This is the new *CloudFormation Template Reference Guide*. Please update your bookmarks and links. For help getting started with CloudFormation, see the [AWS CloudFormation User Guide](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/Welcome.html). # CloudWatch Observability Admin **Resource types** + [AWS::ObservabilityAdmin::OrganizationCentralizationRule](aws-resource-observabilityadmin-organizationcentralizationrule.md) + [AWS::ObservabilityAdmin::OrganizationTelemetryRule](aws-resource-observabilityadmin-organizationtelemetryrule.md) + [AWS::ObservabilityAdmin::S3TableIntegration](aws-resource-observabilityadmin-s3tableintegration.md) + [AWS::ObservabilityAdmin::TelemetryEnrichment](aws-resource-observabilityadmin-telemetryenrichment.md) + [AWS::ObservabilityAdmin::TelemetryPipelines](aws-resource-observabilityadmin-telemetrypipelines.md) + [AWS::ObservabilityAdmin::TelemetryRule](aws-resource-observabilityadmin-telemetryrule.md) # AWS::ObservabilityAdmin::OrganizationCentralizationRule Defines how telemetry data should be centralized across an AWS Organization, including source and destination configurations. ## Syntax To declare this entity in your CloudFormation template, use the following syntax: ### JSON ``` { "Type" : "AWS::ObservabilityAdmin::OrganizationCentralizationRule", "Properties" : { "[Rule](#cfn-observabilityadmin-organizationcentralizationrule-rule)" : CentralizationRule, "[RuleName](#cfn-observabilityadmin-organizationcentralizationrule-rulename)" : String, "[Tags](#cfn-observabilityadmin-organizationcentralizationrule-tags)" : [ Tag, ... ] } } ``` ### YAML ``` Type: AWS::ObservabilityAdmin::OrganizationCentralizationRule Properties: [Rule](#cfn-observabilityadmin-organizationcentralizationrule-rule): CentralizationRule [RuleName](#cfn-observabilityadmin-organizationcentralizationrule-rulename): String [Tags](#cfn-observabilityadmin-organizationcentralizationrule-tags): - Tag ``` ## Properties `Rule` Property description not available. *Required*: Yes *Type*: [CentralizationRule](aws-properties-observabilityadmin-organizationcentralizationrule-centralizationrule.md) *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `RuleName` The name of the organization centralization rule. *Required*: Yes *Type*: String *Pattern*: `^[0-9A-Za-z-]+$` *Minimum*: `1` *Maximum*: `100` *Update requires*: [Replacement](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-replacement) `Tags` A key-value pair to filter resources based on tags associated with the resource. For more information about tags, see [What are tags?](https://docs.aws.amazon.com/whitepapers/latest/tagging-best-practices/what-are-tags.html) *Required*: No *Type*: Array of [Tag](aws-properties-observabilityadmin-organizationcentralizationrule-tag.md) *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) ## Return values ### Ref ### Fn::GetAtt #### `RuleArn` The Amazon Resource Name (ARN) of the organization centralization rule. # AWS::ObservabilityAdmin::OrganizationCentralizationRule CentralizationRule Defines how telemetry data should be centralized across an AWS Organization, including source and destination configurations. ## Syntax To declare this entity in your CloudFormation template, use the following syntax: ### JSON ``` { "[Destination](#cfn-observabilityadmin-organizationcentralizationrule-centralizationrule-destination)" : CentralizationRuleDestination, "[Source](#cfn-observabilityadmin-organizationcentralizationrule-centralizationrule-source)" : CentralizationRuleSource } ``` ### YAML ``` [Destination](#cfn-observabilityadmin-organizationcentralizationrule-centralizationrule-destination): CentralizationRuleDestination [Source](#cfn-observabilityadmin-organizationcentralizationrule-centralizationrule-source): CentralizationRuleSource ``` ## Properties `Destination` Configuration determining where the telemetry data should be centralized, backed up, as well as encryption configuration for the primary and backup destinations. *Required*: Yes *Type*: [CentralizationRuleDestination](aws-properties-observabilityadmin-organizationcentralizationrule-centralizationruledestination.md) *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `Source` Configuration determining the source of the telemetry data to be centralized. *Required*: Yes *Type*: [CentralizationRuleSource](aws-properties-observabilityadmin-organizationcentralizationrule-centralizationrulesource.md) *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) # AWS::ObservabilityAdmin::OrganizationCentralizationRule CentralizationRuleDestination Configuration specifying the primary destination for centralized telemetry data. ## Syntax To declare this entity in your CloudFormation template, use the following syntax: ### JSON ``` { "[Account](#cfn-observabilityadmin-organizationcentralizationrule-centralizationruledestination-account)" : String, "[DestinationLogsConfiguration](#cfn-observabilityadmin-organizationcentralizationrule-centralizationruledestination-destinationlogsconfiguration)" : DestinationLogsConfiguration, "[Region](#cfn-observabilityadmin-organizationcentralizationrule-centralizationruledestination-region)" : String } ``` ### YAML ``` [Account](#cfn-observabilityadmin-organizationcentralizationrule-centralizationruledestination-account): String [DestinationLogsConfiguration](#cfn-observabilityadmin-organizationcentralizationrule-centralizationruledestination-destinationlogsconfiguration): DestinationLogsConfiguration [Region](#cfn-observabilityadmin-organizationcentralizationrule-centralizationruledestination-region): String ``` ## Properties `Account` The destination account (within the organization) to which the telemetry data should be centralized. *Required*: No *Type*: String *Pattern*: `^[0-9]{12}$` *Minimum*: `12` *Maximum*: `12` *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `DestinationLogsConfiguration` Log specific configuration for centralization destination log groups. *Required*: No *Type*: [DestinationLogsConfiguration](aws-properties-observabilityadmin-organizationcentralizationrule-destinationlogsconfiguration.md) *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `Region` The primary destination region to which telemetry data should be centralized. *Required*: Yes *Type*: String *Minimum*: `1` *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) # AWS::ObservabilityAdmin::OrganizationCentralizationRule CentralizationRuleSource Configuration specifying the source of telemetry data to be centralized. ## Syntax To declare this entity in your CloudFormation template, use the following syntax: ### JSON ``` { "[Regions](#cfn-observabilityadmin-organizationcentralizationrule-centralizationrulesource-regions)" : [ String, ... ], "[Scope](#cfn-observabilityadmin-organizationcentralizationrule-centralizationrulesource-scope)" : String, "[SourceLogsConfiguration](#cfn-observabilityadmin-organizationcentralizationrule-centralizationrulesource-sourcelogsconfiguration)" : SourceLogsConfiguration } ``` ### YAML ``` [Regions](#cfn-observabilityadmin-organizationcentralizationrule-centralizationrulesource-regions): - String [Scope](#cfn-observabilityadmin-organizationcentralizationrule-centralizationrulesource-scope): String [SourceLogsConfiguration](#cfn-observabilityadmin-organizationcentralizationrule-centralizationrulesource-sourcelogsconfiguration): SourceLogsConfiguration ``` ## Properties `Regions` The list of source regions from which telemetry data should be centralized. *Required*: Yes *Type*: Array of String *Minimum*: `1` *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `Scope` The organizational scope from which telemetry data should be centralized, specified using organization id, accounts or organizational unit ids. *Required*: No *Type*: String *Minimum*: `1` *Maximum*: `2000` *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `SourceLogsConfiguration` Log specific configuration for centralization source log groups. *Required*: No *Type*: [SourceLogsConfiguration](aws-properties-observabilityadmin-organizationcentralizationrule-sourcelogsconfiguration.md) *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) # AWS::ObservabilityAdmin::OrganizationCentralizationRule DestinationLogsConfiguration Configuration for centralization destination log groups, including encryption and backup settings. ## Syntax To declare this entity in your CloudFormation template, use the following syntax: ### JSON ``` { "[BackupConfiguration](#cfn-observabilityadmin-organizationcentralizationrule-destinationlogsconfiguration-backupconfiguration)" : LogsBackupConfiguration, "[LogGroupNameConfiguration](#cfn-observabilityadmin-organizationcentralizationrule-destinationlogsconfiguration-loggroupnameconfiguration)" : LogGroupNameConfiguration, "[LogsEncryptionConfiguration](#cfn-observabilityadmin-organizationcentralizationrule-destinationlogsconfiguration-logsencryptionconfiguration)" : LogsEncryptionConfiguration } ``` ### YAML ``` [BackupConfiguration](#cfn-observabilityadmin-organizationcentralizationrule-destinationlogsconfiguration-backupconfiguration): LogsBackupConfiguration [LogGroupNameConfiguration](#cfn-observabilityadmin-organizationcentralizationrule-destinationlogsconfiguration-loggroupnameconfiguration): LogGroupNameConfiguration [LogsEncryptionConfiguration](#cfn-observabilityadmin-organizationcentralizationrule-destinationlogsconfiguration-logsencryptionconfiguration): LogsEncryptionConfiguration ``` ## Properties `BackupConfiguration` Configuration defining the backup region and an optional KMS key for the backup destination. *Required*: No *Type*: [LogsBackupConfiguration](aws-properties-observabilityadmin-organizationcentralizationrule-logsbackupconfiguration.md) *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `LogGroupNameConfiguration` Configuration that specifies a naming pattern for destination log groups created during centralization. The pattern supports static text and dynamic variables that are replaced with source attributes when log groups are created. *Required*: No *Type*: [LogGroupNameConfiguration](aws-properties-observabilityadmin-organizationcentralizationrule-loggroupnameconfiguration.md) *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `LogsEncryptionConfiguration` The encryption configuration for centralization destination log groups. *Required*: No *Type*: [LogsEncryptionConfiguration](aws-properties-observabilityadmin-organizationcentralizationrule-logsencryptionconfiguration.md) *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) # AWS::ObservabilityAdmin::OrganizationCentralizationRule LogGroupNameConfiguration Configuration that specifies a naming pattern for destination log groups created during centralization. The pattern supports static text and dynamic variables that are replaced with source attributes when log groups are created. ## Syntax To declare this entity in your CloudFormation template, use the following syntax: ### JSON ``` { "[LogGroupNamePattern](#cfn-observabilityadmin-organizationcentralizationrule-loggroupnameconfiguration-loggroupnamepattern)" : String } ``` ### YAML ``` [LogGroupNamePattern](#cfn-observabilityadmin-organizationcentralizationrule-loggroupnameconfiguration-loggroupnamepattern): String ``` ## Properties `LogGroupNamePattern` The pattern used to generate destination log group names during centralization. The pattern can contain static text and dynamic variables that are replaced with source attributes. If a variable cannot be resolved, it inherits the value from its parent variable in the hierarchy. The pattern must be between 1 and 512 characters. Supported variables: + **\$1\$1source.logGroup\$1** — The original log group name from the source account. + **\$1\$1source.accountId\$1** — The AWS account ID where the log originated. + **\$1\$1source.region\$1** — The AWS Region where the log originated. + **\$1\$1source.org.id\$1** — The AWS Organization ID of the source account. + **\$1\$1source.org.ouId\$1** — The organizational unit ID of the source account. + **\$1\$1source.org.rootId\$1** — The organization Root ID. + **\$1\$1source.org.path\$1** — The organizational path from account to root. *Required*: Yes *Type*: String *Pattern*: `^(?:[\._\-/#A-Za-z0-9]+|\$\{[A-Za-z]+(?:\.[A-Za-z]+){1,2}\})+$` *Minimum*: `1` *Maximum*: `512` *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) # AWS::ObservabilityAdmin::OrganizationCentralizationRule LogsBackupConfiguration Configuration for backing up centralized log data to a secondary region. ## Syntax To declare this entity in your CloudFormation template, use the following syntax: ### JSON ``` { "[KmsKeyArn](#cfn-observabilityadmin-organizationcentralizationrule-logsbackupconfiguration-kmskeyarn)" : String, "[Region](#cfn-observabilityadmin-organizationcentralizationrule-logsbackupconfiguration-region)" : String } ``` ### YAML ``` [KmsKeyArn](#cfn-observabilityadmin-organizationcentralizationrule-logsbackupconfiguration-kmskeyarn): String [Region](#cfn-observabilityadmin-organizationcentralizationrule-logsbackupconfiguration-region): String ``` ## Properties `KmsKeyArn` KMS Key ARN belonging to the primary destination account and backup region, to encrypt newly created central log groups in the backup destination. *Required*: No *Type*: String *Pattern*: `^arn:aws([a-z0-9\-]+)?:([a-zA-Z0-9\-]+):([a-z0-9\-]+)?:([0-9]{12})?:(.+)$` *Minimum*: `1` *Maximum*: `1011` *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `Region` Logs specific backup destination region within the primary destination account to which log data should be centralized. *Required*: Yes *Type*: String *Minimum*: `1` *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) # AWS::ObservabilityAdmin::OrganizationCentralizationRule LogsEncryptionConfiguration Configuration for encrypting centralized log groups. This configuration is only applied to destination log groups for which the corresponding source log groups are encrypted using Customer Managed KMS Keys. ## Syntax To declare this entity in your CloudFormation template, use the following syntax: ### JSON ``` { "[EncryptionConflictResolutionStrategy](#cfn-observabilityadmin-organizationcentralizationrule-logsencryptionconfiguration-encryptionconflictresolutionstrategy)" : String, "[EncryptionStrategy](#cfn-observabilityadmin-organizationcentralizationrule-logsencryptionconfiguration-encryptionstrategy)" : String, "[KmsKeyArn](#cfn-observabilityadmin-organizationcentralizationrule-logsencryptionconfiguration-kmskeyarn)" : String } ``` ### YAML ``` [EncryptionConflictResolutionStrategy](#cfn-observabilityadmin-organizationcentralizationrule-logsencryptionconfiguration-encryptionconflictresolutionstrategy): String [EncryptionStrategy](#cfn-observabilityadmin-organizationcentralizationrule-logsencryptionconfiguration-encryptionstrategy): String [KmsKeyArn](#cfn-observabilityadmin-organizationcentralizationrule-logsencryptionconfiguration-kmskeyarn): String ``` ## Properties `EncryptionConflictResolutionStrategy` Conflict resolution strategy for centralization if the encryption strategy is set to CUSTOMER\$1MANAGED and the destination log group is encrypted with an AWS\$1OWNED KMS Key. ALLOW lets centralization go through while SKIP prevents centralization into the destination log group. *Required*: No *Type*: String *Allowed values*: `ALLOW | SKIP` *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `EncryptionStrategy` Configuration that determines the encryption strategy of the destination log groups. CUSTOMER\$1MANAGED uses the configured KmsKeyArn to encrypt newly created destination log groups. *Required*: Yes *Type*: String *Allowed values*: `CUSTOMER_MANAGED | AWS_OWNED` *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `KmsKeyArn` KMS Key ARN belonging to the primary destination account and region, to encrypt newly created central log groups in the primary destination. *Required*: No *Type*: String *Pattern*: `^arn:aws([a-z0-9\-]+)?:([a-zA-Z0-9\-]+):([a-z0-9\-]+)?:([0-9]{12})?:(.+)$` *Minimum*: `1` *Maximum*: `1011` *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) # AWS::ObservabilityAdmin::OrganizationCentralizationRule SourceLogsConfiguration Configuration for selecting and handling source log groups for centralization. ## Syntax To declare this entity in your CloudFormation template, use the following syntax: ### JSON ``` { "[DataSourceSelectionCriteria](#cfn-observabilityadmin-organizationcentralizationrule-sourcelogsconfiguration-datasourceselectioncriteria)" : String, "[EncryptedLogGroupStrategy](#cfn-observabilityadmin-organizationcentralizationrule-sourcelogsconfiguration-encryptedloggroupstrategy)" : String, "[LogGroupSelectionCriteria](#cfn-observabilityadmin-organizationcentralizationrule-sourcelogsconfiguration-loggroupselectioncriteria)" : String } ``` ### YAML ``` [DataSourceSelectionCriteria](#cfn-observabilityadmin-organizationcentralizationrule-sourcelogsconfiguration-datasourceselectioncriteria): String [EncryptedLogGroupStrategy](#cfn-observabilityadmin-organizationcentralizationrule-sourcelogsconfiguration-encryptedloggroupstrategy): String [LogGroupSelectionCriteria](#cfn-observabilityadmin-organizationcentralizationrule-sourcelogsconfiguration-loggroupselectioncriteria): String ``` ## Properties `DataSourceSelectionCriteria` The selection criteria that specifies which data sources to centralize. The selection criteria uses the same filter expression format as `LogGroupSelectionCriteria`, but operates on `DataSourceName` and `DataSourceType` operands. When both `LogGroupSelectionCriteria` and `DataSourceSelectionCriteria` are specified, a log event must match both criteria to be centralized. *Required*: No *Type*: String *Minimum*: `1` *Maximum*: `2000` *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `EncryptedLogGroupStrategy` A strategy determining whether to centralize source log groups that are encrypted with customer managed KMS keys (CMK). ALLOW will consider CMK encrypted source log groups for centralization while SKIP will skip CMK encrypted source log groups from centralization. *Required*: Yes *Type*: String *Allowed values*: `ALLOW | SKIP` *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `LogGroupSelectionCriteria` The selection criteria that specifies which source log groups to centralize. The selection criteria uses the same format as OAM link filters. *Required*: No *Type*: String *Minimum*: `1` *Maximum*: `2000` *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) # AWS::ObservabilityAdmin::OrganizationCentralizationRule Tag A key-value pair to filter resources in the organization based on tags associated with the resource. Fore more information about tags, see [What are tags?](https://docs.aws.amazon.com/whitepapers/latest/tagging-best-practices/what-are-tags.html) ## Syntax To declare this entity in your CloudFormation template, use the following syntax: ### JSON ``` { "[Key](#cfn-observabilityadmin-organizationcentralizationrule-tag-key)" : String, "[Value](#cfn-observabilityadmin-organizationcentralizationrule-tag-value)" : String } ``` ### YAML ``` [Key](#cfn-observabilityadmin-organizationcentralizationrule-tag-key): String [Value](#cfn-observabilityadmin-organizationcentralizationrule-tag-value): String ``` ## Properties `Key` One part of a key-value pair that makes up a tag associated with the organization's centralization rule resource. A key is a general label that acts like a category for more specific tag values. *Required*: Yes *Type*: String *Minimum*: `1` *Maximum*: `128` *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `Value` One part of a key-value pair that make up a tag associated with the organization's centralization rule resource. A value acts as a descriptor within a tag category (key). The value can be empty or null. *Required*: Yes *Type*: String *Minimum*: `0` *Maximum*: `256` *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) # AWS::ObservabilityAdmin::OrganizationTelemetryRule Retrieves the details of a specific organization centralization rule. This operation can only be called by the organization's management account or a delegated administrator account. ## Syntax To declare this entity in your CloudFormation template, use the following syntax: ### JSON ``` { "Type" : "AWS::ObservabilityAdmin::OrganizationTelemetryRule", "Properties" : { "[Rule](#cfn-observabilityadmin-organizationtelemetryrule-rule)" : TelemetryRule, "[RuleName](#cfn-observabilityadmin-organizationtelemetryrule-rulename)" : String, "[Tags](#cfn-observabilityadmin-organizationtelemetryrule-tags)" : [ Tag, ... ] } } ``` ### YAML ``` Type: AWS::ObservabilityAdmin::OrganizationTelemetryRule Properties: [Rule](#cfn-observabilityadmin-organizationtelemetryrule-rule): TelemetryRule [RuleName](#cfn-observabilityadmin-organizationtelemetryrule-rulename): String [Tags](#cfn-observabilityadmin-organizationtelemetryrule-tags): - Tag ``` ## Properties `Rule` The name of the organization telemetry rule. *Required*: Yes *Type*: [TelemetryRule](aws-properties-observabilityadmin-organizationtelemetryrule-telemetryrule.md) *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `RuleName` The name of the organization centralization rule. *Required*: Yes *Type*: String *Pattern*: `^[0-9A-Za-z-]+$` *Minimum*: `1` *Maximum*: `100` *Update requires*: [Replacement](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-replacement) `Tags` Lists all tags attached to the specified resource. Supports telemetry rule resources and telemetry pipeline resources. *Required*: No *Type*: Array of [Tag](aws-properties-observabilityadmin-organizationtelemetryrule-tag.md) *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) ## Return values ### Ref ### Fn::GetAtt #### `RuleArn` Property description not available. # AWS::ObservabilityAdmin::OrganizationTelemetryRule ActionCondition Condition that matches based on the specific WAF action taken on the request. ## Syntax To declare this entity in your CloudFormation template, use the following syntax: ### JSON ``` { "[Action](#cfn-observabilityadmin-organizationtelemetryrule-actioncondition-action)" : String } ``` ### YAML ``` [Action](#cfn-observabilityadmin-organizationtelemetryrule-actioncondition-action): String ``` ## Properties `Action` The WAF action to match against (ALLOW, BLOCK, COUNT, CAPTCHA, CHALLENGE, EXCLUDED\$1AS\$1COUNT). *Required*: No *Type*: String *Allowed values*: `ALLOW | BLOCK | COUNT | CAPTCHA | CHALLENGE | EXCLUDED_AS_COUNT` *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) # AWS::ObservabilityAdmin::OrganizationTelemetryRule AdvancedEventSelector Advanced event selectors let you create fine-grained selectors for management, data, and network activity events. ## Syntax To declare this entity in your CloudFormation template, use the following syntax: ### JSON ``` { "[FieldSelectors](#cfn-observabilityadmin-organizationtelemetryrule-advancedeventselector-fieldselectors)" : [ AdvancedFieldSelector, ... ], "[Name](#cfn-observabilityadmin-organizationtelemetryrule-advancedeventselector-name)" : String } ``` ### YAML ``` [FieldSelectors](#cfn-observabilityadmin-organizationtelemetryrule-advancedeventselector-fieldselectors): - AdvancedFieldSelector [Name](#cfn-observabilityadmin-organizationtelemetryrule-advancedeventselector-name): String ``` ## Properties `FieldSelectors` Contains all selector statements in an advanced event selector. *Required*: Yes *Type*: Array of [AdvancedFieldSelector](aws-properties-observabilityadmin-organizationtelemetryrule-advancedfieldselector.md) *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `Name` An optional, descriptive name for an advanced event selector, such as "Log data events for only two S3 buckets". *Required*: No *Type*: String *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) # AWS::ObservabilityAdmin::OrganizationTelemetryRule AdvancedFieldSelector Defines criteria for selecting resources based on field values. ## Syntax To declare this entity in your CloudFormation template, use the following syntax: ### JSON ``` { "[EndsWith](#cfn-observabilityadmin-organizationtelemetryrule-advancedfieldselector-endswith)" : [ String, ... ], "[Equals](#cfn-observabilityadmin-organizationtelemetryrule-advancedfieldselector-equals)" : [ String, ... ], "[Field](#cfn-observabilityadmin-organizationtelemetryrule-advancedfieldselector-field)" : String, "[NotEndsWith](#cfn-observabilityadmin-organizationtelemetryrule-advancedfieldselector-notendswith)" : [ String, ... ], "[NotEquals](#cfn-observabilityadmin-organizationtelemetryrule-advancedfieldselector-notequals)" : [ String, ... ], "[NotStartsWith](#cfn-observabilityadmin-organizationtelemetryrule-advancedfieldselector-notstartswith)" : [ String, ... ], "[StartsWith](#cfn-observabilityadmin-organizationtelemetryrule-advancedfieldselector-startswith)" : [ String, ... ] } ``` ### YAML ``` [EndsWith](#cfn-observabilityadmin-organizationtelemetryrule-advancedfieldselector-endswith): - String [Equals](#cfn-observabilityadmin-organizationtelemetryrule-advancedfieldselector-equals): - String [Field](#cfn-observabilityadmin-organizationtelemetryrule-advancedfieldselector-field): String [NotEndsWith](#cfn-observabilityadmin-organizationtelemetryrule-advancedfieldselector-notendswith): - String [NotEquals](#cfn-observabilityadmin-organizationtelemetryrule-advancedfieldselector-notequals): - String [NotStartsWith](#cfn-observabilityadmin-organizationtelemetryrule-advancedfieldselector-notstartswith): - String [StartsWith](#cfn-observabilityadmin-organizationtelemetryrule-advancedfieldselector-startswith): - String ``` ## Properties `EndsWith` Matches if the field value ends with the specified value. *Required*: No *Type*: Array of String *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `Equals` Matches if the field value equals the specified value. *Required*: No *Type*: Array of String *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `Field` The name of the field to use for selection. *Required*: No *Type*: String *Minimum*: `1` *Maximum*: `1000` *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `NotEndsWith` Matches if the field value does not end with the specified value. *Required*: No *Type*: Array of String *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `NotEquals` Matches if the field value does not equal the specified value. *Required*: No *Type*: Array of String *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `NotStartsWith` Matches if the field value does not start with the specified value. *Required*: No *Type*: Array of String *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `StartsWith` Matches if the field value starts with the specified value. *Required*: No *Type*: Array of String *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) # AWS::ObservabilityAdmin::OrganizationTelemetryRule CloudtrailParameters Parameters specific to AWS CloudTrail telemetry configuration. ## Syntax To declare this entity in your CloudFormation template, use the following syntax: ### JSON ``` { "[AdvancedEventSelectors](#cfn-observabilityadmin-organizationtelemetryrule-cloudtrailparameters-advancedeventselectors)" : [ AdvancedEventSelector, ... ] } ``` ### YAML ``` [AdvancedEventSelectors](#cfn-observabilityadmin-organizationtelemetryrule-cloudtrailparameters-advancedeventselectors): - AdvancedEventSelector ``` ## Properties `AdvancedEventSelectors` The advanced event selectors to use for filtering AWS CloudTrail events. *Required*: Yes *Type*: Array of [AdvancedEventSelector](aws-properties-observabilityadmin-organizationtelemetryrule-advancedeventselector.md) *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) # AWS::ObservabilityAdmin::OrganizationTelemetryRule Condition A single condition that can match based on WAF rule action or label name. ## Syntax To declare this entity in your CloudFormation template, use the following syntax: ### JSON ``` { "[ActionCondition](#cfn-observabilityadmin-organizationtelemetryrule-condition-actioncondition)" : ActionCondition, "[LabelNameCondition](#cfn-observabilityadmin-organizationtelemetryrule-condition-labelnamecondition)" : LabelNameCondition } ``` ### YAML ``` [ActionCondition](#cfn-observabilityadmin-organizationtelemetryrule-condition-actioncondition): ActionCondition [LabelNameCondition](#cfn-observabilityadmin-organizationtelemetryrule-condition-labelnamecondition): LabelNameCondition ``` ## Properties `ActionCondition` Matches log records based on the WAF rule action taken (ALLOW, BLOCK, COUNT, etc.). *Required*: No *Type*: [ActionCondition](aws-properties-observabilityadmin-organizationtelemetryrule-actioncondition.md) *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `LabelNameCondition` Matches log records based on WAF rule labels applied to the request. *Required*: No *Type*: [LabelNameCondition](aws-properties-observabilityadmin-organizationtelemetryrule-labelnamecondition.md) *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) # AWS::ObservabilityAdmin::OrganizationTelemetryRule ELBLoadBalancerLoggingParameters Configuration parameters for ELB load balancer logging, including output format and field delimiter settings. ## Syntax To declare this entity in your CloudFormation template, use the following syntax: ### JSON ``` { "[FieldDelimiter](#cfn-observabilityadmin-organizationtelemetryrule-elbloadbalancerloggingparameters-fielddelimiter)" : String, "[OutputFormat](#cfn-observabilityadmin-organizationtelemetryrule-elbloadbalancerloggingparameters-outputformat)" : String } ``` ### YAML ``` [FieldDelimiter](#cfn-observabilityadmin-organizationtelemetryrule-elbloadbalancerloggingparameters-fielddelimiter): String [OutputFormat](#cfn-observabilityadmin-organizationtelemetryrule-elbloadbalancerloggingparameters-outputformat): String ``` ## Properties `FieldDelimiter` The delimiter character used to separate fields in ELB access log entries when using plain text format. *Required*: No *Type*: String *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `OutputFormat` The format for ELB access log entries (plain text or JSON format). *Required*: No *Type*: String *Allowed values*: `plain | json` *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) # AWS::ObservabilityAdmin::OrganizationTelemetryRule FieldToMatch Specifies a field in the request to redact from WAF logs, such as headers, query parameters, or body content. ## Syntax To declare this entity in your CloudFormation template, use the following syntax: ### JSON ``` { "[Method](#cfn-observabilityadmin-organizationtelemetryrule-fieldtomatch-method)" : String, "[QueryString](#cfn-observabilityadmin-organizationtelemetryrule-fieldtomatch-querystring)" : String, "[SingleHeader](#cfn-observabilityadmin-organizationtelemetryrule-fieldtomatch-singleheader)" : SingleHeader, "[UriPath](#cfn-observabilityadmin-organizationtelemetryrule-fieldtomatch-uripath)" : String } ``` ### YAML ``` [Method](#cfn-observabilityadmin-organizationtelemetryrule-fieldtomatch-method): String [QueryString](#cfn-observabilityadmin-organizationtelemetryrule-fieldtomatch-querystring): String [SingleHeader](#cfn-observabilityadmin-organizationtelemetryrule-fieldtomatch-singleheader): SingleHeader [UriPath](#cfn-observabilityadmin-organizationtelemetryrule-fieldtomatch-uripath): String ``` ## Properties `Method` Redacts the HTTP method from WAF logs. *Required*: No *Type*: String *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `QueryString` Redacts the entire query string from WAF logs. *Required*: No *Type*: String *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `SingleHeader` Redacts a specific header field by name from WAF logs. *Required*: No *Type*: [SingleHeader](aws-properties-observabilityadmin-organizationtelemetryrule-singleheader.md) *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `UriPath` Redacts the URI path from WAF logs. *Required*: No *Type*: String *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) # AWS::ObservabilityAdmin::OrganizationTelemetryRule Filter A single filter condition that specifies behavior, requirement, and matching conditions for WAF log records. ## Syntax To declare this entity in your CloudFormation template, use the following syntax: ### JSON ``` { "[Behavior](#cfn-observabilityadmin-organizationtelemetryrule-filter-behavior)" : String, "[Conditions](#cfn-observabilityadmin-organizationtelemetryrule-filter-conditions)" : [ Condition, ... ], "[Requirement](#cfn-observabilityadmin-organizationtelemetryrule-filter-requirement)" : String } ``` ### YAML ``` [Behavior](#cfn-observabilityadmin-organizationtelemetryrule-filter-behavior): String [Conditions](#cfn-observabilityadmin-organizationtelemetryrule-filter-conditions): - Condition [Requirement](#cfn-observabilityadmin-organizationtelemetryrule-filter-requirement): String ``` ## Properties `Behavior` The action to take for log records matching this filter (KEEP or DROP). *Required*: No *Type*: String *Allowed values*: `KEEP | DROP` *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `Conditions` The list of conditions that determine if a log record matches this filter. *Required*: No *Type*: Array of [Condition](aws-properties-observabilityadmin-organizationtelemetryrule-condition.md) *Minimum*: `1` *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `Requirement` Whether the log record must meet all conditions (MEETS\$1ALL) or any condition (MEETS\$1ANY) to match this filter. *Required*: No *Type*: String *Allowed values*: `MEETS_ALL | MEETS_ANY` *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) # AWS::ObservabilityAdmin::OrganizationTelemetryRule LabelNameCondition Condition that matches based on WAF rule labels, with label names limited to 1024 characters. ## Syntax To declare this entity in your CloudFormation template, use the following syntax: ### JSON ``` { "[LabelName](#cfn-observabilityadmin-organizationtelemetryrule-labelnamecondition-labelname)" : String } ``` ### YAML ``` [LabelName](#cfn-observabilityadmin-organizationtelemetryrule-labelnamecondition-labelname): String ``` ## Properties `LabelName` The label name to match, supporting alphanumeric characters, underscores, hyphens, and colons. *Required*: No *Type*: String *Pattern*: `^[0-9A-Za-z_\-:]+$` *Minimum*: `1` *Maximum*: `1024` *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) # AWS::ObservabilityAdmin::OrganizationTelemetryRule LoggingFilter Configuration that determines which WAF log records to keep or drop based on specified conditions. ## Syntax To declare this entity in your CloudFormation template, use the following syntax: ### JSON ``` { "[DefaultBehavior](#cfn-observabilityadmin-organizationtelemetryrule-loggingfilter-defaultbehavior)" : String, "[Filters](#cfn-observabilityadmin-organizationtelemetryrule-loggingfilter-filters)" : [ Filter, ... ] } ``` ### YAML ``` [DefaultBehavior](#cfn-observabilityadmin-organizationtelemetryrule-loggingfilter-defaultbehavior): String [Filters](#cfn-observabilityadmin-organizationtelemetryrule-loggingfilter-filters): - Filter ``` ## Properties `DefaultBehavior` The default action (KEEP or DROP) for log records that don't match any filter conditions. *Required*: No *Type*: String *Allowed values*: `KEEP | DROP` *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `Filters` A list of filter conditions that determine log record handling behavior. *Required*: No *Type*: Array of [Filter](aws-properties-observabilityadmin-organizationtelemetryrule-filter.md) *Minimum*: `1` *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) # AWS::ObservabilityAdmin::OrganizationTelemetryRule SingleHeader Structure containing a name field limited to 64 characters for header or query parameter identification. ## Syntax To declare this entity in your CloudFormation template, use the following syntax: ### JSON ``` { "[Name](#cfn-observabilityadmin-organizationtelemetryrule-singleheader-name)" : String } ``` ### YAML ``` [Name](#cfn-observabilityadmin-organizationtelemetryrule-singleheader-name): String ``` ## Properties `Name` The name value, limited to 64 characters. *Required*: Yes *Type*: String *Minimum*: `1` *Maximum*: `64` *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) # AWS::ObservabilityAdmin::OrganizationTelemetryRule Tag A key-value pair to filter resources based on tags associated with the resource. For more information about tags, see [What are tags?](https://docs.aws.amazon.com/whitepapers/latest/tagging-best-practices/what-are-tags.html) ## Syntax To declare this entity in your CloudFormation template, use the following syntax: ### JSON ``` { "[Key](#cfn-observabilityadmin-organizationtelemetryrule-tag-key)" : String, "[Value](#cfn-observabilityadmin-organizationtelemetryrule-tag-value)" : String } ``` ### YAML ``` [Key](#cfn-observabilityadmin-organizationtelemetryrule-tag-key): String [Value](#cfn-observabilityadmin-organizationtelemetryrule-tag-value): String ``` ## Properties `Key` One part of a key-value pair that makes up a tag associated with the organization's telemetry rule resource. A key is a general label that acts like a category for more specific tag values. *Required*: Yes *Type*: String *Minimum*: `1` *Maximum*: `128` *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `Value` One part of a key-value pair that make up a tag associated with the organization's telemetry rule resource. A value acts as a descriptor within a tag category (key). The value can be empty or null. *Required*: Yes *Type*: String *Minimum*: `0` *Maximum*: `256` *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) # AWS::ObservabilityAdmin::OrganizationTelemetryRule TelemetryDestinationConfiguration Configuration specifying where and how telemetry data should be delivered for AWS resources. ## Syntax To declare this entity in your CloudFormation template, use the following syntax: ### JSON ``` { "[CloudtrailParameters](#cfn-observabilityadmin-organizationtelemetryrule-telemetrydestinationconfiguration-cloudtrailparameters)" : CloudtrailParameters, "[DestinationPattern](#cfn-observabilityadmin-organizationtelemetryrule-telemetrydestinationconfiguration-destinationpattern)" : String, "[DestinationType](#cfn-observabilityadmin-organizationtelemetryrule-telemetrydestinationconfiguration-destinationtype)" : String, "[ELBLoadBalancerLoggingParameters](#cfn-observabilityadmin-organizationtelemetryrule-telemetrydestinationconfiguration-elbloadbalancerloggingparameters)" : ELBLoadBalancerLoggingParameters, "[RetentionInDays](#cfn-observabilityadmin-organizationtelemetryrule-telemetrydestinationconfiguration-retentionindays)" : Integer, "[VPCFlowLogParameters](#cfn-observabilityadmin-organizationtelemetryrule-telemetrydestinationconfiguration-vpcflowlogparameters)" : VPCFlowLogParameters, "[WAFLoggingParameters](#cfn-observabilityadmin-organizationtelemetryrule-telemetrydestinationconfiguration-wafloggingparameters)" : WAFLoggingParameters } ``` ### YAML ``` [CloudtrailParameters](#cfn-observabilityadmin-organizationtelemetryrule-telemetrydestinationconfiguration-cloudtrailparameters): CloudtrailParameters [DestinationPattern](#cfn-observabilityadmin-organizationtelemetryrule-telemetrydestinationconfiguration-destinationpattern): String [DestinationType](#cfn-observabilityadmin-organizationtelemetryrule-telemetrydestinationconfiguration-destinationtype): String [ELBLoadBalancerLoggingParameters](#cfn-observabilityadmin-organizationtelemetryrule-telemetrydestinationconfiguration-elbloadbalancerloggingparameters): ELBLoadBalancerLoggingParameters [RetentionInDays](#cfn-observabilityadmin-organizationtelemetryrule-telemetrydestinationconfiguration-retentionindays): Integer [VPCFlowLogParameters](#cfn-observabilityadmin-organizationtelemetryrule-telemetrydestinationconfiguration-vpcflowlogparameters): VPCFlowLogParameters [WAFLoggingParameters](#cfn-observabilityadmin-organizationtelemetryrule-telemetrydestinationconfiguration-wafloggingparameters): WAFLoggingParameters ``` ## Properties `CloudtrailParameters` Configuration parameters specific to AWS CloudTrail when CloudTrail is the source type. *Required*: No *Type*: [CloudtrailParameters](aws-properties-observabilityadmin-organizationtelemetryrule-cloudtrailparameters.md) *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `DestinationPattern` The pattern used to generate the destination path or name, supporting macros like and . *Required*: No *Type*: String *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `DestinationType` The type of destination for the telemetry data (e.g., "Amazon CloudWatch Logs", "S3"). *Required*: No *Type*: String *Allowed values*: `cloud-watch-logs` *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `ELBLoadBalancerLoggingParameters` Configuration parameters specific to ELB load balancer logging when ELB is the resource type. *Required*: No *Type*: [ELBLoadBalancerLoggingParameters](aws-properties-observabilityadmin-organizationtelemetryrule-elbloadbalancerloggingparameters.md) *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `RetentionInDays` The number of days to retain the telemetry data in the destination. *Required*: No *Type*: Integer *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `VPCFlowLogParameters` Configuration parameters specific to VPC Flow Logs when VPC is the resource type. *Required*: No *Type*: [VPCFlowLogParameters](aws-properties-observabilityadmin-organizationtelemetryrule-vpcflowlogparameters.md) *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `WAFLoggingParameters` Configuration parameters specific to WAF logging when WAF is the resource type. *Required*: No *Type*: [WAFLoggingParameters](aws-properties-observabilityadmin-organizationtelemetryrule-wafloggingparameters.md) *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) # AWS::ObservabilityAdmin::OrganizationTelemetryRule TelemetryRule Defines how telemetry should be configured for specific AWS resources. ## Syntax To declare this entity in your CloudFormation template, use the following syntax: ### JSON ``` { "[DestinationConfiguration](#cfn-observabilityadmin-organizationtelemetryrule-telemetryrule-destinationconfiguration)" : TelemetryDestinationConfiguration, "[ResourceType](#cfn-observabilityadmin-organizationtelemetryrule-telemetryrule-resourcetype)" : String, "[Scope](#cfn-observabilityadmin-organizationtelemetryrule-telemetryrule-scope)" : String, "[SelectionCriteria](#cfn-observabilityadmin-organizationtelemetryrule-telemetryrule-selectioncriteria)" : String, "[TelemetrySourceTypes](#cfn-observabilityadmin-organizationtelemetryrule-telemetryrule-telemetrysourcetypes)" : [ String, ... ], "[TelemetryType](#cfn-observabilityadmin-organizationtelemetryrule-telemetryrule-telemetrytype)" : String } ``` ### YAML ``` [DestinationConfiguration](#cfn-observabilityadmin-organizationtelemetryrule-telemetryrule-destinationconfiguration): TelemetryDestinationConfiguration [ResourceType](#cfn-observabilityadmin-organizationtelemetryrule-telemetryrule-resourcetype): String [Scope](#cfn-observabilityadmin-organizationtelemetryrule-telemetryrule-scope): String [SelectionCriteria](#cfn-observabilityadmin-organizationtelemetryrule-telemetryrule-selectioncriteria): String [TelemetrySourceTypes](#cfn-observabilityadmin-organizationtelemetryrule-telemetryrule-telemetrysourcetypes): - String [TelemetryType](#cfn-observabilityadmin-organizationtelemetryrule-telemetryrule-telemetrytype): String ``` ## Properties `DestinationConfiguration` Configuration specifying where and how the telemetry data should be delivered. *Required*: No *Type*: [TelemetryDestinationConfiguration](aws-properties-observabilityadmin-organizationtelemetryrule-telemetrydestinationconfiguration.md) *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `ResourceType` The type of AWS resource to configure telemetry for (e.g., "AWS::EC2::VPC", "AWS::EKS::Cluster", "AWS::WAFv2::WebACL"). *Required*: Yes *Type*: String *Allowed values*: `AWS::EC2::VPC | AWS::WAFv2::WebACL | AWS::CloudTrail | AWS::EKS::Cluster | AWS::ElasticLoadBalancingV2::LoadBalancer | AWS::EC2::Instance` *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `Scope` The organizational scope to which the rule applies, specified using accounts or organizational units. *Required*: No *Type*: String *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `SelectionCriteria` Criteria for selecting which resources the rule applies to, such as resource tags. *Required*: No *Type*: String *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `TelemetrySourceTypes` The specific telemetry source types to configure for the resource, such as VPC\$1FLOW\$1LOGS or EKS\$1AUDIT\$1LOGS. TelemetrySourceTypes must be correlated with the specific resource type. *Required*: No *Type*: Array of String *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `TelemetryType` The type of telemetry to collect (Logs, Metrics, or Traces). *Required*: Yes *Type*: String *Allowed values*: `Logs | Metrics` *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) # AWS::ObservabilityAdmin::OrganizationTelemetryRule VPCFlowLogParameters Configuration parameters specific to VPC Flow Logs. ## Syntax To declare this entity in your CloudFormation template, use the following syntax: ### JSON ``` { "[LogFormat](#cfn-observabilityadmin-organizationtelemetryrule-vpcflowlogparameters-logformat)" : String, "[MaxAggregationInterval](#cfn-observabilityadmin-organizationtelemetryrule-vpcflowlogparameters-maxaggregationinterval)" : Integer, "[TrafficType](#cfn-observabilityadmin-organizationtelemetryrule-vpcflowlogparameters-traffictype)" : String } ``` ### YAML ``` [LogFormat](#cfn-observabilityadmin-organizationtelemetryrule-vpcflowlogparameters-logformat): String [MaxAggregationInterval](#cfn-observabilityadmin-organizationtelemetryrule-vpcflowlogparameters-maxaggregationinterval): Integer [TrafficType](#cfn-observabilityadmin-organizationtelemetryrule-vpcflowlogparameters-traffictype): String ``` ## Properties `LogFormat` The format in which VPC Flow Log entries should be logged. *Required*: No *Type*: String *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `MaxAggregationInterval` The maximum interval in seconds between the capture of flow log records. *Required*: No *Type*: Integer *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `TrafficType` The type of traffic to log (ACCEPT, REJECT, or ALL). *Required*: No *Type*: String *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) # AWS::ObservabilityAdmin::OrganizationTelemetryRule WAFLoggingParameters Configuration parameters for WAF logging, including redacted fields and logging filters. ## Syntax To declare this entity in your CloudFormation template, use the following syntax: ### JSON ``` { "[LoggingFilter](#cfn-observabilityadmin-organizationtelemetryrule-wafloggingparameters-loggingfilter)" : LoggingFilter, "[LogType](#cfn-observabilityadmin-organizationtelemetryrule-wafloggingparameters-logtype)" : String, "[RedactedFields](#cfn-observabilityadmin-organizationtelemetryrule-wafloggingparameters-redactedfields)" : [ FieldToMatch, ... ] } ``` ### YAML ``` [LoggingFilter](#cfn-observabilityadmin-organizationtelemetryrule-wafloggingparameters-loggingfilter): LoggingFilter [LogType](#cfn-observabilityadmin-organizationtelemetryrule-wafloggingparameters-logtype): String [RedactedFields](#cfn-observabilityadmin-organizationtelemetryrule-wafloggingparameters-redactedfields): - FieldToMatch ``` ## Properties `LoggingFilter` A filter configuration that determines which WAF log records to include or exclude. *Required*: No *Type*: [LoggingFilter](aws-properties-observabilityadmin-organizationtelemetryrule-loggingfilter.md) *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `LogType` The type of WAF logs to collect (currently supports WAF\$1LOGS). *Required*: No *Type*: String *Allowed values*: `WAF_LOGS` *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `RedactedFields` The fields to redact from WAF logs to protect sensitive information. *Required*: No *Type*: Array of [FieldToMatch](aws-properties-observabilityadmin-organizationtelemetryrule-fieldtomatch.md) *Maximum*: `100` *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) # AWS::ObservabilityAdmin::S3TableIntegration Creates an integration between CloudWatch and S3 Tables for analytics. This integration enables querying CloudWatch telemetry data using analytics engines like Amazon Athena, Amazon Redshift, and Apache Spark. ## Syntax To declare this entity in your CloudFormation template, use the following syntax: ### JSON ``` { "Type" : "AWS::ObservabilityAdmin::S3TableIntegration", "Properties" : { "[Encryption](#cfn-observabilityadmin-s3tableintegration-encryption)" : EncryptionConfig, "[LogSources](#cfn-observabilityadmin-s3tableintegration-logsources)" : [ LogSource, ... ], "[RoleArn](#cfn-observabilityadmin-s3tableintegration-rolearn)" : String, "[Tags](#cfn-observabilityadmin-s3tableintegration-tags)" : [ Tag, ... ] } } ``` ### YAML ``` Type: AWS::ObservabilityAdmin::S3TableIntegration Properties: [Encryption](#cfn-observabilityadmin-s3tableintegration-encryption): EncryptionConfig [LogSources](#cfn-observabilityadmin-s3tableintegration-logsources): - LogSource [RoleArn](#cfn-observabilityadmin-s3tableintegration-rolearn): String [Tags](#cfn-observabilityadmin-s3tableintegration-tags): - Tag ``` ## Properties `Encryption` Defines the encryption configuration for S3 Table integrations, including the encryption algorithm and KMS key settings. *Required*: Yes *Type*: [EncryptionConfig](aws-properties-observabilityadmin-s3tableintegration-encryptionconfig.md) *Update requires*: [Replacement](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-replacement) `LogSources` A data source with an S3 Table integration for query access in the `logs` namespace. *Required*: No *Type*: Array of [LogSource](aws-properties-observabilityadmin-s3tableintegration-logsource.md) *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `RoleArn` The Amazon Resource Name (ARN) of the IAM role that grants permissions for the S3 Table integration to access necessary resources. *Required*: Yes *Type*: String *Pattern*: `^arn:aws([a-z0-9\-]+)?:([a-zA-Z0-9\-]+):([a-z0-9\-]+)?:([0-9]{12})?:(.+)$` *Minimum*: `1` *Maximum*: `1011` *Update requires*: [Replacement](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-replacement) `Tags` The key-value pairs to associate with the S3 Table integration resource for categorization and management purposes. *Required*: No *Type*: Array of [Tag](aws-properties-observabilityadmin-s3tableintegration-tag.md) *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) ## Return values ### Ref The Amazon Resource Name (ARN) of the created S3 Table integration. ### Fn::GetAtt #### `Arn` The Amazon Resource Name (ARN) of the S3 Table integration. # AWS::ObservabilityAdmin::S3TableIntegration EncryptionConfig Defines the encryption configuration for S3 Table integrations, including the encryption algorithm and KMS key settings. ## Syntax To declare this entity in your CloudFormation template, use the following syntax: ### JSON ``` { "[KmsKeyArn](#cfn-observabilityadmin-s3tableintegration-encryptionconfig-kmskeyarn)" : String, "[SseAlgorithm](#cfn-observabilityadmin-s3tableintegration-encryptionconfig-ssealgorithm)" : String } ``` ### YAML ``` [KmsKeyArn](#cfn-observabilityadmin-s3tableintegration-encryptionconfig-kmskeyarn): String [SseAlgorithm](#cfn-observabilityadmin-s3tableintegration-encryptionconfig-ssealgorithm): String ``` ## Properties `KmsKeyArn` The Amazon Resource Name (ARN) of the KMS key used for encryption when using customer-managed keys. *Required*: No *Type*: String *Pattern*: `^arn:aws([a-z0-9\-]+)?:([a-zA-Z0-9\-]+):([a-z0-9\-]+)?:([0-9]{12})?:(.+)$` *Minimum*: `1` *Maximum*: `1011` *Update requires*: [Replacement](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-replacement) `SseAlgorithm` The server-side encryption algorithm used for encrypting data in the S3 Table integration. *Required*: Yes *Type*: String *Allowed values*: `AES256 | aws:kms` *Update requires*: [Replacement](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-replacement) # AWS::ObservabilityAdmin::S3TableIntegration LogSource A data source with an S3 Table integration for query access in the `logs` namespace. ## Syntax To declare this entity in your CloudFormation template, use the following syntax: ### JSON ``` { "[Identifier](#cfn-observabilityadmin-s3tableintegration-logsource-identifier)" : String, "[Name](#cfn-observabilityadmin-s3tableintegration-logsource-name)" : String, "[Type](#cfn-observabilityadmin-s3tableintegration-logsource-type)" : String } ``` ### YAML ``` [Identifier](#cfn-observabilityadmin-s3tableintegration-logsource-identifier): String [Name](#cfn-observabilityadmin-s3tableintegration-logsource-name): String [Type](#cfn-observabilityadmin-s3tableintegration-logsource-type): String ``` ## Properties `Identifier` The unique identifier for the association between the data source and S3 Table integration. *Required*: No *Type*: String *Minimum*: `1` *Maximum*: `256` *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `Name` The name of the data source. *Required*: Yes *Type*: String *Minimum*: `1` *Maximum*: `256` *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `Type` The type of the data source. *Required*: Yes *Type*: String *Minimum*: `1` *Maximum*: `256` *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) # AWS::ObservabilityAdmin::S3TableIntegration Tag The key-value pairs to associate with the S3 Table integration resource for categorization and management purposes. ## Syntax To declare this entity in your CloudFormation template, use the following syntax: ### JSON ``` { "[Key](#cfn-observabilityadmin-s3tableintegration-tag-key)" : String, "[Value](#cfn-observabilityadmin-s3tableintegration-tag-value)" : String } ``` ### YAML ``` [Key](#cfn-observabilityadmin-s3tableintegration-tag-key): String [Value](#cfn-observabilityadmin-s3tableintegration-tag-value): String ``` ## Properties `Key` One part of a key-value pair that makes up a tag associated with the S3 Table integration. A key is a general label that acts like a category for more specific tag values. *Required*: Yes *Type*: String *Minimum*: `1` *Maximum*: `128` *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `Value` One part of a key-value pair that makes up a tag associated with an S3 Table integration. A value acts as a descriptor within a tag category (key). The value can be empty or null. *Required*: Yes *Type*: String *Minimum*: `0` *Maximum*: `256` *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) # AWS::ObservabilityAdmin::TelemetryEnrichment The `AWS::ObservabilityAdmin::TelemetryEnrichment` resource Property description not available. for ObservabilityAdmin. ## Syntax To declare this entity in your CloudFormation template, use the following syntax: ### JSON ``` { "Type" : "AWS::ObservabilityAdmin::TelemetryEnrichment", "Properties" : { "[Scope](#cfn-observabilityadmin-telemetryenrichment-scope)" : String } } ``` ### YAML ``` Type: AWS::ObservabilityAdmin::TelemetryEnrichment Properties: [Scope](#cfn-observabilityadmin-telemetryenrichment-scope): String ``` ## Properties `Scope` Property description not available. *Required*: No *Type*: String *Allowed values*: `ACCOUNT` *Update requires*: [Replacement](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-replacement) ## Return values ### Ref ### Fn::GetAtt #### `Status` Property description not available. # AWS::ObservabilityAdmin::TelemetryPipelines Creates a telemetry pipeline for processing and transforming telemetry data. The pipeline defines how data flows from sources through processors to destinations, enabling data transformation and delivering capabilities. ## Syntax To declare this entity in your CloudFormation template, use the following syntax: ### JSON ``` { "Type" : "AWS::ObservabilityAdmin::TelemetryPipelines", "Properties" : { "[Configuration](#cfn-observabilityadmin-telemetrypipelines-configuration)" : TelemetryPipelineConfiguration, "[Name](#cfn-observabilityadmin-telemetrypipelines-name)" : String, "[Tags](#cfn-observabilityadmin-telemetrypipelines-tags)" : [ Tag, ... ] } } ``` ### YAML ``` Type: AWS::ObservabilityAdmin::TelemetryPipelines Properties: [Configuration](#cfn-observabilityadmin-telemetrypipelines-configuration): TelemetryPipelineConfiguration [Name](#cfn-observabilityadmin-telemetrypipelines-name): String [Tags](#cfn-observabilityadmin-telemetrypipelines-tags): - Tag ``` ## Properties `Configuration` The configuration that defines how the telemetry pipeline processes data, including sources, processors, and destinations. For more information, see the [Amazon CloudWatch User Guide](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Creating-pipelines.html). *Required*: Yes *Type*: [TelemetryPipelineConfiguration](aws-properties-observabilityadmin-telemetrypipelines-telemetrypipelineconfiguration.md) *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `Name` The name of the telemetry pipeline to create. The name must be unique within your account. *Required*: No *Type*: String *Pattern*: `[a-z][a-z0-9\-]+` *Minimum*: `3` *Maximum*: `28` *Update requires*: [Replacement](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-replacement) `Tags` The key-value pairs to associate with the telemetry pipeline resource for categorization and management purposes. *Required*: No *Type*: Array of [Tag](aws-properties-observabilityadmin-telemetrypipelines-tag.md) *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) ## Return values ### Ref The Amazon Resource Name (ARN) of the created telemetry pipeline. ### Fn::GetAtt #### `Arn` The Amazon Resource Name (ARN) of the created telemetry pipeline. `PipelineIdentifier` The Amazon Resource Name (ARN) of the telemetry pipeline. `Status` The current status of the telemetry pipeline. ## Examples **Topics** + [Using CloudWatch as a pipeline source](#aws-resource-observabilityadmin-telemetrypipelines--examples--Using_CloudWatch_as_a_pipeline_source) + [Using Amazon S3 as a pipeline source](#aws-resource-observabilityadmin-telemetrypipelines--examples--Using_Amazon_S3_as_a_pipeline_source) ### Using CloudWatch as a pipeline source The following is an example of a `Body` property value for the `Configuration` object. #### JSON ``` { "Type": "AWS::ObservabilityAdmin::TelemetryPipelines", "Properties": { "Configuration": { "Body": "pipeline:\n source:\n cloudwatch_logs:\n log_event_metadata:\n data_source_name: \"my_data_source\"\n data_source_type: \"default\"\n aws:\n sts_role_arn: \"arn:aws:iam::123456789012:role/MyPipelineAccessRole\"\n processor:\n - parse_json: {}\n sink:\n - cloudwatch_logs:\n log_group: \"@original\"" } } } ``` #### YAML ``` Type: AWS::ObservabilityAdmin::TelemetryPipelines Properties: Configuration: Body: | pipeline: source: cloudwatch_logs: log_event_metadata: data_source_name: "my_data_source" data_source_type: "default" aws: sts_role_arn: "arn:aws:iam::123456789012:role/MyPipelineAccessRole" processor: - parse_json: {} sink: - cloudwatch_logs: log_group: "@original" ``` ### Using Amazon S3 as a pipeline source The following is an example of a `Body` property value for the `Configuration` object. #### JSON ``` { "Type": "AWS::ObservabilityAdmin::TelemetryPipelines", "Properties": { "Configuration": { "Body": "pipeline:\n source:\n s3:\n sqs:\n visibility_timeout: \"PT60S\"\n visibility_duplication_protection: true\n maximum_messages: 10\n queue_url: \"https://sqs.us-east-1.amazonaws.com/123456789012/my-sqs-queue\"\n notification_type: \"sqs\"\n codec:\n ndjson: {}\n aws:\n region: \"us-east-1\"\n sts_role_arn: \"arn:aws:iam::123456789012:role/MyAccessRole\"\n data_source_name: \"crowdstrike_falcon\"\n processor:\n - ocsf:\n version: \"1.5\"\n mapping_version: \"1.5.0\"\n schema:\n crowdstrike_falcon:\n sink:\n - cloudwatch_logs:\n log_group: \"my-log-group\"" } } } ``` #### YAML ``` Type: AWS::ObservabilityAdmin::TelemetryPipelines Properties: Configuration: Body: | pipeline: source: s3: sqs: visibility_timeout: "PT60S" visibility_duplication_protection: true maximum_messages: 10 queue_url: "https://sqs.us-east-1.amazonaws.com/123456789012/my-sqs-queue" notification_type: "sqs" codec: ndjson: {} aws: region: "us-east-1" sts_role_arn: "arn:aws:iam::123456789012:role/MyAccessRole" data_source_name: "crowdstrike_falcon" processor: - ocsf: version: "1.5" mapping_version: "1.5.0" schema: crowdstrike_falcon: sink: - cloudwatch_logs: log_group: "my-log-group" ``` # AWS::ObservabilityAdmin::TelemetryPipelines Tag Lists all tags attached to the specified telemetry pipeline resource. ## Syntax To declare this entity in your CloudFormation template, use the following syntax: ### JSON ``` { "[Key](#cfn-observabilityadmin-telemetrypipelines-tag-key)" : String, "[Value](#cfn-observabilityadmin-telemetrypipelines-tag-value)" : String } ``` ### YAML ``` [Key](#cfn-observabilityadmin-telemetrypipelines-tag-key): String [Value](#cfn-observabilityadmin-telemetrypipelines-tag-value): String ``` ## Properties `Key` One part of a key-value pair that makes up a tag associated with the telemetry pipeline resource. A key is a general label that acts like a category for more specific tag values. *Required*: Yes *Type*: String *Minimum*: `1` *Maximum*: `128` *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `Value` One part of a key-value pair that makes up a tag associated with the telemetry pipeline resource. A value acts as a descriptor within a tag category (key). The value can be empty or null. *Required*: Yes *Type*: String *Minimum*: `0` *Maximum*: `256` *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) # AWS::ObservabilityAdmin::TelemetryPipelines TelemetryPipeline Represents a complete telemetry pipeline resource with configuration, status, and metadata for data processing and transformation. ## Syntax To declare this entity in your CloudFormation template, use the following syntax: ### JSON ``` { "[Arn](#cfn-observabilityadmin-telemetrypipelines-telemetrypipeline-arn)" : String, "[Configuration](#cfn-observabilityadmin-telemetrypipelines-telemetrypipeline-configuration)" : TelemetryPipelineConfiguration, "[CreatedTimeStamp](#cfn-observabilityadmin-telemetrypipelines-telemetrypipeline-createdtimestamp)" : Number, "[LastUpdateTimeStamp](#cfn-observabilityadmin-telemetrypipelines-telemetrypipeline-lastupdatetimestamp)" : Number, "[Name](#cfn-observabilityadmin-telemetrypipelines-telemetrypipeline-name)" : String, "[Status](#cfn-observabilityadmin-telemetrypipelines-telemetrypipeline-status)" : String, "[StatusReason](#cfn-observabilityadmin-telemetrypipelines-telemetrypipeline-statusreason)" : TelemetryPipelineStatusReason, "[Tags](#cfn-observabilityadmin-telemetrypipelines-telemetrypipeline-tags)" : [ Tag, ... ] } ``` ### YAML ``` [Arn](#cfn-observabilityadmin-telemetrypipelines-telemetrypipeline-arn): String [Configuration](#cfn-observabilityadmin-telemetrypipelines-telemetrypipeline-configuration): TelemetryPipelineConfiguration [CreatedTimeStamp](#cfn-observabilityadmin-telemetrypipelines-telemetrypipeline-createdtimestamp): Number [LastUpdateTimeStamp](#cfn-observabilityadmin-telemetrypipelines-telemetrypipeline-lastupdatetimestamp): Number [Name](#cfn-observabilityadmin-telemetrypipelines-telemetrypipeline-name): String [Status](#cfn-observabilityadmin-telemetrypipelines-telemetrypipeline-status): String [StatusReason](#cfn-observabilityadmin-telemetrypipelines-telemetrypipeline-statusreason): TelemetryPipelineStatusReason [Tags](#cfn-observabilityadmin-telemetrypipelines-telemetrypipeline-tags): - Tag ``` ## Properties `Arn` The Amazon Resource Name (ARN) of the telemetry pipeline. *Required*: No *Type*: String *Pattern*: `^arn:aws([a-z0-9\-]+)?:([a-zA-Z0-9\-]+):([a-z0-9\-]+)?:([0-9]{12})?:(.+)$` *Minimum*: `1` *Maximum*: `1011` *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `Configuration` The configuration that defines how the telemetry pipeline processes data. For more information, see the [Amazon CloudWatch User Guide](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Creating-pipelines.html). *Required*: No *Type*: [TelemetryPipelineConfiguration](aws-properties-observabilityadmin-telemetrypipelines-telemetrypipelineconfiguration.md) *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `CreatedTimeStamp` The timestamp when the telemetry pipeline was created. *Required*: No *Type*: Number *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `LastUpdateTimeStamp` The timestamp when the telemetry pipeline was last updated. *Required*: No *Type*: Number *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `Name` The name of the telemetry pipeline. *Required*: No *Type*: String *Pattern*: `[a-z][a-z0-9\-]+` *Minimum*: `3` *Maximum*: `28` *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `Status` The current status of the telemetry pipeline. *Required*: No *Type*: String *Allowed values*: `CREATING | ACTIVE | UPDATING | DELETING | CREATE_FAILED | UPDATE_FAILED` *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `StatusReason` Additional information about the pipeline status, including reasons for failure states. *Required*: No *Type*: [TelemetryPipelineStatusReason](aws-properties-observabilityadmin-telemetrypipelines-telemetrypipelinestatusreason.md) *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `Tags` The key-value pairs associated with the telemetry pipeline resource. *Required*: No *Type*: Array of [Tag](aws-properties-observabilityadmin-telemetrypipelines-tag.md) *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) # AWS::ObservabilityAdmin::TelemetryPipelines TelemetryPipelineConfiguration Defines the configuration for a pipeline, including how data flows from sources through processors to destinations. The configuration is specified in YAML format and must include a valid pipeline definition with required source and sink components. This pipeline enables end-to-end telemetry data collection, transformation, and delivery while supporting optional processing steps and extensions for enhanced functionality. The primary pipeline configuration section are: + **Source:** Defines where log data originates from (S3 buckets, CloudWatch Logs, third-party APIs). Each pipeline must have exactly one source. + **Processors (optional):** Transform, parse, and enrich log data as it flows through the pipeline. Processors are applied sequentially in the order they are defined. + **Sink:** Defines the destination where processed log data is sent. Each pipeline must have exactly one sink. + **Extensions (optional):** Provide additional functionality such as AWS Secrets Manager integration for credential management. For more details on each configuration section see [CloudWatch pipelines User Guide](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/cloudwatch-pipelines.html). Additional comprehensive configuration examples can be found in the [CreateTelemetryPipeline API docs](https://docs.aws.amazon.com/cloudwatch/latest/observabilityadmin/API_CreateTelemetryPipeline.html#API_CreateTelemetryPipeline_Examples). ## Syntax To declare this entity in your CloudFormation template, use the following syntax: ### JSON ``` { "[Body](#cfn-observabilityadmin-telemetrypipelines-telemetrypipelineconfiguration-body)" : String } ``` ### YAML ``` [Body](#cfn-observabilityadmin-telemetrypipelines-telemetrypipelineconfiguration-body): String ``` ## Properties `Body` The pipeline configuration body that defines the data processing rules and transformations. *Required*: Yes *Type*: String *Minimum*: `1` *Maximum*: `24000` *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) # AWS::ObservabilityAdmin::TelemetryPipelines TelemetryPipelineStatusReason Provides detailed information about the status of a telemetry pipeline, including reasons for specific states. ## Syntax To declare this entity in your CloudFormation template, use the following syntax: ### JSON ``` { "[Description](#cfn-observabilityadmin-telemetrypipelines-telemetrypipelinestatusreason-description)" : String } ``` ### YAML ``` [Description](#cfn-observabilityadmin-telemetrypipelines-telemetrypipelinestatusreason-description): String ``` ## Properties `Description` A description of the pipeline status reason, providing additional context about the current state. *Required*: No *Type*: String *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) # AWS::ObservabilityAdmin::TelemetryRule Creates a telemetry rule that defines how telemetry should be configured for AWS resources in your account. The rule specifies which resources should have telemetry enabled and how that telemetry data should be collected based on resource type, telemetry type, and selection criteria. ## Syntax To declare this entity in your CloudFormation template, use the following syntax: ### JSON ``` { "Type" : "AWS::ObservabilityAdmin::TelemetryRule", "Properties" : { "[Rule](#cfn-observabilityadmin-telemetryrule-rule)" : TelemetryRule, "[RuleName](#cfn-observabilityadmin-telemetryrule-rulename)" : String, "[Tags](#cfn-observabilityadmin-telemetryrule-tags)" : [ Tag, ... ] } } ``` ### YAML ``` Type: AWS::ObservabilityAdmin::TelemetryRule Properties: [Rule](#cfn-observabilityadmin-telemetryrule-rule): TelemetryRule [RuleName](#cfn-observabilityadmin-telemetryrule-rulename): String [Tags](#cfn-observabilityadmin-telemetryrule-tags): - Tag ``` ## Properties `Rule` Retrieves the details of a specific telemetry rule in your account. *Required*: Yes *Type*: [TelemetryRule](aws-properties-observabilityadmin-telemetryrule-telemetryrule.md) *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `RuleName` The name of the telemetry rule. *Required*: Yes *Type*: String *Pattern*: `^[0-9A-Za-z-]+$` *Minimum*: `1` *Maximum*: `100` *Update requires*: [Replacement](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-replacement) `Tags` Lists all tags attached to the specified resource. Supports telemetry rule resources and telemetry pipeline resources. *Required*: No *Type*: Array of [Tag](aws-properties-observabilityadmin-telemetryrule-tag.md) *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) ## Return values ### Ref ### Fn::GetAtt #### `RuleArn` The Amazon Resource Name (ARN) of the telemetry rule. # AWS::ObservabilityAdmin::TelemetryRule ActionCondition Condition that matches based on the specific WAF action taken on the request. ## Syntax To declare this entity in your CloudFormation template, use the following syntax: ### JSON ``` { "[Action](#cfn-observabilityadmin-telemetryrule-actioncondition-action)" : String } ``` ### YAML ``` [Action](#cfn-observabilityadmin-telemetryrule-actioncondition-action): String ``` ## Properties `Action` The WAF action to match against (ALLOW, BLOCK, COUNT, CAPTCHA, CHALLENGE, EXCLUDED\$1AS\$1COUNT). *Required*: No *Type*: String *Allowed values*: `ALLOW | BLOCK | COUNT | CAPTCHA | CHALLENGE | EXCLUDED_AS_COUNT` *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) # AWS::ObservabilityAdmin::TelemetryRule AdvancedEventSelector Advanced event selectors let you create fine-grained selectors for management, data, and network activity events. ## Syntax To declare this entity in your CloudFormation template, use the following syntax: ### JSON ``` { "[FieldSelectors](#cfn-observabilityadmin-telemetryrule-advancedeventselector-fieldselectors)" : [ AdvancedFieldSelector, ... ], "[Name](#cfn-observabilityadmin-telemetryrule-advancedeventselector-name)" : String } ``` ### YAML ``` [FieldSelectors](#cfn-observabilityadmin-telemetryrule-advancedeventselector-fieldselectors): - AdvancedFieldSelector [Name](#cfn-observabilityadmin-telemetryrule-advancedeventselector-name): String ``` ## Properties `FieldSelectors` Contains all selector statements in an advanced event selector. *Required*: Yes *Type*: Array of [AdvancedFieldSelector](aws-properties-observabilityadmin-telemetryrule-advancedfieldselector.md) *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `Name` An optional, descriptive name for an advanced event selector, such as "Log data events for only two S3 buckets". *Required*: No *Type*: String *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) # AWS::ObservabilityAdmin::TelemetryRule AdvancedFieldSelector Defines criteria for selecting resources based on field values. ## Syntax To declare this entity in your CloudFormation template, use the following syntax: ### JSON ``` { "[EndsWith](#cfn-observabilityadmin-telemetryrule-advancedfieldselector-endswith)" : [ String, ... ], "[Equals](#cfn-observabilityadmin-telemetryrule-advancedfieldselector-equals)" : [ String, ... ], "[Field](#cfn-observabilityadmin-telemetryrule-advancedfieldselector-field)" : String, "[NotEndsWith](#cfn-observabilityadmin-telemetryrule-advancedfieldselector-notendswith)" : [ String, ... ], "[NotEquals](#cfn-observabilityadmin-telemetryrule-advancedfieldselector-notequals)" : [ String, ... ], "[NotStartsWith](#cfn-observabilityadmin-telemetryrule-advancedfieldselector-notstartswith)" : [ String, ... ], "[StartsWith](#cfn-observabilityadmin-telemetryrule-advancedfieldselector-startswith)" : [ String, ... ] } ``` ### YAML ``` [EndsWith](#cfn-observabilityadmin-telemetryrule-advancedfieldselector-endswith): - String [Equals](#cfn-observabilityadmin-telemetryrule-advancedfieldselector-equals): - String [Field](#cfn-observabilityadmin-telemetryrule-advancedfieldselector-field): String [NotEndsWith](#cfn-observabilityadmin-telemetryrule-advancedfieldselector-notendswith): - String [NotEquals](#cfn-observabilityadmin-telemetryrule-advancedfieldselector-notequals): - String [NotStartsWith](#cfn-observabilityadmin-telemetryrule-advancedfieldselector-notstartswith): - String [StartsWith](#cfn-observabilityadmin-telemetryrule-advancedfieldselector-startswith): - String ``` ## Properties `EndsWith` Matches if the field value ends with the specified value. *Required*: No *Type*: Array of String *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `Equals` Matches if the field value equals the specified value. *Required*: No *Type*: Array of String *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `Field` The name of the field to use for selection. *Required*: No *Type*: String *Minimum*: `1` *Maximum*: `1000` *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `NotEndsWith` Matches if the field value does not end with the specified value. *Required*: No *Type*: Array of String *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `NotEquals` Matches if the field value does not equal the specified value. *Required*: No *Type*: Array of String *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `NotStartsWith` Matches if the field value does not start with the specified value. *Required*: No *Type*: Array of String *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `StartsWith` Matches if the field value starts with the specified value. *Required*: No *Type*: Array of String *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) # AWS::ObservabilityAdmin::TelemetryRule CloudtrailParameters Parameters specific to AWS CloudTrail telemetry configuration. ## Syntax To declare this entity in your CloudFormation template, use the following syntax: ### JSON ``` { "[AdvancedEventSelectors](#cfn-observabilityadmin-telemetryrule-cloudtrailparameters-advancedeventselectors)" : [ AdvancedEventSelector, ... ] } ``` ### YAML ``` [AdvancedEventSelectors](#cfn-observabilityadmin-telemetryrule-cloudtrailparameters-advancedeventselectors): - AdvancedEventSelector ``` ## Properties `AdvancedEventSelectors` The advanced event selectors to use for filtering AWS CloudTrail events. *Required*: Yes *Type*: Array of [AdvancedEventSelector](aws-properties-observabilityadmin-telemetryrule-advancedeventselector.md) *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) # AWS::ObservabilityAdmin::TelemetryRule Condition A single condition that can match based on WAF rule action or label name. ## Syntax To declare this entity in your CloudFormation template, use the following syntax: ### JSON ``` { "[ActionCondition](#cfn-observabilityadmin-telemetryrule-condition-actioncondition)" : ActionCondition, "[LabelNameCondition](#cfn-observabilityadmin-telemetryrule-condition-labelnamecondition)" : LabelNameCondition } ``` ### YAML ``` [ActionCondition](#cfn-observabilityadmin-telemetryrule-condition-actioncondition): ActionCondition [LabelNameCondition](#cfn-observabilityadmin-telemetryrule-condition-labelnamecondition): LabelNameCondition ``` ## Properties `ActionCondition` Matches log records based on the WAF rule action taken (ALLOW, BLOCK, COUNT, etc.). *Required*: No *Type*: [ActionCondition](aws-properties-observabilityadmin-telemetryrule-actioncondition.md) *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `LabelNameCondition` Matches log records based on WAF rule labels applied to the request. *Required*: No *Type*: [LabelNameCondition](aws-properties-observabilityadmin-telemetryrule-labelnamecondition.md) *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) # AWS::ObservabilityAdmin::TelemetryRule ELBLoadBalancerLoggingParameters Configuration parameters for ELB load balancer logging, including output format and field delimiter settings. ## Syntax To declare this entity in your CloudFormation template, use the following syntax: ### JSON ``` { "[FieldDelimiter](#cfn-observabilityadmin-telemetryrule-elbloadbalancerloggingparameters-fielddelimiter)" : String, "[OutputFormat](#cfn-observabilityadmin-telemetryrule-elbloadbalancerloggingparameters-outputformat)" : String } ``` ### YAML ``` [FieldDelimiter](#cfn-observabilityadmin-telemetryrule-elbloadbalancerloggingparameters-fielddelimiter): String [OutputFormat](#cfn-observabilityadmin-telemetryrule-elbloadbalancerloggingparameters-outputformat): String ``` ## Properties `FieldDelimiter` The delimiter character used to separate fields in ELB access log entries when using plain text format. *Required*: No *Type*: String *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `OutputFormat` The format for ELB access log entries (plain text or JSON format). *Required*: No *Type*: String *Allowed values*: `plain | json` *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) # AWS::ObservabilityAdmin::TelemetryRule FieldToMatch Specifies a field in the request to redact from WAF logs, such as headers, query parameters, or body content. ## Syntax To declare this entity in your CloudFormation template, use the following syntax: ### JSON ``` { "[Method](#cfn-observabilityadmin-telemetryrule-fieldtomatch-method)" : String, "[QueryString](#cfn-observabilityadmin-telemetryrule-fieldtomatch-querystring)" : String, "[SingleHeader](#cfn-observabilityadmin-telemetryrule-fieldtomatch-singleheader)" : SingleHeader, "[UriPath](#cfn-observabilityadmin-telemetryrule-fieldtomatch-uripath)" : String } ``` ### YAML ``` [Method](#cfn-observabilityadmin-telemetryrule-fieldtomatch-method): String [QueryString](#cfn-observabilityadmin-telemetryrule-fieldtomatch-querystring): String [SingleHeader](#cfn-observabilityadmin-telemetryrule-fieldtomatch-singleheader): SingleHeader [UriPath](#cfn-observabilityadmin-telemetryrule-fieldtomatch-uripath): String ``` ## Properties `Method` Redacts the HTTP method from WAF logs. *Required*: No *Type*: String *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `QueryString` Redacts the entire query string from WAF logs. *Required*: No *Type*: String *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `SingleHeader` Redacts a specific header field by name from WAF logs. *Required*: No *Type*: [SingleHeader](aws-properties-observabilityadmin-telemetryrule-singleheader.md) *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `UriPath` Redacts the URI path from WAF logs. *Required*: No *Type*: String *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) # AWS::ObservabilityAdmin::TelemetryRule Filter A single filter condition that specifies behavior, requirement, and matching conditions for WAF log records. ## Syntax To declare this entity in your CloudFormation template, use the following syntax: ### JSON ``` { "[Behavior](#cfn-observabilityadmin-telemetryrule-filter-behavior)" : String, "[Conditions](#cfn-observabilityadmin-telemetryrule-filter-conditions)" : [ Condition, ... ], "[Requirement](#cfn-observabilityadmin-telemetryrule-filter-requirement)" : String } ``` ### YAML ``` [Behavior](#cfn-observabilityadmin-telemetryrule-filter-behavior): String [Conditions](#cfn-observabilityadmin-telemetryrule-filter-conditions): - Condition [Requirement](#cfn-observabilityadmin-telemetryrule-filter-requirement): String ``` ## Properties `Behavior` The action to take for log records matching this filter (KEEP or DROP). *Required*: No *Type*: String *Allowed values*: `KEEP | DROP` *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `Conditions` The list of conditions that determine if a log record matches this filter. *Required*: No *Type*: Array of [Condition](aws-properties-observabilityadmin-telemetryrule-condition.md) *Minimum*: `1` *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `Requirement` Whether the log record must meet all conditions (MEETS\$1ALL) or any condition (MEETS\$1ANY) to match this filter. *Required*: No *Type*: String *Allowed values*: `MEETS_ALL | MEETS_ANY` *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) # AWS::ObservabilityAdmin::TelemetryRule LabelNameCondition Condition that matches based on WAF rule labels, with label names limited to 1024 characters. ## Syntax To declare this entity in your CloudFormation template, use the following syntax: ### JSON ``` { "[LabelName](#cfn-observabilityadmin-telemetryrule-labelnamecondition-labelname)" : String } ``` ### YAML ``` [LabelName](#cfn-observabilityadmin-telemetryrule-labelnamecondition-labelname): String ``` ## Properties `LabelName` The label name to match, supporting alphanumeric characters, underscores, hyphens, and colons. *Required*: No *Type*: String *Pattern*: `^[0-9A-Za-z_\-:]+$` *Minimum*: `1` *Maximum*: `1024` *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) # AWS::ObservabilityAdmin::TelemetryRule LogDeliveryParameters Configuration parameters for Amazon Bedrock AgentCore logging, including `logType` settings. ## Syntax To declare this entity in your CloudFormation template, use the following syntax: ### JSON ``` { "[LogTypes](#cfn-observabilityadmin-telemetryrule-logdeliveryparameters-logtypes)" : [ String, ... ] } ``` ### YAML ``` [LogTypes](#cfn-observabilityadmin-telemetryrule-logdeliveryparameters-logtypes): - String ``` ## Properties `LogTypes` The type of log that the source is sending. *Required*: No *Type*: Array of String *Allowed values*: `APPLICATION_LOGS | USAGE_LOGS` *Minimum*: `1` *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) # AWS::ObservabilityAdmin::TelemetryRule LoggingFilter Configuration that determines which WAF log records to keep or drop based on specified conditions. ## Syntax To declare this entity in your CloudFormation template, use the following syntax: ### JSON ``` { "[DefaultBehavior](#cfn-observabilityadmin-telemetryrule-loggingfilter-defaultbehavior)" : String, "[Filters](#cfn-observabilityadmin-telemetryrule-loggingfilter-filters)" : [ Filter, ... ] } ``` ### YAML ``` [DefaultBehavior](#cfn-observabilityadmin-telemetryrule-loggingfilter-defaultbehavior): String [Filters](#cfn-observabilityadmin-telemetryrule-loggingfilter-filters): - Filter ``` ## Properties `DefaultBehavior` The default action (KEEP or DROP) for log records that don't match any filter conditions. *Required*: No *Type*: String *Allowed values*: `KEEP | DROP` *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `Filters` A list of filter conditions that determine log record handling behavior. *Required*: No *Type*: Array of [Filter](aws-properties-observabilityadmin-telemetryrule-filter.md) *Minimum*: `1` *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) # AWS::ObservabilityAdmin::TelemetryRule SingleHeader Structure containing a name field limited to 64 characters for header or query parameter identification. ## Syntax To declare this entity in your CloudFormation template, use the following syntax: ### JSON ``` { "[Name](#cfn-observabilityadmin-telemetryrule-singleheader-name)" : String } ``` ### YAML ``` [Name](#cfn-observabilityadmin-telemetryrule-singleheader-name): String ``` ## Properties `Name` The name value, limited to 64 characters. *Required*: Yes *Type*: String *Minimum*: `1` *Maximum*: `64` *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) # AWS::ObservabilityAdmin::TelemetryRule Tag Lists all tags attached to the specified resource. Supports telemetry rule resources and telemetry pipeline resources. ## Syntax To declare this entity in your CloudFormation template, use the following syntax: ### JSON ``` { "[Key](#cfn-observabilityadmin-telemetryrule-tag-key)" : String, "[Value](#cfn-observabilityadmin-telemetryrule-tag-value)" : String } ``` ### YAML ``` [Key](#cfn-observabilityadmin-telemetryrule-tag-key): String [Value](#cfn-observabilityadmin-telemetryrule-tag-value): String ``` ## Properties `Key` One part of a key-value pair that makes up a tag associated with the telemetry rule resource. A key is a general label that acts like a category for more specific tag values. *Required*: Yes *Type*: String *Minimum*: `1` *Maximum*: `128` *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `Value` One part of a key-value pair that make up a tag associated with the telemetry rule resource. A value acts as a descriptor within a tag category (key). The value can be empty or null. *Required*: Yes *Type*: String *Minimum*: `0` *Maximum*: `256` *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) # AWS::ObservabilityAdmin::TelemetryRule TelemetryDestinationConfiguration Configuration specifying where and how telemetry data should be delivered for AWS resources. ## Syntax To declare this entity in your CloudFormation template, use the following syntax: ### JSON ``` { "[CloudtrailParameters](#cfn-observabilityadmin-telemetryrule-telemetrydestinationconfiguration-cloudtrailparameters)" : CloudtrailParameters, "[DestinationPattern](#cfn-observabilityadmin-telemetryrule-telemetrydestinationconfiguration-destinationpattern)" : String, "[DestinationType](#cfn-observabilityadmin-telemetryrule-telemetrydestinationconfiguration-destinationtype)" : String, "[ELBLoadBalancerLoggingParameters](#cfn-observabilityadmin-telemetryrule-telemetrydestinationconfiguration-elbloadbalancerloggingparameters)" : ELBLoadBalancerLoggingParameters, "[LogDeliveryParameters](#cfn-observabilityadmin-telemetryrule-telemetrydestinationconfiguration-logdeliveryparameters)" : LogDeliveryParameters, "[RetentionInDays](#cfn-observabilityadmin-telemetryrule-telemetrydestinationconfiguration-retentionindays)" : Integer, "[VPCFlowLogParameters](#cfn-observabilityadmin-telemetryrule-telemetrydestinationconfiguration-vpcflowlogparameters)" : VPCFlowLogParameters, "[WAFLoggingParameters](#cfn-observabilityadmin-telemetryrule-telemetrydestinationconfiguration-wafloggingparameters)" : WAFLoggingParameters } ``` ### YAML ``` [CloudtrailParameters](#cfn-observabilityadmin-telemetryrule-telemetrydestinationconfiguration-cloudtrailparameters): CloudtrailParameters [DestinationPattern](#cfn-observabilityadmin-telemetryrule-telemetrydestinationconfiguration-destinationpattern): String [DestinationType](#cfn-observabilityadmin-telemetryrule-telemetrydestinationconfiguration-destinationtype): String [ELBLoadBalancerLoggingParameters](#cfn-observabilityadmin-telemetryrule-telemetrydestinationconfiguration-elbloadbalancerloggingparameters): ELBLoadBalancerLoggingParameters [LogDeliveryParameters](#cfn-observabilityadmin-telemetryrule-telemetrydestinationconfiguration-logdeliveryparameters): LogDeliveryParameters [RetentionInDays](#cfn-observabilityadmin-telemetryrule-telemetrydestinationconfiguration-retentionindays): Integer [VPCFlowLogParameters](#cfn-observabilityadmin-telemetryrule-telemetrydestinationconfiguration-vpcflowlogparameters): VPCFlowLogParameters [WAFLoggingParameters](#cfn-observabilityadmin-telemetryrule-telemetrydestinationconfiguration-wafloggingparameters): WAFLoggingParameters ``` ## Properties `CloudtrailParameters` Configuration parameters specific to AWS CloudTrail when CloudTrail is the source type. *Required*: No *Type*: [CloudtrailParameters](aws-properties-observabilityadmin-telemetryrule-cloudtrailparameters.md) *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `DestinationPattern` The pattern used to generate the destination path or name, supporting macros like and . *Required*: No *Type*: String *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `DestinationType` The type of destination for the telemetry data (e.g., "Amazon CloudWatch Logs", "S3"). *Required*: No *Type*: String *Allowed values*: `cloud-watch-logs` *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `ELBLoadBalancerLoggingParameters` Configuration parameters specific to ELB load balancer logging when ELB is the resource type. *Required*: No *Type*: [ELBLoadBalancerLoggingParameters](aws-properties-observabilityadmin-telemetryrule-elbloadbalancerloggingparameters.md) *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `LogDeliveryParameters` Configuration parameters specific to Amazon Bedrock AgentCore logging when Amazon Bedrock AgentCore is the resource type. *Required*: No *Type*: [LogDeliveryParameters](aws-properties-observabilityadmin-telemetryrule-logdeliveryparameters.md) *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `RetentionInDays` The number of days to retain the telemetry data in the destination. *Required*: No *Type*: Integer *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `VPCFlowLogParameters` Configuration parameters specific to VPC Flow Logs when VPC is the resource type. *Required*: No *Type*: [VPCFlowLogParameters](aws-properties-observabilityadmin-telemetryrule-vpcflowlogparameters.md) *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `WAFLoggingParameters` Configuration parameters specific to WAF logging when WAF is the resource type. *Required*: No *Type*: [WAFLoggingParameters](aws-properties-observabilityadmin-telemetryrule-wafloggingparameters.md) *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) # AWS::ObservabilityAdmin::TelemetryRule TelemetryRule Defines how telemetry should be configured for specific AWS resources. ## Syntax To declare this entity in your CloudFormation template, use the following syntax: ### JSON ``` { "[DestinationConfiguration](#cfn-observabilityadmin-telemetryrule-telemetryrule-destinationconfiguration)" : TelemetryDestinationConfiguration, "[ResourceType](#cfn-observabilityadmin-telemetryrule-telemetryrule-resourcetype)" : String, "[SelectionCriteria](#cfn-observabilityadmin-telemetryrule-telemetryrule-selectioncriteria)" : String, "[TelemetrySourceTypes](#cfn-observabilityadmin-telemetryrule-telemetryrule-telemetrysourcetypes)" : [ String, ... ], "[TelemetryType](#cfn-observabilityadmin-telemetryrule-telemetryrule-telemetrytype)" : String } ``` ### YAML ``` [DestinationConfiguration](#cfn-observabilityadmin-telemetryrule-telemetryrule-destinationconfiguration): TelemetryDestinationConfiguration [ResourceType](#cfn-observabilityadmin-telemetryrule-telemetryrule-resourcetype): String [SelectionCriteria](#cfn-observabilityadmin-telemetryrule-telemetryrule-selectioncriteria): String [TelemetrySourceTypes](#cfn-observabilityadmin-telemetryrule-telemetryrule-telemetrysourcetypes): - String [TelemetryType](#cfn-observabilityadmin-telemetryrule-telemetryrule-telemetrytype): String ``` ## Properties `DestinationConfiguration` Configuration specifying where and how the telemetry data should be delivered. *Required*: No *Type*: [TelemetryDestinationConfiguration](aws-properties-observabilityadmin-telemetryrule-telemetrydestinationconfiguration.md) *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `ResourceType` The type of AWS resource to configure telemetry for (e.g., "AWS::EC2::VPC", "AWS::EKS::Cluster", "AWS::WAFv2::WebACL"). *Required*: Yes *Type*: String *Allowed values*: `AWS::EC2::VPC | AWS::WAFv2::WebACL | AWS::CloudTrail | AWS::EKS::Cluster | AWS::ElasticLoadBalancingV2::LoadBalancer | AWS::EC2::Instance | AWS::BedrockAgentCore::Runtime | AWS::BedrockAgentCore::Browser | AWS::BedrockAgentCore::CodeInterpreter` *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `SelectionCriteria` Criteria for selecting which resources the rule applies to, such as resource tags. *Required*: No *Type*: String *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `TelemetrySourceTypes` The specific telemetry source types to configure for the resource, such as VPC\$1FLOW\$1LOGS or EKS\$1AUDIT\$1LOGS. TelemetrySourceTypes must be correlated with the specific resource type. *Required*: No *Type*: Array of String *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `TelemetryType` The type of telemetry to collect (Logs, Metrics, or Traces). *Required*: Yes *Type*: String *Allowed values*: `Logs | Traces | Metrics` *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) # AWS::ObservabilityAdmin::TelemetryRule VPCFlowLogParameters Configuration parameters specific to VPC Flow Logs. ## Syntax To declare this entity in your CloudFormation template, use the following syntax: ### JSON ``` { "[LogFormat](#cfn-observabilityadmin-telemetryrule-vpcflowlogparameters-logformat)" : String, "[MaxAggregationInterval](#cfn-observabilityadmin-telemetryrule-vpcflowlogparameters-maxaggregationinterval)" : Integer, "[TrafficType](#cfn-observabilityadmin-telemetryrule-vpcflowlogparameters-traffictype)" : String } ``` ### YAML ``` [LogFormat](#cfn-observabilityadmin-telemetryrule-vpcflowlogparameters-logformat): String [MaxAggregationInterval](#cfn-observabilityadmin-telemetryrule-vpcflowlogparameters-maxaggregationinterval): Integer [TrafficType](#cfn-observabilityadmin-telemetryrule-vpcflowlogparameters-traffictype): String ``` ## Properties `LogFormat` The format in which VPC Flow Log entries should be logged. *Required*: No *Type*: String *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `MaxAggregationInterval` The maximum interval in seconds between the capture of flow log records. *Required*: No *Type*: Integer *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `TrafficType` The type of traffic to log (ACCEPT, REJECT, or ALL). *Required*: No *Type*: String *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) # AWS::ObservabilityAdmin::TelemetryRule WAFLoggingParameters Configuration parameters for WAF logging, including redacted fields and logging filters. ## Syntax To declare this entity in your CloudFormation template, use the following syntax: ### JSON ``` { "[LoggingFilter](#cfn-observabilityadmin-telemetryrule-wafloggingparameters-loggingfilter)" : LoggingFilter, "[LogType](#cfn-observabilityadmin-telemetryrule-wafloggingparameters-logtype)" : String, "[RedactedFields](#cfn-observabilityadmin-telemetryrule-wafloggingparameters-redactedfields)" : [ FieldToMatch, ... ] } ``` ### YAML ``` [LoggingFilter](#cfn-observabilityadmin-telemetryrule-wafloggingparameters-loggingfilter): LoggingFilter [LogType](#cfn-observabilityadmin-telemetryrule-wafloggingparameters-logtype): String [RedactedFields](#cfn-observabilityadmin-telemetryrule-wafloggingparameters-redactedfields): - FieldToMatch ``` ## Properties `LoggingFilter` A filter configuration that determines which WAF log records to include or exclude. *Required*: No *Type*: [LoggingFilter](aws-properties-observabilityadmin-telemetryrule-loggingfilter.md) *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `LogType` The type of WAF logs to collect (currently supports WAF\$1LOGS). *Required*: No *Type*: String *Allowed values*: `WAF_LOGS` *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `RedactedFields` The fields to redact from WAF logs to protect sensitive information. *Required*: No *Type*: Array of [FieldToMatch](aws-properties-observabilityadmin-telemetryrule-fieldtomatch.md) *Maximum*: `100` *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)