxy

Nested classes/interfaces inherited from interface software.amazon.awscdk.services.cloudtrail.ITrailRef

ITrailRef.Jsii$Default, ITrailRef.Jsii$Proxy

Field Summary

Fields

Modifier and Type	Field	Description
static final String	CFN_RESOURCE_TYPE_NAME	The CloudFormation resource type name for this resource class.

Constructor Summary

Constructors

Modifier	Constructor	Description
protected	CfnTrail(software.amazon.jsii.JsiiObject.InitializationMode initializationMode)
protected	CfnTrail(software.amazon.jsii.JsiiObjectRef objRef)
	CfnTrail(software.constructs.Construct scope, String id, CfnTrailProps props)

Method Summary

Modifier and Type	Method	Description
static ITrailRef	fromTrailArn(software.constructs.Construct scope, String id, String arn)	Creates a new ITrailRef from an ARN.
static ITrailRef	fromTrailName(software.constructs.Construct scope, String id, String trailName)	Creates a new ITrailRef from a trailName.
Object	getAdvancedEventSelectors()	Specifies the settings for advanced event selectors.
String	getAttrArn()	Ref returns the ARN of the CloudTrail trail, such as arn:aws:cloudtrail:us-east-2:123456789012:trail/myCloudTrail .
String	getAttrSnsTopicArn()	Ref returns the ARN of the Amazon SNS topic that's associated with the CloudTrail trail, such as arn:aws:sns:us-east-2:123456789012:mySNSTopic .
protected Map<String,Object>	getCfnProperties()
String	getCloudWatchLogsLogGroupArn()	Specifies a log group name using an Amazon Resource Name (ARN), a unique identifier that represents the log group to which CloudTrail logs are delivered.
String	getCloudWatchLogsRoleArn()	Specifies the role for the CloudWatch Logs endpoint to assume to write to a user's log group.
Object	getEnableLogFileValidation()	Specifies whether log file validation is enabled.
Object	getEventSelectors()	Use event selectors to further specify the management and data event settings for your trail.
Object	getIncludeGlobalServiceEvents()	Specifies whether the trail is publishing events from global services such as IAM to the log files.
Object	getInsightSelectors()	A JSON string that contains the Insights types you want to log on a trail.
Object	getIsLogging()	Whether the CloudTrail trail is currently logging AWS API calls.
Object	getIsMultiRegionTrail()	Specifies whether the trail applies only to the current Region or to all Regions.
Object	getIsOrganizationTrail()	Specifies whether the trail is applied to all accounts in an organization in AWS Organizations , or only for the current AWS account .
String	getKmsKeyId()	Specifies the AWS KMS key ID to use to encrypt the logs and digest files delivered by CloudTrail.
String	getS3BucketName()	Specifies the name of the Amazon S3 bucket designated for publishing log files.
String	getS3KeyPrefix()	Specifies the Amazon S3 key prefix that comes after the name of the bucket you have designated for log file delivery.
String	getSnsTopicName()	Specifies the name or ARN of the Amazon SNS topic defined for notification of log file delivery.
TagManager	getTags()	Tag Manager which manages the tags for this resource.
List<CfnTag>	getTagsRaw()	A custom set of tags (key-value pairs) for this trail.
String	getTrailName()	Specifies the name of the trail.
TrailReference	getTrailRef()	A reference to a Trail resource.
void	inspect(TreeInspector inspector)	Examines the CloudFormation resource and discloses attributes.
protected Map<String,Object>	renderProperties(Map<String,Object> props)
void	setAdvancedEventSelectors(List<Object> value)	Specifies the settings for advanced event selectors.
void	setAdvancedEventSelectors(IResolvable value)	Specifies the settings for advanced event selectors.
void	setCloudWatchLogsLogGroupArn(String value)	Specifies a log group name using an Amazon Resource Name (ARN), a unique identifier that represents the log group to which CloudTrail logs are delivered.
void	setCloudWatchLogsRoleArn(String value)	Specifies the role for the CloudWatch Logs endpoint to assume to write to a user's log group.
void	setEnableLogFileValidation(Boolean value)	Specifies whether log file validation is enabled.
void	setEnableLogFileValidation(IResolvable value)	Specifies whether log file validation is enabled.
void	setEventSelectors(List<Object> value)	Use event selectors to further specify the management and data event settings for your trail.
void	setEventSelectors(IResolvable value)	Use event selectors to further specify the management and data event settings for your trail.
void	setIncludeGlobalServiceEvents(Boolean value)	Specifies whether the trail is publishing events from global services such as IAM to the log files.
void	setIncludeGlobalServiceEvents(IResolvable value)	Specifies whether the trail is publishing events from global services such as IAM to the log files.
void	setInsightSelectors(List<Object> value)	A JSON string that contains the Insights types you want to log on a trail.
void	setInsightSelectors(IResolvable value)	A JSON string that contains the Insights types you want to log on a trail.
void	setIsLogging(Boolean value)	Whether the CloudTrail trail is currently logging AWS API calls.
void	setIsLogging(IResolvable value)	Whether the CloudTrail trail is currently logging AWS API calls.
void	setIsMultiRegionTrail(Boolean value)	Specifies whether the trail applies only to the current Region or to all Regions.
void	setIsMultiRegionTrail(IResolvable value)	Specifies whether the trail applies only to the current Region or to all Regions.
void	setIsOrganizationTrail(Boolean value)	Specifies whether the trail is applied to all accounts in an organization in AWS Organizations , or only for the current AWS account .
void	setIsOrganizationTrail(IResolvable value)	Specifies whether the trail is applied to all accounts in an organization in AWS Organizations , or only for the current AWS account .
void	setKmsKeyId(String value)	Specifies the AWS KMS key ID to use to encrypt the logs and digest files delivered by CloudTrail.
void	setS3BucketName(String value)	Specifies the name of the Amazon S3 bucket designated for publishing log files.
void	setS3KeyPrefix(String value)	Specifies the Amazon S3 key prefix that comes after the name of the bucket you have designated for log file delivery.
void	setSnsTopicName(String value)	Specifies the name or ARN of the Amazon SNS topic defined for notification of log file delivery.
void	setTagsRaw(List<CfnTag> value)	A custom set of tags (key-value pairs) for this trail.
void	setTrailName(String value)	Specifies the name of the trail.

Methods inherited from class software.amazon.awscdk.CfnResource

addDeletionOverride, addDependency, addDependsOn, addMetadata, addOverride, addPropertyDeletionOverride, addPropertyOverride, applyRemovalPolicy, applyRemovalPolicy, applyRemovalPolicy, getAtt, getAtt, getCfnOptions, getCfnResourceType, getMetadata, getUpdatedProperites, getUpdatedProperties, isCfnResource, obtainDependencies, obtainResourceDependencies, removeDependency, replaceDependency, shouldSynthesize, toString, validateProperties

Methods inherited from class software.amazon.awscdk.CfnRefElement

getRef

Methods inherited from class software.amazon.awscdk.CfnElement

getCreationStack, getLogicalId, getStack, isCfnElement, overrideLogicalId

Methods inherited from class software.constructs.Construct

getNode, isConstruct

Methods inherited from class software.amazon.jsii.JsiiObject

jsiiAsyncCall, jsiiAsyncCall, jsiiCall, jsiiCall, jsiiGet, jsiiGet, jsiiSet, jsiiStaticCall, jsiiStaticCall, jsiiStaticGet, jsiiStaticGet, jsiiStaticSet, jsiiStaticSet

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Methods inherited from interface software.constructs.IConstruct

getNode

Methods inherited from interface software.amazon.jsii.JsiiSerializable

$jsii$toJson

Field Details

CFN_RESOURCE_TYPE_NAME

@Stability(Stable)
public static final String CFN_RESOURCE_TYPE_NAME

The CloudFormation resource type name for this resource class.

Constructor Details

CfnTrail

protected CfnTrail(software.amazon.jsii.JsiiObjectRef objRef)

CfnTrail

protected CfnTrail(software.amazon.jsii.JsiiObject.InitializationMode initializationMode)

CfnTrail

@Stability(Stable)
public CfnTrail(@NotNull
 software.constructs.Construct scope,
 @NotNull
 String id,
 @NotNull
 CfnTrailProps props)

Parameters:

scope - Scope in which this resource is defined. This parameter is required.

id - Construct identifier for this resource (unique in its scope). This parameter is required.

props - Resource properties. This parameter is required.

Method Details

fromTrailArn

@Stability(Stable)
@NotNull
public static ITrailRef fromTrailArn(@NotNull
 software.constructs.Construct scope,
 @NotNull
 String id,
 @NotNull
 String arn)

Creates a new ITrailRef from an ARN.

Parameters:

scope - This parameter is required.

id - This parameter is required.

arn - This parameter is required.

fromTrailName

@Stability(Stable)
@NotNull
public static ITrailRef fromTrailName(@NotNull
 software.constructs.Construct scope,
 @NotNull
 String id,
 @NotNull
 String trailName)

Creates a new ITrailRef from a trailName.

Parameters:

scope - This parameter is required.

id - This parameter is required.

trailName - This parameter is required.

inspect

@Stability(Stable)
public void inspect(@NotNull
 TreeInspector inspector)

Examines the CloudFormation resource and discloses attributes.

Specified by:

inspect in interface IInspectable

Parameters:

inspector - tree inspector to collect and process attributes. This parameter is required.

renderProperties

@Stability(Stable)
@NotNull
protected Map<String,Object> renderProperties(@NotNull
 Map<String,Object> props)

Overrides:

renderProperties in class CfnResource

Parameters:

props - This parameter is required.

getAttrArn

@Stability(Stable)
@NotNull
public String getAttrArn()

Ref returns the ARN of the CloudTrail trail, such as arn:aws:cloudtrail:us-east-2:123456789012:trail/myCloudTrail .

getAttrSnsTopicArn

@Stability(Stable)
@NotNull
public String getAttrSnsTopicArn()

Ref returns the ARN of the Amazon SNS topic that's associated with the CloudTrail trail, such as arn:aws:sns:us-east-2:123456789012:mySNSTopic .

getCfnProperties

@Stability(Stable)
@NotNull
protected Map<String,Object> getCfnProperties()

Overrides:

getCfnProperties in class CfnResource

getTags

@Stability(Stable)
@NotNull
public TagManager getTags()

Tag Manager which manages the tags for this resource.

Specified by:

getTags in interface ITaggable

getTrailRef

@Stability(Stable)
@NotNull
public TrailReference getTrailRef()

A reference to a Trail resource.

Specified by:

getTrailRef in interface ITrailRef

getIsLogging

@Stability(Stable)
@NotNull
public Object getIsLogging()

Whether the CloudTrail trail is currently logging AWS API calls.

setIsLogging

@Stability(Stable)
public void setIsLogging(@NotNull
 Boolean value)

Whether the CloudTrail trail is currently logging AWS API calls.

setIsLogging

@Stability(Stable)
public void setIsLogging(@NotNull
 IResolvable value)

Whether the CloudTrail trail is currently logging AWS API calls.

getS3BucketName

@Stability(Stable)
@NotNull
public String getS3BucketName()

Specifies the name of the Amazon S3 bucket designated for publishing log files.

setS3BucketName

@Stability(Stable)
public void setS3BucketName(@NotNull
 String value)

Specifies the name of the Amazon S3 bucket designated for publishing log files.

getAdvancedEventSelectors

@Stability(Stable)
@Nullable
public Object getAdvancedEventSelectors()

Specifies the settings for advanced event selectors.

setAdvancedEventSelectors

@Stability(Stable)
public void setAdvancedEventSelectors(@Nullable
 IResolvable value)

Specifies the settings for advanced event selectors.

setAdvancedEventSelectors

@Stability(Stable)
public void setAdvancedEventSelectors(@Nullable
 List<Object> value)

Specifies the settings for advanced event selectors.

getCloudWatchLogsLogGroupArn

@Stability(Stable)
@Nullable
public String getCloudWatchLogsLogGroupArn()

Specifies a log group name using an Amazon Resource Name (ARN), a unique identifier that represents the log group to which CloudTrail logs are delivered.

setCloudWatchLogsLogGroupArn

@Stability(Stable)
public void setCloudWatchLogsLogGroupArn(@Nullable
 String value)

Specifies a log group name using an Amazon Resource Name (ARN), a unique identifier that represents the log group to which CloudTrail logs are delivered.

getCloudWatchLogsRoleArn

@Stability(Stable)
@Nullable
public String getCloudWatchLogsRoleArn()

Specifies the role for the CloudWatch Logs endpoint to assume to write to a user's log group.

setCloudWatchLogsRoleArn

@Stability(Stable)
public void setCloudWatchLogsRoleArn(@Nullable
 String value)

Specifies the role for the CloudWatch Logs endpoint to assume to write to a user's log group.

getEnableLogFileValidation

@Stability(Stable)
@Nullable
public Object getEnableLogFileValidation()

Specifies whether log file validation is enabled.

The default is false.

setEnableLogFileValidation

@Stability(Stable)
public void setEnableLogFileValidation(@Nullable
 Boolean value)

Specifies whether log file validation is enabled.

The default is false.

setEnableLogFileValidation

@Stability(Stable)
public void setEnableLogFileValidation(@Nullable
 IResolvable value)

Specifies whether log file validation is enabled.

The default is false.

getEventSelectors

@Stability(Stable)
@Nullable
public Object getEventSelectors()

Use event selectors to further specify the management and data event settings for your trail.

setEventSelectors

@Stability(Stable)
public void setEventSelectors(@Nullable
 IResolvable value)

Use event selectors to further specify the management and data event settings for your trail.

setEventSelectors

@Stability(Stable)
public void setEventSelectors(@Nullable
 List<Object> value)

Use event selectors to further specify the management and data event settings for your trail.

getIncludeGlobalServiceEvents

@Stability(Stable)
@Nullable
public Object getIncludeGlobalServiceEvents()

Specifies whether the trail is publishing events from global services such as IAM to the log files.

setIncludeGlobalServiceEvents

@Stability(Stable)
public void setIncludeGlobalServiceEvents(@Nullable
 Boolean value)

Specifies whether the trail is publishing events from global services such as IAM to the log files.

setIncludeGlobalServiceEvents

@Stability(Stable)
public void setIncludeGlobalServiceEvents(@Nullable
 IResolvable value)

Specifies whether the trail is publishing events from global services such as IAM to the log files.

getInsightSelectors

@Stability(Stable)
@Nullable
public Object getInsightSelectors()

A JSON string that contains the Insights types you want to log on a trail.

setInsightSelectors

@Stability(Stable)
public void setInsightSelectors(@Nullable
 IResolvable value)

A JSON string that contains the Insights types you want to log on a trail.

setInsightSelectors

@Stability(Stable)
public void setInsightSelectors(@Nullable
 List<Object> value)

A JSON string that contains the Insights types you want to log on a trail.

getIsMultiRegionTrail

@Stability(Stable)
@Nullable
public Object getIsMultiRegionTrail()

Specifies whether the trail applies only to the current Region or to all Regions.

setIsMultiRegionTrail

@Stability(Stable)
public void setIsMultiRegionTrail(@Nullable
 Boolean value)

Specifies whether the trail applies only to the current Region or to all Regions.

setIsMultiRegionTrail

@Stability(Stable)
public void setIsMultiRegionTrail(@Nullable
 IResolvable value)

Specifies whether the trail applies only to the current Region or to all Regions.

getIsOrganizationTrail

@Stability(Stable)
@Nullable
public Object getIsOrganizationTrail()

Specifies whether the trail is applied to all accounts in an organization in AWS Organizations , or only for the current AWS account .

setIsOrganizationTrail

@Stability(Stable)
public void setIsOrganizationTrail(@Nullable
 Boolean value)

Specifies whether the trail is applied to all accounts in an organization in AWS Organizations , or only for the current AWS account .

setIsOrganizationTrail

@Stability(Stable)
public void setIsOrganizationTrail(@Nullable
 IResolvable value)

Specifies whether the trail is applied to all accounts in an organization in AWS Organizations , or only for the current AWS account .

getKmsKeyId

@Stability(Stable)
@Nullable
public String getKmsKeyId()

Specifies the AWS KMS key ID to use to encrypt the logs and digest files delivered by CloudTrail.

setKmsKeyId

@Stability(Stable)
public void setKmsKeyId(@Nullable
 String value)

Specifies the AWS KMS key ID to use to encrypt the logs and digest files delivered by CloudTrail.

getS3KeyPrefix

@Stability(Stable)
@Nullable
public String getS3KeyPrefix()

Specifies the Amazon S3 key prefix that comes after the name of the bucket you have designated for log file delivery.

setS3KeyPrefix

@Stability(Stable)
public void setS3KeyPrefix(@Nullable
 String value)

Specifies the Amazon S3 key prefix that comes after the name of the bucket you have designated for log file delivery.

getSnsTopicName

@Stability(Stable)
@Nullable
public String getSnsTopicName()

Specifies the name or ARN of the Amazon SNS topic defined for notification of log file delivery.

setSnsTopicName

@Stability(Stable)
public void setSnsTopicName(@Nullable
 String value)

Specifies the name or ARN of the Amazon SNS topic defined for notification of log file delivery.

getTagsRaw

@Stability(Stable)
@Nullable
public List<CfnTag> getTagsRaw()

A custom set of tags (key-value pairs) for this trail.

setTagsRaw

@Stability(Stable)
public void setTagsRaw(@Nullable
 List<CfnTag> value)

A custom set of tags (key-value pairs) for this trail.

getTrailName

@Stability(Stable)
@Nullable
public String getTrailName()

Specifies the name of the trail.

The name must meet the following requirements:.

setTrailName

@Stability(Stable)
public void setTrailName(@Nullable
 String value)

Specifies the name of the trail.

The name must meet the following requirements:.