Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow Usage of sessionCredentialFromConsole in Data Store Selectors #41704

Open
wants to merge 2 commits into
base: main
Choose a base branch
from

Conversation

hi-artem
Copy link
Contributor

@hi-artem hi-artem commented Mar 6, 2025

Description

Add a field allowed by AWS Cloudtrail API and described in this documentation https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_AdvancedEventSelector.html

Similar to #40629

Currently, the following Terraform resource should be valid:

resource "aws_cloudtrail_event_data_store" "dynamodb_events_data_store" {
  name = "dynamodb-events-data-store"

  advanced_event_selector {
    name = "Log all DynamoDB data events emitted by AWS Console users"

    field_selector {
      field  = "eventCategory"
      equals = ["Data"]
    }

    field_selector {
      field  = "resources.type"
      equals = ["AWS::DynamoDB::Table"]
    }

    field_selector {
      field  = "sessionCredentialFromConsole"
      equals = ["true"]
    }
  }
}

However, the plan fails due to:

╷
│ Error: expected advanced_event_selector.1.field_selector.2.field to be one of ["eventCategory" "eventName" "eventSource" "readOnly" "resources.ARN" "resources.type" "userIdentity.arn"], got sessionCredentialFromConsole
│ 
│   with aws_cloudtrail_event_data_store.dynamodb_events_data_store,
│   on cloudtrail.tf line 44, in resource "aws_cloudtrail_event_data_store" "dynamodb_events_data_store":
│   44:   advanced_event_selector {

@hi-artem hi-artem requested a review from a team as a code owner March 6, 2025 19:35
Copy link

github-actions bot commented Mar 6, 2025

Community Guidelines

This comment is added to every new Pull Request to provide quick reference to how the Terraform AWS Provider is maintained. Please review the information below, and thank you for contributing to the community that keeps the provider thriving! 🚀

Voting for Prioritization

  • Please vote on this Pull Request by adding a 👍 reaction to the original post to help the community and maintainers prioritize it.
  • Please see our prioritization guide for additional information on how the maintainers handle prioritization.
  • Please do not leave +1 or other comments that do not add relevant new information or questions; they generate extra noise for others following the Pull Request and do not help prioritize the request.

Pull Request Authors

  • Review the contribution guide relating to the type of change you are making to ensure all of the necessary steps have been taken.
  • Whether or not the branch has been rebased will not impact prioritization, but doing so is always a welcome surprise.

@github-actions github-actions bot added needs-triage Waiting for first response or review from a maintainer. service/cloudtrail Issues and PRs that pertain to the cloudtrail service. size/XS Managed by automation to categorize the size of a PR. labels Mar 6, 2025
@justinretzolk justinretzolk added enhancement Requests to existing resources that expand the functionality or scope. and removed needs-triage Waiting for first response or review from a maintainer. labels Mar 6, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement Requests to existing resources that expand the functionality or scope. service/cloudtrail Issues and PRs that pertain to the cloudtrail service. size/XS Managed by automation to categorize the size of a PR.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants