Guides

LOGS

Suggest Edits
docs.aws.amazon.com
AWS documentation

AssociateKmsKey

valid {
    input.Body.logGroupName == STRING
    input.Body.kmsKeyId == STRING
    input.Body.resourceIdentifier == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

CancelExportTask

valid {
    input.Body.taskId == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

CreateDelivery

valid {
    input.Body.deliverySourceName == STRING
    input.Body.deliveryDestinationArn == STRING
    input.Body.recordFields[_] == STRING
    input.Body.fieldDelimiter == STRING
    input.Body.s3DeliveryConfiguration.suffixPath == STRING
    input.Body.s3DeliveryConfiguration.enableHiveCompatiblePath == BOOLEAN
    input.Body.tags.STRING == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

CreateExportTask

valid {
    input.Body.taskName == STRING
    input.Body.logGroupName == STRING
    input.Body.logStreamNamePrefix == STRING
    input.Body.from == LONG
    input.Body.to == LONG
    input.Body.destination == STRING
    input.Body.destinationPrefix == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

CreateLogAnomalyDetector

enum_EvaluationFrequency := [ "ONE_MIN", "FIVE_MIN", "TEN_MIN", "FIFTEEN_MIN", "THIRTY_MIN", "ONE_HOUR" ]

valid {
    input.Body.logGroupArnList[_] == STRING
    input.Body.detectorName == STRING
    input.Body.evaluationFrequency == enum_EvaluationFrequency[_]
    input.Body.filterPattern == STRING
    input.Body.kmsKeyId == STRING
    input.Body.anomalyVisibilityTime == LONG
    input.Body.tags.STRING == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

CreateLogGroup

enum_LogGroupClass := [ "STANDARD", "INFREQUENT_ACCESS" ]

valid {
    input.Body.logGroupName == STRING
    input.Body.kmsKeyId == STRING
    input.Body.tags.STRING == STRING
    input.Body.logGroupClass == enum_LogGroupClass[_]
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

CreateLogStream

valid {
    input.Body.logGroupName == STRING
    input.Body.logStreamName == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

DeleteAccountPolicy

enum_PolicyType := [ "DATA_PROTECTION_POLICY", "SUBSCRIPTION_FILTER_POLICY", "FIELD_INDEX_POLICY", "TRANSFORMER_POLICY" ]

valid {
    input.Body.policyName == STRING
    input.Body.policyType == enum_PolicyType[_]
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

DeleteDataProtectionPolicy

valid {
    input.Body.logGroupIdentifier == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

DeleteDelivery

valid {
    input.Body.id == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

DeleteDeliveryDestination

valid {
    input.Body.name == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

DeleteDeliveryDestinationPolicy

valid {
    input.Body.deliveryDestinationName == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

DeleteDeliverySource

valid {
    input.Body.name == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

DeleteDestination

valid {
    input.Body.destinationName == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

DeleteIndexPolicy

valid {
    input.Body.logGroupIdentifier == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

DeleteIntegration

valid {
    input.Body.integrationName == STRING
    input.Body.force == BOOLEAN
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

DeleteLogAnomalyDetector

valid {
    input.Body.anomalyDetectorArn == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

DeleteLogGroup

valid {
    input.Body.logGroupName == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

DeleteLogStream

valid {
    input.Body.logGroupName == STRING
    input.Body.logStreamName == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

DeleteMetricFilter

valid {
    input.Body.logGroupName == STRING
    input.Body.filterName == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

DeleteQueryDefinition

valid {
    input.Body.queryDefinitionId == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

DeleteResourcePolicy

valid {
    input.Body.policyName == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

DeleteRetentionPolicy

valid {
    input.Body.logGroupName == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

DeleteSubscriptionFilter

valid {
    input.Body.logGroupName == STRING
    input.Body.filterName == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

DeleteTransformer

valid {
    input.Body.logGroupIdentifier == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

DescribeAccountPolicies

enum_PolicyType := [ "DATA_PROTECTION_POLICY", "SUBSCRIPTION_FILTER_POLICY", "FIELD_INDEX_POLICY", "TRANSFORMER_POLICY" ]

valid {
    input.Body.policyType == enum_PolicyType[_]
    input.Body.policyName == STRING
    input.Body.accountIdentifiers[_] == STRING
    input.Body.nextToken == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

DescribeConfigurationTemplates

enum_DeliveryDestinationType := [ "S3", "CWL", "FH" ]

valid {
    input.Body.service == STRING
    input.Body.logTypes[_] == STRING
    input.Body.resourceTypes[_] == STRING
    input.Body.deliveryDestinationTypes[_] == enum_DeliveryDestinationType[_]
    input.Body.nextToken == STRING
    input.Body.limit == INTEGER
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

DescribeDeliveries

valid {
    input.Body.nextToken == STRING
    input.Body.limit == INTEGER
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

DescribeDeliveryDestinations

valid {
    input.Body.nextToken == STRING
    input.Body.limit == INTEGER
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

DescribeDeliverySources

valid {
    input.Body.nextToken == STRING
    input.Body.limit == INTEGER
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

DescribeDestinations

valid {
    input.Body.DestinationNamePrefix == STRING
    input.Body.nextToken == STRING
    input.Body.limit == INTEGER
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

DescribeExportTasks

enum_ExportTaskStatusCode := [ "CANCELLED", "COMPLETED", "FAILED", "PENDING", "PENDING_CANCEL", "RUNNING" ]

valid {
    input.Body.taskId == STRING
    input.Body.statusCode == enum_ExportTaskStatusCode[_]
    input.Body.nextToken == STRING
    input.Body.limit == INTEGER
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

DescribeFieldIndexes

valid {
    input.Body.logGroupIdentifiers[_] == STRING
    input.Body.nextToken == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

DescribeIndexPolicies

valid {
    input.Body.logGroupIdentifiers[_] == STRING
    input.Body.nextToken == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

DescribeLogGroups

enum_LogGroupClass := [ "STANDARD", "INFREQUENT_ACCESS" ]

valid {
    input.Body.accountIdentifiers[_] == STRING
    input.Body.logGroupNamePrefix == STRING
    input.Body.logGroupNamePattern == STRING
    input.Body.nextToken == STRING
    input.Body.limit == INTEGER
    input.Body.includeLinkedAccounts == BOOLEAN
    input.Body.logGroupClass == enum_LogGroupClass[_]
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

DescribeLogStreams

enum_OrderBy := [ "LogStreamName", "LastEventTime" ]

valid {
    input.Body.logGroupName == STRING
    input.Body.logGroupIdentifier == STRING
    input.Body.logStreamNamePrefix == STRING
    input.Body.orderBy == enum_OrderBy[_]
    input.Body.descending == BOOLEAN
    input.Body.nextToken == STRING
    input.Body.limit == INTEGER
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

DescribeMetricFilters

valid {
    input.Body.logGroupName == STRING
    input.Body.filterNamePrefix == STRING
    input.Body.nextToken == STRING
    input.Body.limit == INTEGER
    input.Body.metricName == STRING
    input.Body.metricNamespace == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

DescribeQueries

enum_QueryLanguage := [ "CWLI", "SQL", "PPL" ]
enum_QueryStatus := [ "Scheduled", "Running", "Complete", "Failed", "Cancelled", "Timeout", "Unknown" ]

valid {
    input.Body.logGroupName == STRING
    input.Body.status == enum_QueryStatus[_]
    input.Body.maxResults == INTEGER
    input.Body.nextToken == STRING
    input.Body.queryLanguage == enum_QueryLanguage[_]
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

DescribeQueryDefinitions

enum_QueryLanguage := [ "CWLI", "SQL", "PPL" ]

valid {
    input.Body.queryLanguage == enum_QueryLanguage[_]
    input.Body.queryDefinitionNamePrefix == STRING
    input.Body.maxResults == INTEGER
    input.Body.nextToken == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

DescribeResourcePolicies

valid {
    input.Body.nextToken == STRING
    input.Body.limit == INTEGER
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

DescribeSubscriptionFilters

valid {
    input.Body.logGroupName == STRING
    input.Body.filterNamePrefix == STRING
    input.Body.nextToken == STRING
    input.Body.limit == INTEGER
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

DisassociateKmsKey

valid {
    input.Body.logGroupName == STRING
    input.Body.resourceIdentifier == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

FilterLogEvents

valid {
    input.Body.logGroupName == STRING
    input.Body.logGroupIdentifier == STRING
    input.Body.logStreamNames[_] == STRING
    input.Body.logStreamNamePrefix == STRING
    input.Body.startTime == LONG
    input.Body.endTime == LONG
    input.Body.filterPattern == STRING
    input.Body.nextToken == STRING
    input.Body.limit == INTEGER
    input.Body.interleaved == BOOLEAN
    input.Body.unmask == BOOLEAN
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

GetDataProtectionPolicy

valid {
    input.Body.logGroupIdentifier == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

GetDelivery

valid {
    input.Body.id == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

GetDeliveryDestination

valid {
    input.Body.name == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

GetDeliveryDestinationPolicy

valid {
    input.Body.deliveryDestinationName == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

GetDeliverySource

valid {
    input.Body.name == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

GetIntegration

valid {
    input.Body.integrationName == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

GetLogAnomalyDetector

valid {
    input.Body.anomalyDetectorArn == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

GetLogEvents

valid {
    input.Body.logGroupName == STRING
    input.Body.logGroupIdentifier == STRING
    input.Body.logStreamName == STRING
    input.Body.startTime == LONG
    input.Body.endTime == LONG
    input.Body.nextToken == STRING
    input.Body.limit == INTEGER
    input.Body.startFromHead == BOOLEAN
    input.Body.unmask == BOOLEAN
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

GetLogGroupFields

valid {
    input.Body.logGroupName == STRING
    input.Body.time == LONG
    input.Body.logGroupIdentifier == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

GetLogRecord

valid {
    input.Body.logRecordPointer == STRING
    input.Body.unmask == BOOLEAN
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

GetQueryResults

valid {
    input.Body.queryId == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

GetTransformer

valid {
    input.Body.logGroupIdentifier == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

ListAnomalies

enum_SuppressionState := [ "SUPPRESSED", "UNSUPPRESSED" ]

valid {
    input.Body.anomalyDetectorArn == STRING
    input.Body.suppressionState == enum_SuppressionState[_]
    input.Body.limit == INTEGER
    input.Body.nextToken == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

ListIntegrations

enum_IntegrationStatus := [ "PROVISIONING", "ACTIVE", "FAILED" ]
enum_IntegrationType := [ "OPENSEARCH" ]

valid {
    input.Body.integrationNamePrefix == STRING
    input.Body.integrationType == enum_IntegrationType[_]
    input.Body.integrationStatus == enum_IntegrationStatus[_]
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

ListLogAnomalyDetectors

valid {
    input.Body.filterLogGroupArn == STRING
    input.Body.limit == INTEGER
    input.Body.nextToken == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

ListLogGroupsForQuery

valid {
    input.Body.queryId == STRING
    input.Body.nextToken == STRING
    input.Body.maxResults == INTEGER
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

ListTagsForResource

valid {
    input.Body.resourceArn == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

ListTagsLogGroup

valid {
    input.Body.logGroupName == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

PutAccountPolicy

enum_PolicyType := [ "DATA_PROTECTION_POLICY", "SUBSCRIPTION_FILTER_POLICY", "FIELD_INDEX_POLICY", "TRANSFORMER_POLICY" ]
enum_Scope := [ "ALL" ]

valid {
    input.Body.policyName == STRING
    input.Body.policyDocument == STRING
    input.Body.policyType == enum_PolicyType[_]
    input.Body.scope == enum_Scope[_]
    input.Body.selectionCriteria == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

PutDataProtectionPolicy

valid {
    input.Body.logGroupIdentifier == STRING
    input.Body.policyDocument == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

PutDeliveryDestination

enum_OutputFormat := [ "json", "plain", "w3c", "raw", "parquet" ]

valid {
    input.Body.name == STRING
    input.Body.outputFormat == enum_OutputFormat[_]
    input.Body.deliveryDestinationConfiguration.destinationResourceArn == STRING
    input.Body.tags.STRING == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

PutDeliveryDestinationPolicy

valid {
    input.Body.deliveryDestinationName == STRING
    input.Body.deliveryDestinationPolicy == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

PutDeliverySource

valid {
    input.Body.name == STRING
    input.Body.resourceArn == STRING
    input.Body.logType == STRING
    input.Body.tags.STRING == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

PutDestination

valid {
    input.Body.destinationName == STRING
    input.Body.targetArn == STRING
    input.Body.roleArn == STRING
    input.Body.tags.STRING == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

PutDestinationPolicy

valid {
    input.Body.destinationName == STRING
    input.Body.accessPolicy == STRING
    input.Body.forceUpdate == BOOLEAN
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

PutIndexPolicy

valid {
    input.Body.logGroupIdentifier == STRING
    input.Body.policyDocument == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

PutIntegration

enum_IntegrationType := [ "OPENSEARCH" ]

valid {
    input.Body.integrationName == STRING
    input.Body.resourceConfig.openSearchResourceConfig.kmsKeyArn == STRING
    input.Body.resourceConfig.openSearchResourceConfig.dataSourceRoleArn == STRING
    input.Body.resourceConfig.openSearchResourceConfig.dashboardViewerPrincipals[_] == STRING
    input.Body.resourceConfig.openSearchResourceConfig.applicationArn == STRING
    input.Body.resourceConfig.openSearchResourceConfig.retentionDays == INTEGER
    input.Body.integrationType == enum_IntegrationType[_]
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

PutLogEvents

valid {
    input.Body.logGroupName == STRING
    input.Body.logStreamName == STRING
    input.Body.logEvents[_].timestamp == LONG
    input.Body.logEvents[_].message == STRING
    input.Body.sequenceToken == STRING
    input.Body.entity.keyAttributes.STRING == STRING
    input.Body.entity.attributes.STRING == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

PutMetricFilter

enum_StandardUnit := [ "Seconds", "Microseconds", "Milliseconds", "Bytes", "Kilobytes", "Megabytes", "Gigabytes", "Terabytes", "Bits", "Kilobits", "Megabits", "Gigabits", "Terabits", "Percent", "Count", "Bytes/Second", "Kilobytes/Second", "Megabytes/Second", "Gigabytes/Second", "Terabytes/Second", "Bits/Second", "Kilobits/Second", "Megabits/Second", "Gigabits/Second", "Terabits/Second", "Count/Second", "None" ]

valid {
    input.Body.logGroupName == STRING
    input.Body.filterName == STRING
    input.Body.filterPattern == STRING
    input.Body.metricTransformations[_].metricName == STRING
    input.Body.metricTransformations[_].metricNamespace == STRING
    input.Body.metricTransformations[_].metricValue == STRING
    input.Body.metricTransformations[_].defaultValue == DOUBLE
    input.Body.metricTransformations[_].dimensions.STRING == STRING
    input.Body.metricTransformations[_].unit == enum_StandardUnit[_]
    input.Body.applyOnTransformedLogs == BOOLEAN
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

PutQueryDefinition

enum_QueryLanguage := [ "CWLI", "SQL", "PPL" ]

valid {
    input.Body.queryLanguage == enum_QueryLanguage[_]
    input.Body.name == STRING
    input.Body.queryDefinitionId == STRING
    input.Body.logGroupNames[_] == STRING
    input.Body.queryString == STRING
    input.Body.clientToken == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

PutResourcePolicy

valid {
    input.Body.policyName == STRING
    input.Body.policyDocument == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

PutRetentionPolicy

valid {
    input.Body.logGroupName == STRING
    input.Body.retentionInDays == INTEGER
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

PutSubscriptionFilter

enum_Distribution := [ "Random", "ByLogStream" ]

valid {
    input.Body.logGroupName == STRING
    input.Body.filterName == STRING
    input.Body.filterPattern == STRING
    input.Body.destinationArn == STRING
    input.Body.roleArn == STRING
    input.Body.distribution == enum_Distribution[_]
    input.Body.applyOnTransformedLogs == BOOLEAN
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

PutTransformer

enum_FlattenedElement := [ "first", "last" ]
enum_Type := [ "boolean", "integer", "double", "string" ]

valid {
    input.Body.logGroupIdentifier == STRING
    input.Body.transformerConfig[_].addKeys.entries[_].key == STRING
    input.Body.transformerConfig[_].addKeys.entries[_].value == STRING
    input.Body.transformerConfig[_].addKeys.entries[_].overwriteIfExists == BOOLEAN
    input.Body.transformerConfig[_].copyValue.entries[_].source == STRING
    input.Body.transformerConfig[_].copyValue.entries[_].target == STRING
    input.Body.transformerConfig[_].copyValue.entries[_].overwriteIfExists == BOOLEAN
    input.Body.transformerConfig[_].csv.quoteCharacter == STRING
    input.Body.transformerConfig[_].csv.delimiter == STRING
    input.Body.transformerConfig[_].csv.columns[_] == STRING
    input.Body.transformerConfig[_].csv.source == STRING
    input.Body.transformerConfig[_].dateTimeConverter.source == STRING
    input.Body.transformerConfig[_].dateTimeConverter.target == STRING
    input.Body.transformerConfig[_].dateTimeConverter.targetFormat == STRING
    input.Body.transformerConfig[_].dateTimeConverter.matchPatterns[_] == STRING
    input.Body.transformerConfig[_].dateTimeConverter.sourceTimezone == STRING
    input.Body.transformerConfig[_].dateTimeConverter.targetTimezone == STRING
    input.Body.transformerConfig[_].dateTimeConverter.locale == STRING
    input.Body.transformerConfig[_].deleteKeys.withKeys[_] == STRING
    input.Body.transformerConfig[_].grok.source == STRING
    input.Body.transformerConfig[_].grok.match == STRING
    input.Body.transformerConfig[_].listToMap.source == STRING
    input.Body.transformerConfig[_].listToMap.key == STRING
    input.Body.transformerConfig[_].listToMap.valueKey == STRING
    input.Body.transformerConfig[_].listToMap.target == STRING
    input.Body.transformerConfig[_].listToMap.flatten == BOOLEAN
    input.Body.transformerConfig[_].listToMap.flattenedElement == enum_FlattenedElement[_]
    input.Body.transformerConfig[_].lowerCaseString.withKeys[_] == STRING
    input.Body.transformerConfig[_].moveKeys.entries[_].source == STRING
    input.Body.transformerConfig[_].moveKeys.entries[_].target == STRING
    input.Body.transformerConfig[_].moveKeys.entries[_].overwriteIfExists == BOOLEAN
    input.Body.transformerConfig[_].parseCloudfront.source == STRING
    input.Body.transformerConfig[_].parseJSON.source == STRING
    input.Body.transformerConfig[_].parseJSON.destination == STRING
    input.Body.transformerConfig[_].parseKeyValue.source == STRING
    input.Body.transformerConfig[_].parseKeyValue.destination == STRING
    input.Body.transformerConfig[_].parseKeyValue.fieldDelimiter == STRING
    input.Body.transformerConfig[_].parseKeyValue.keyValueDelimiter == STRING
    input.Body.transformerConfig[_].parseKeyValue.keyPrefix == STRING
    input.Body.transformerConfig[_].parseKeyValue.nonMatchValue == STRING
    input.Body.transformerConfig[_].parseKeyValue.overwriteIfExists == BOOLEAN
    input.Body.transformerConfig[_].parseRoute53.source == STRING
    input.Body.transformerConfig[_].parsePostgres.source == STRING
    input.Body.transformerConfig[_].parseVPC.source == STRING
    input.Body.transformerConfig[_].parseWAF.source == STRING
    input.Body.transformerConfig[_].renameKeys.entries[_].key == STRING
    input.Body.transformerConfig[_].renameKeys.entries[_].renameTo == STRING
    input.Body.transformerConfig[_].renameKeys.entries[_].overwriteIfExists == BOOLEAN
    input.Body.transformerConfig[_].splitString.entries[_].source == STRING
    input.Body.transformerConfig[_].splitString.entries[_].delimiter == STRING
    input.Body.transformerConfig[_].substituteString.entries[_].source == STRING
    input.Body.transformerConfig[_].substituteString.entries[_].from == STRING
    input.Body.transformerConfig[_].substituteString.entries[_].to == STRING
    input.Body.transformerConfig[_].trimString.withKeys[_] == STRING
    input.Body.transformerConfig[_].typeConverter.entries[_].key == STRING
    input.Body.transformerConfig[_].typeConverter.entries[_].type == enum_Type[_]
    input.Body.transformerConfig[_].upperCaseString.withKeys[_] == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

StartLiveTail

valid {
    input.Body.logGroupIdentifiers[_] == STRING
    input.Body.logStreamNames[_] == STRING
    input.Body.logStreamNamePrefixes[_] == STRING
    input.Body.logEventFilterPattern == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

StartQuery

enum_QueryLanguage := [ "CWLI", "SQL", "PPL" ]

valid {
    input.Body.queryLanguage == enum_QueryLanguage[_]
    input.Body.logGroupName == STRING
    input.Body.logGroupNames[_] == STRING
    input.Body.logGroupIdentifiers[_] == STRING
    input.Body.startTime == LONG
    input.Body.endTime == LONG
    input.Body.queryString == STRING
    input.Body.limit == INTEGER
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

StopQuery

valid {
    input.Body.queryId == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

TagLogGroup

valid {
    input.Body.logGroupName == STRING
    input.Body.tags.STRING == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

TagResource

valid {
    input.Body.resourceArn == STRING
    input.Body.tags.STRING == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

TestMetricFilter

valid {
    input.Body.filterPattern == STRING
    input.Body.logEventMessages[_] == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

TestTransformer

enum_FlattenedElement := [ "first", "last" ]
enum_Type := [ "boolean", "integer", "double", "string" ]

valid {
    input.Body.transformerConfig[_].addKeys.entries[_].key == STRING
    input.Body.transformerConfig[_].addKeys.entries[_].value == STRING
    input.Body.transformerConfig[_].addKeys.entries[_].overwriteIfExists == BOOLEAN
    input.Body.transformerConfig[_].copyValue.entries[_].source == STRING
    input.Body.transformerConfig[_].copyValue.entries[_].target == STRING
    input.Body.transformerConfig[_].copyValue.entries[_].overwriteIfExists == BOOLEAN
    input.Body.transformerConfig[_].csv.quoteCharacter == STRING
    input.Body.transformerConfig[_].csv.delimiter == STRING
    input.Body.transformerConfig[_].csv.columns[_] == STRING
    input.Body.transformerConfig[_].csv.source == STRING
    input.Body.transformerConfig[_].dateTimeConverter.source == STRING
    input.Body.transformerConfig[_].dateTimeConverter.target == STRING
    input.Body.transformerConfig[_].dateTimeConverter.targetFormat == STRING
    input.Body.transformerConfig[_].dateTimeConverter.matchPatterns[_] == STRING
    input.Body.transformerConfig[_].dateTimeConverter.sourceTimezone == STRING
    input.Body.transformerConfig[_].dateTimeConverter.targetTimezone == STRING
    input.Body.transformerConfig[_].dateTimeConverter.locale == STRING
    input.Body.transformerConfig[_].deleteKeys.withKeys[_] == STRING
    input.Body.transformerConfig[_].grok.source == STRING
    input.Body.transformerConfig[_].grok.match == STRING
    input.Body.transformerConfig[_].listToMap.source == STRING
    input.Body.transformerConfig[_].listToMap.key == STRING
    input.Body.transformerConfig[_].listToMap.valueKey == STRING
    input.Body.transformerConfig[_].listToMap.target == STRING
    input.Body.transformerConfig[_].listToMap.flatten == BOOLEAN
    input.Body.transformerConfig[_].listToMap.flattenedElement == enum_FlattenedElement[_]
    input.Body.transformerConfig[_].lowerCaseString.withKeys[_] == STRING
    input.Body.transformerConfig[_].moveKeys.entries[_].source == STRING
    input.Body.transformerConfig[_].moveKeys.entries[_].target == STRING
    input.Body.transformerConfig[_].moveKeys.entries[_].overwriteIfExists == BOOLEAN
    input.Body.transformerConfig[_].parseCloudfront.source == STRING
    input.Body.transformerConfig[_].parseJSON.source == STRING
    input.Body.transformerConfig[_].parseJSON.destination == STRING
    input.Body.transformerConfig[_].parseKeyValue.source == STRING
    input.Body.transformerConfig[_].parseKeyValue.destination == STRING
    input.Body.transformerConfig[_].parseKeyValue.fieldDelimiter == STRING
    input.Body.transformerConfig[_].parseKeyValue.keyValueDelimiter == STRING
    input.Body.transformerConfig[_].parseKeyValue.keyPrefix == STRING
    input.Body.transformerConfig[_].parseKeyValue.nonMatchValue == STRING
    input.Body.transformerConfig[_].parseKeyValue.overwriteIfExists == BOOLEAN
    input.Body.transformerConfig[_].parseRoute53.source == STRING
    input.Body.transformerConfig[_].parsePostgres.source == STRING
    input.Body.transformerConfig[_].parseVPC.source == STRING
    input.Body.transformerConfig[_].parseWAF.source == STRING
    input.Body.transformerConfig[_].renameKeys.entries[_].key == STRING
    input.Body.transformerConfig[_].renameKeys.entries[_].renameTo == STRING
    input.Body.transformerConfig[_].renameKeys.entries[_].overwriteIfExists == BOOLEAN
    input.Body.transformerConfig[_].splitString.entries[_].source == STRING
    input.Body.transformerConfig[_].splitString.entries[_].delimiter == STRING
    input.Body.transformerConfig[_].substituteString.entries[_].source == STRING
    input.Body.transformerConfig[_].substituteString.entries[_].from == STRING
    input.Body.transformerConfig[_].substituteString.entries[_].to == STRING
    input.Body.transformerConfig[_].trimString.withKeys[_] == STRING
    input.Body.transformerConfig[_].typeConverter.entries[_].key == STRING
    input.Body.transformerConfig[_].typeConverter.entries[_].type == enum_Type[_]
    input.Body.transformerConfig[_].upperCaseString.withKeys[_] == STRING
    input.Body.logEventMessages[_] == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

UntagLogGroup

valid {
    input.Body.logGroupName == STRING
    input.Body.tags[_] == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

UntagResource

valid {
    input.Body.resourceArn == STRING
    input.Body.tagKeys[_] == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

UpdateAnomaly

enum_SuppressionType := [ "LIMITED", "INFINITE" ]
enum_SuppressionUnit := [ "SECONDS", "MINUTES", "HOURS" ]

valid {
    input.Body.anomalyId == STRING
    input.Body.patternId == STRING
    input.Body.anomalyDetectorArn == STRING
    input.Body.suppressionType == enum_SuppressionType[_]
    input.Body.suppressionPeriod.value == INTEGER
    input.Body.suppressionPeriod.suppressionUnit == enum_SuppressionUnit[_]
    input.Body.baseline == BOOLEAN
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

UpdateDeliveryConfiguration

valid {
    input.Body.id == STRING
    input.Body.recordFields[_] == STRING
    input.Body.fieldDelimiter == STRING
    input.Body.s3DeliveryConfiguration.suffixPath == STRING
    input.Body.s3DeliveryConfiguration.enableHiveCompatiblePath == BOOLEAN
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

UpdateLogAnomalyDetector

enum_EvaluationFrequency := [ "ONE_MIN", "FIVE_MIN", "TEN_MIN", "FIFTEEN_MIN", "THIRTY_MIN", "ONE_HOUR" ]

valid {
    input.Body.anomalyDetectorArn == STRING
    input.Body.evaluationFrequency == enum_EvaluationFrequency[_]
    input.Body.filterPattern == STRING
    input.Body.anomalyVisibilityTime == LONG
    input.Body.enabled == BOOLEAN
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

Updated 5 days ago