cloudtrail

package
v1.2.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 3, 2026 License: MIT Imports: 25 Imported by: 0

README

CloudTrail

Parity grade: A · SDK aws-sdk-go-v2/service/cloudtrail@v1.55.7 · last audited 2026-07-23 (UNKNOWN_SEE_GIT_LOG)

Coverage

Metric Value
Operations audited 60 (53 ok, 7 partial)
Known gaps 4
Deferred items 0
Resource leaks clean
Known gaps
  • ListQueries' EventDataStore filter is real AWS's required field but left optional/permissive here (an empty filter returns every query) for backward wire compatibility with an existing smoke test that calls ListQueries with no arguments; a real client omitting it would get a client-side validation error before the request is even sent, so this is low-risk.
  • GetQueryResults' SQL execution only understands a bounded grammar (SELECT <*|cols> FROM [WHERE col[!]=val [AND ...]] [LIMIT n]); joins, aggregates (COUNT/GROUP BY), OR, LIKE, and subqueries are accepted (the query still reaches FINISHED, never rejected) but always yield zero rows. See query_exec.go's file doc comment.
  • RegisterOrganizationDelegatedAdmin / DeregisterOrganizationDelegatedAdmin validate input but track no org-admin state (no GetOrganizationDelegatedAdmins-equivalent op exists in gopherstack's CloudTrail service to read it back anyway, and none exists in the real upstream API either).
  • PARITY-FOLLOWUP (pkgs/service, out of scope for this service): pkgs/service/cloudtrail_capture.go's wrapCloudTrailCapture records a management event unconditionally after next(c) returns, regardless of the wrapped handler's response status — a failed (4xx/5xx) mutating API call is captured identically to a successful one, and the synthesized CloudTrailEvent detail JSON always sets errorCode/errorMessage-equivalent fields absent (no error info at all). Real CloudTrail records failed calls too, but with populated errorCode/errorMessage. Not broken (chokepoint IS wired correctly end-to-end: RecordManagementEvent -> InMemoryBackend.RecordManagementEvent -> LookupEvents returns real captured events), just an accuracy gap in a shared file outside services/cloudtrail/'s edit scope.

More

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var (
	// ErrNotFound is returned when the requested resource does not exist.
	ErrNotFound = awserr.New("TrailNotFoundException", awserr.ErrNotFound)
	// ErrAlreadyExists is returned when a resource already exists.
	ErrAlreadyExists = awserr.New("TrailAlreadyExistsException", awserr.ErrConflict)
	// ErrValidation is returned when input validation fails.
	ErrValidation = awserr.New("InvalidParameterException", awserr.ErrInvalidParameter)
	// ErrChannelNotFound is returned when a channel is not found.
	ErrChannelNotFound = awserr.New("ChannelNotFoundException", awserr.ErrNotFound)
	// ErrDashboardNotFound is returned when a dashboard is not found.
	ErrDashboardNotFound = awserr.New("DashboardNotFoundException", awserr.ErrNotFound)
	// ErrEventDataStoreNotFound is returned when an event data store is not found.
	ErrEventDataStoreNotFound = awserr.New("EventDataStoreNotFoundException", awserr.ErrNotFound)
	// ErrQueryIDNotFound is returned when a query ID does not exist or does not
	// map to a query (CancelQuery/DescribeQuery/GetQueryResults).
	ErrQueryIDNotFound = awserr.New("QueryIdNotFoundException", awserr.ErrNotFound)
	// ErrQueryInactive is returned when CancelQuery is called on a query that
	// is already in a terminal state (FINISHED/FAILED/TIMED_OUT/CANCELLED).
	ErrQueryInactive = awserr.New("InactiveQueryException", awserr.ErrInvalidParameter)
	// ErrTerminationProtected is returned when trying to delete a termination-protected resource.
	ErrTerminationProtected = awserr.New("EventDataStoreTerminationProtectedException", awserr.ErrConflict)
	// ErrInsightNotEnabled is returned when GetInsightSelectors is called on a trail with no
	// insight selectors configured. AWS returns InsightNotEnabledException in this case.
	ErrInsightNotEnabled = awserr.New("InsightNotEnabledException", awserr.ErrInvalidParameter)
)

Functions

This section is empty.

Types

type AdvancedEventSelector 

type AdvancedEventSelector struct {
	Name           string                  `json:"Name,omitempty"`
	FieldSelectors []AdvancedFieldSelector `json:"FieldSelectors"`
}

AdvancedEventSelector represents an advanced event selector that filters events based on field-level conditions. Mutually exclusive with basic EventSelectors.

type AdvancedFieldSelector 

type AdvancedFieldSelector struct {
	Field         string   `json:"Field"`
	Equals        []string `json:"Equals,omitempty"`
	StartsWith    []string `json:"StartsWith,omitempty"`
	EndsWith      []string `json:"EndsWith,omitempty"`
	NotEquals     []string `json:"NotEquals,omitempty"`
	NotStartsWith []string `json:"NotStartsWith,omitempty"`
	NotEndsWith   []string `json:"NotEndsWith,omitempty"`
}

AdvancedFieldSelector represents a filter condition in an advanced event selector. Each field selector specifies a field name and one or more comparison operators.

type Channel 

type Channel struct {
	Tags         *tags.Tags    `json:"tags,omitempty"`
	ChannelID    string        `json:"channelId"`
	ChannelARN   string        `json:"channelArn"`
	Name         string        `json:"name"`
	Source       string        `json:"source"`
	Destinations []Destination `json:"destinations,omitempty"`
}

Channel represents a CloudTrail channel resource.

type Dashboard 

type Dashboard struct {
	CreatedTimestamp             time.Time        `json:"createdTimestamp"`
	UpdatedTimestamp             time.Time        `json:"updatedTimestamp"`
	Tags                         *tags.Tags       `json:"tags,omitempty"`
	RefreshSchedule              *RefreshSchedule `json:"refreshSchedule,omitempty"`
	DashboardID                  string           `json:"dashboardId"`
	DashboardARN                 string           `json:"dashboardArn"`
	Name                         string           `json:"name"`
	Type                         string           `json:"type"`
	Status                       string           `json:"status"`
	LastRefreshID                string           `json:"lastRefreshId,omitempty"`
	LastRefreshFailureReason     string           `json:"lastRefreshFailureReason,omitempty"`
	Widgets                      []Widget         `json:"widgets,omitempty"`
	TerminationProtectionEnabled bool             `json:"terminationProtectionEnabled"`
}

Dashboard represents a CloudTrail dashboard resource.

type DataResource 

type DataResource struct {
	Type   string   `json:"Type"`
	Values []string `json:"Values"`
}

DataResource represents a resource type for event selector data resources.

type Destination 

type Destination struct {
	Type     string `json:"Type"`
	Location string `json:"Location"`
}

Destination represents a channel destination.

type Event 

type Event struct {
	EventTime   time.Time `json:"EventTime"`
	EventID     string    `json:"EventId"`
	EventName   string    `json:"EventName"`
	EventSource string    `json:"EventSource"`
	Username    string    `json:"Username,omitempty"`
	ReadOnly    string    `json:"ReadOnly,omitempty"`
	AccessKeyID string    `json:"AccessKeyId,omitempty"`
	// EventCategory mirrors the CloudTrail record's eventCategory field
	// ("Management" or "Insight"). Every event this backend records via
	// RecordManagementEvent is a management-plane API call, so it is always
	// "Management" -- this backend never synthesizes Insight events. Used to
	// filter LookupEvents by the LookupEventsInput.EventCategory input field
	// (real AWS: omit it and only Management events are returned; pass
	// "insight" and only Insight events are returned). The real
	// LookupEventsOutput Event shape has no top-level EventCategory field (it
	// is only present nested in the CloudTrailEvent JSON string), but this
	// backend's Event type is shared between the wire response and the
	// internal/persisted record, so this extra key rides along on the wire --
	// harmless, since JSON-protocol clients ignore unknown response fields
	// (same pattern as dashToMap's Status key; see PARITY.md).
	EventCategory string `json:"EventCategory,omitempty"`
	// CloudTrailEvent is the full JSON-encoded event record (eventVersion,
	// userIdentity, eventTime, eventSource, eventName, awsRegion, requestID,
	// eventID, readOnly, eventType, managementEvent, eventCategory, ...),
	// matching the shape AWS embeds as a JSON string in LookupEvents results.
	CloudTrailEvent string          `json:"CloudTrailEvent,omitempty"`
	Resources       []EventResource `json:"Resources,omitempty"`
}

Event represents a recorded management or data event.

func (Event) MarshalJSON 

func (e Event) MarshalJSON() ([]byte, error)

MarshalJSON renders Event in the AWS JSON-protocol wire format. LookupEvents is a JSON-protocol operation whose EventTime shape is a unixTimestamp, so the SDK deserializer requires a JSON number of seconds since the epoch (see pkgs/awstime) rather than encoding/json's default RFC3339 string.

func (*Event) UnmarshalJSON added in v1.2.0 

func (e *Event) UnmarshalJSON(data []byte) error

UnmarshalJSON is the inverse of MarshalJSON: it decodes the epoch-seconds EventTime this type emits back into a time.Time. Without this, Event could be marshaled (e.g. into a Snapshot) but never restored -- encoding/json's default time.Time decoder rejects a JSON number ("parsing time ... as RFC3339: cannot parse ..."), so any snapshot containing a recorded event would fail Restore entirely. See persistence.go/backendSnapshot.Events.

type EventConfiguration 

type EventConfiguration struct {
	MaxEventSize              string           `json:"maxEventSize,omitempty"`
	AggregationConfigurations []map[string]any `json:"aggregationConfigurations,omitempty"`
	ContextKeySelectors       []map[string]any `json:"contextKeySelectors,omitempty"`
}

EventConfiguration holds the event-aggregation and enriched-context settings for a single trail or event data store (keyed by its ARN). AggregationConfigurations and ContextKeySelectors are stored as generic maps (rather than fully modeled types) because the backend only needs to persist and echo back exactly what the caller configured -- CloudTrail itself does not evaluate aggregation templates or context key matches.

type EventDataStore 

type EventDataStore struct {
	Tags                   *tags.Tags              `json:"tags,omitempty"`
	CreatedTimestamp       time.Time               `json:"createdTimestamp"`
	UpdatedTimestamp       time.Time               `json:"updatedTimestamp"`
	EventDataStoreID       string                  `json:"eventDataStoreId"`
	EventDataStoreARN      string                  `json:"eventDataStoreArn"`
	Name                   string                  `json:"name"`
	Status                 string                  `json:"status"`
	FederationStatus       string                  `json:"federationStatus,omitempty"`
	FederationRoleArn      string                  `json:"federationRoleArn,omitempty"`
	BillingMode            string                  `json:"billingMode,omitempty"`
	KMSKeyID               string                  `json:"kmsKeyId,omitempty"`
	AdvancedEventSelectors []AdvancedEventSelector `json:"advancedEventSelectors,omitempty"`
	InsightSelectors       []InsightSelector       `json:"insightSelectors,omitempty"`
	RetentionPeriod        int32                   `json:"retentionPeriod"`
	MultiRegionEnabled     bool                    `json:"multiRegionEnabled"`
	OrganizationEnabled    bool                    `json:"organizationEnabled"`
	TerminationProtected   bool                    `json:"terminationProtectionEnabled"`
}

EventDataStore represents a CloudTrail event data store resource.

type EventResource 

type EventResource struct {
	ResourceName string `json:"ResourceName,omitempty"`
	ResourceType string `json:"ResourceType,omitempty"`
}

EventResource represents a resource associated with a CloudTrail event.

type EventSelector 

type EventSelector struct {
	ReadWriteType           string         `json:"ReadWriteType"`
	DataResources           []DataResource `json:"DataResources"`
	IncludeManagementEvents bool           `json:"IncludeManagementEvents"`
}

EventSelector represents a CloudTrail event selector.

type GeneratedQuery 

type GeneratedQuery struct {
	QueryStatement string
	QueryAlias     string
	OwnerAccountID string
}

GeneratedQuery holds the result of a GenerateQuery call: a synthesized CloudTrail Lake SQL statement (and alias) for a natural-language prompt. Unlike StartQuery, GenerateQuery does not create a persisted, runnable query record -- AWS only returns the generated statement text.

type Handler 

type Handler struct {
	Backend *InMemoryBackend
	// contains filtered or unexported fields
}

Handler is the Echo HTTP handler for AWS CloudTrail operations (JSON-1.1 protocol).

func NewHandler 

func NewHandler(backend *InMemoryBackend) *Handler

NewHandler creates a new CloudTrail handler.

func (*Handler) ChaosOperations 

func (h *Handler) ChaosOperations() []string

ChaosOperations returns all operations that can be fault-injected.

func (*Handler) ChaosRegions 

func (h *Handler) ChaosRegions() []string

ChaosRegions returns all regions this CloudTrail instance handles.

func (*Handler) ChaosServiceName 

func (h *Handler) ChaosServiceName() string

ChaosServiceName returns the lowercase AWS service name for fault rule matching.

func (*Handler) ExtractOperation 

func (h *Handler) ExtractOperation(c *echo.Context) string

ExtractOperation extracts the CloudTrail operation name from the X-Amz-Target header.

func (*Handler) ExtractResource 

func (h *Handler) ExtractResource(_ *echo.Context) string

ExtractResource extracts the primary resource identifier from the request body.

func (*Handler) GetSupportedOperations 

func (h *Handler) GetSupportedOperations() []string

GetSupportedOperations returns the list of supported CloudTrail operations.

func (*Handler) Handler 

func (h *Handler) Handler() echo.HandlerFunc

Handler returns the Echo handler function for CloudTrail requests.

func (*Handler) MatchPriority 

func (h *Handler) MatchPriority() int

MatchPriority returns the routing priority.

func (*Handler) Name 

func (h *Handler) Name() string

Name returns the service name.

func (*Handler) RecordManagementEvent 

func (h *Handler) RecordManagementEvent(ev service.CloudTrailEventInput)

RecordManagementEvent implements service.CloudTrailRecorder, allowing the central service registry to reach this live backend directly (no second, disconnected CloudTrail backend is created).

func (*Handler) Reset 

func (h *Handler) Reset()

Reset clears the backend state (test helper).

func (*Handler) Restore 

func (h *Handler) Restore(ctx context.Context, data []byte) error

Restore implements persistence.Persistable by delegating to the backend.

func (*Handler) RouteMatcher 

func (h *Handler) RouteMatcher() service.Matcher

RouteMatcher returns a function that matches AWS CloudTrail JSON requests.

func (*Handler) Snapshot 

func (h *Handler) Snapshot(ctx context.Context) []byte

Snapshot implements persistence.Persistable by delegating to the backend.

type Import 

type Import struct {
	CreatedTimestamp time.Time     `json:"createdTimestamp"`
	UpdatedTimestamp time.Time     `json:"updatedTimestamp"`
	ImportSource     *ImportSource `json:"importSource,omitempty"`
	ImportID         string        `json:"importId"`
	ImportStatus     string        `json:"importStatus"`
	Destinations     []string      `json:"destinations,omitempty"`
}

Import represents a CloudTrail import resource.

type ImportSource added in v1.2.0 

type ImportSource struct {
	S3 *S3ImportSource `json:"S3,omitempty"`
}

ImportSource is the S3 source location for a StartImport request, matching the real ImportSource{S3: *S3ImportSource} wire shape (S3LocationUri, S3BucketRegion, S3BucketAccessRoleArn are all required fields on the real S3ImportSource -- previously only S3LocationUri was modeled/echoed).

type InMemoryBackend 

type InMemoryBackend struct {
	// contains filtered or unexported fields
}

InMemoryBackend is the in-memory store for CloudTrail resources.

func NewInMemoryBackend 

func NewInMemoryBackend(accountID, region string) *InMemoryBackend

NewInMemoryBackend creates a new in-memory CloudTrail backend.

func (*InMemoryBackend) AccountID added in v1.2.0 

func (b *InMemoryBackend) AccountID() string

AccountID returns the AWS account ID this backend is configured for.

func (*InMemoryBackend) AddTags 

func (b *InMemoryBackend) AddTags(resourceID string, kv map[string]string) error

AddTags adds tags to a resource by ARN or ID.

func (*InMemoryBackend) CancelQuery 

func (b *InMemoryBackend) CancelQuery(queryID string) (*Query, error)

CancelQuery cancels a running (non-terminal) query.

func (*InMemoryBackend) CreateChannel 

func (b *InMemoryBackend) CreateChannel(
	name, source string,
	destinations []Destination,
	kv map[string]string,
) (*Channel, error)

CreateChannel creates a new CloudTrail channel.

func (*InMemoryBackend) CreateDashboard 

func (b *InMemoryBackend) CreateDashboard(
	name, dashType string,
	kv map[string]string,
	widgets []Widget,
	refreshSchedule *RefreshSchedule,
	terminationProtected bool,
) (*Dashboard, error)

CreateDashboard creates a new CloudTrail dashboard.

func (*InMemoryBackend) CreateEventDataStore 

func (b *InMemoryBackend) CreateEventDataStore(
	name string,
	multiRegionEnabled, organizationEnabled, terminationProtected bool,
	retentionPeriod int32,
	advancedEventSelectors []AdvancedEventSelector,
	billingMode, kmsKeyID string,
	kv map[string]string,
) (*EventDataStore, error)

CreateEventDataStore creates a new CloudTrail event data store.

func (*InMemoryBackend) CreateTrail 

func (b *InMemoryBackend) CreateTrail(
	name, s3BucketName, s3KeyPrefix, snsTopicName,
	cloudWatchLogsLogGroupARN, cloudWatchLogsRoleARN, kmsKeyID string,
	includeGlobalServiceEvents, isMultiRegionTrail, enableLogFileValidation bool,
	kv map[string]string,
) (*Trail, error)

CreateTrail creates a new CloudTrail trail.

func (*InMemoryBackend) DeleteChannel 

func (b *InMemoryBackend) DeleteChannel(channelIDOrARN string) error

DeleteChannel deletes a channel by ID or ARN.

func (*InMemoryBackend) DeleteDashboard 

func (b *InMemoryBackend) DeleteDashboard(dashboardIDOrARN string) error

DeleteDashboard deletes a dashboard by ID or ARN.

func (*InMemoryBackend) DeleteEventDataStore 

func (b *InMemoryBackend) DeleteEventDataStore(edsIDOrARN string) error

DeleteEventDataStore deletes an event data store by ID or ARN. Returns ErrTerminationProtected if termination protection is enabled.

func (*InMemoryBackend) DeleteResourcePolicy 

func (b *InMemoryBackend) DeleteResourcePolicy(resourceARN string) error

DeleteResourcePolicy removes the resource-based policy from a CloudTrail resource.

func (*InMemoryBackend) DeleteTrail 

func (b *InMemoryBackend) DeleteTrail(nameOrARN string) error

DeleteTrail deletes a trail by name or ARN.

func (*InMemoryBackend) DeregisterOrganizationDelegatedAdmin 

func (b *InMemoryBackend) DeregisterOrganizationDelegatedAdmin(delegatedAdminAccountID string) error

DeregisterOrganizationDelegatedAdmin deregisters an organization delegated admin account. This is a no-op in the in-memory backend (returns success).

func (*InMemoryBackend) DescribeQuery 

func (b *InMemoryBackend) DescribeQuery(queryID string) (*Query, error)

DescribeQuery returns details about a specific query, materializing (lazily executing) it first if it hasn't been read yet. See materializeQueryLocked.

func (*InMemoryBackend) DescribeTrails 

func (b *InMemoryBackend) DescribeTrails(nameList []string) []*Trail

DescribeTrails returns trails matching the given name list. If nameList is empty, all trails are returned.

func (*InMemoryBackend) DisableFederation 

func (b *InMemoryBackend) DisableFederation(edsIDOrARN string) (*EventDataStore, error)

DisableFederation disables federation for an event data store.

func (*InMemoryBackend) EnableFederation 

func (b *InMemoryBackend) EnableFederation(edsIDOrARN, federationRoleArn string) (*EventDataStore, error)

EnableFederation enables federation for an event data store, storing the role ARN.

func (*InMemoryBackend) GenerateQuery 

func (b *InMemoryBackend) GenerateQuery(eventDataStores []string, prompt string) *GeneratedQuery

GenerateQuery synthesizes a CloudTrail Lake SQL query statement from a natural-language prompt against the given event data stores.

func (*InMemoryBackend) GetChannel 

func (b *InMemoryBackend) GetChannel(channelIDOrARN string) (*Channel, error)

GetChannel returns a channel by ID or ARN.

func (*InMemoryBackend) GetDashboard 

func (b *InMemoryBackend) GetDashboard(dashIDOrARN string) (*Dashboard, error)

GetDashboard returns a dashboard by ID or ARN.

func (*InMemoryBackend) GetEDSInsightSelectors 

func (b *InMemoryBackend) GetEDSInsightSelectors(edsIDOrARN string) (string, []InsightSelector, error)

GetEDSInsightSelectors returns insight selectors for an event data store. AWS returns InsightNotEnabledException when no insight selectors are configured.

func (*InMemoryBackend) GetEventConfiguration 

func (b *InMemoryBackend) GetEventConfiguration(resourceARN string) *EventConfiguration

GetEventConfiguration returns the event configuration for a trail or event data store ARN. AWS returns an empty configuration when none has been set.

func (*InMemoryBackend) GetEventDataStore 

func (b *InMemoryBackend) GetEventDataStore(edsIDOrARN string) (*EventDataStore, error)

GetEventDataStore returns an event data store by ID or ARN.

func (*InMemoryBackend) GetEventSelectors 

func (b *InMemoryBackend) GetEventSelectors(
	nameOrARN string,
) (string, []EventSelector, []AdvancedEventSelector, error)

GetEventSelectors returns both basic and advanced event selectors for a trail.

func (*InMemoryBackend) GetImport 

func (b *InMemoryBackend) GetImport(importID string) (*Import, error)

GetImport returns an import by ID.

func (*InMemoryBackend) GetInsightSelectors 

func (b *InMemoryBackend) GetInsightSelectors(trailNameOrARN string) (string, []InsightSelector, error)

GetInsightSelectors returns insight selectors for a trail. AWS returns InsightNotEnabledException when no insight selectors are configured.

func (*InMemoryBackend) GetQueryResults 

func (b *InMemoryBackend) GetQueryResults(queryID string) (*Query, error)

GetQueryResults returns results for a query, materializing (lazily executing) it first if it hasn't been read yet. See materializeQueryLocked.

func (*InMemoryBackend) GetResourcePolicy 

func (b *InMemoryBackend) GetResourcePolicy(resourceARN string) (*ResourcePolicy, error)

GetResourcePolicy returns the resource policy for the given ARN.

func (*InMemoryBackend) GetTrail 

func (b *InMemoryBackend) GetTrail(nameOrARN string) (*Trail, error)

GetTrail returns a trail by name or ARN.

func (*InMemoryBackend) GetTrailStatus 

func (b *InMemoryBackend) GetTrailStatus(nameOrARN string) (*Trail, error)

GetTrailStatus returns the full logging status of a trail.

func (*InMemoryBackend) ListChannels 

func (b *InMemoryBackend) ListChannels() []*Channel

ListChannels returns all channels.

func (*InMemoryBackend) ListDashboards 

func (b *InMemoryBackend) ListDashboards() []*Dashboard

ListDashboards returns all dashboards.

func (*InMemoryBackend) ListEventDataStores 

func (b *InMemoryBackend) ListEventDataStores() []*EventDataStore

ListEventDataStores returns all event data stores.

func (*InMemoryBackend) ListImportFailures 

func (b *InMemoryBackend) ListImportFailures(_ string) []map[string]any

ListImportFailures returns empty import failures (stub).

func (*InMemoryBackend) ListImports 

func (b *InMemoryBackend) ListImports() []*Import

ListImports returns all imports.

func (*InMemoryBackend) ListInsightsData 

func (b *InMemoryBackend) ListInsightsData() []map[string]any

ListInsightsData returns empty insights data (stub).

func (*InMemoryBackend) ListInsightsMetricData 

func (b *InMemoryBackend) ListInsightsMetricData() []map[string]any

ListInsightsMetricData returns empty insights metric data (stub).

func (*InMemoryBackend) ListPublicKeys 

func (b *InMemoryBackend) ListPublicKeys() []map[string]any

ListPublicKeys returns empty public keys (stub).

func (*InMemoryBackend) ListQueries 

func (b *InMemoryBackend) ListQueries() []*Query

ListQueries returns all queries.

func (*InMemoryBackend) ListTags 

func (b *InMemoryBackend) ListTags(resourceIDs []string) map[string]map[string]string

ListTags returns tags for the given resource ARNs or IDs.

func (*InMemoryBackend) ListTrails 

func (b *InMemoryBackend) ListTrails() []*Trail

ListTrails returns all trails.

func (*InMemoryBackend) LookupEvents 

func (b *InMemoryBackend) LookupEvents(input LookupEventsInput) LookupEventsOutput

LookupEvents returns recorded events matching the given filters. Events are returned newest-first (matching AWS) and honor StartTime/EndTime, the lookup attributes (ANDed together), MaxResults, and NextToken pagination.

func (*InMemoryBackend) PutEDSInsightSelectors 

func (b *InMemoryBackend) PutEDSInsightSelectors(
	edsIDOrARN string,
	selectors []InsightSelector,
) (*EventDataStore, error)

PutEDSInsightSelectors sets insight selectors for an event data store.

func (*InMemoryBackend) PutEventConfiguration 

func (b *InMemoryBackend) PutEventConfiguration(
	resourceARN string,
	aggregationConfigurations, contextKeySelectors []map[string]any,
	maxEventSize string,
) *EventConfiguration

PutEventConfiguration sets the event configuration for a trail or event data store ARN.

func (*InMemoryBackend) PutEventSelectors 

func (b *InMemoryBackend) PutEventSelectors(
	nameOrARN string,
	selectors []EventSelector,
	advancedSelectors []AdvancedEventSelector,
) (*Trail, error)

PutEventSelectors sets event selectors for a trail. Basic and advanced selectors are mutually exclusive: providing AdvancedEventSelectors clears EventSelectors and vice versa.

func (*InMemoryBackend) PutInsightSelectors 

func (b *InMemoryBackend) PutInsightSelectors(trailNameOrARN string, selectors []InsightSelector) (*Trail, error)

PutInsightSelectors sets insight selectors for a trail, updating HasInsightSelectors.

func (*InMemoryBackend) PutResourcePolicy 

func (b *InMemoryBackend) PutResourcePolicy(resourceARN, policy string) *ResourcePolicy

PutResourcePolicy sets the resource policy for the given ARN.

func (*InMemoryBackend) RecordEvent 

func (b *InMemoryBackend) RecordEvent(ev Event)

RecordEvent stores a management/data event so it can later be returned by LookupEvents. The event is assigned an EventID, EventTime, and EventCategory if not already set (every event this backend records is a management-plane API call; it never synthesizes Insight events).

func (*InMemoryBackend) RecordManagementEvent 

func (b *InMemoryBackend) RecordManagementEvent(ev service.CloudTrailEventInput)

RecordManagementEvent implements service.CloudTrailRecorder. It is invoked by the central service registry (pkgs/service.Registry) after every mutating API call made against any registered emulator service. This is what turns the previously-unused RecordEvent path into a real, globally wired CloudTrail capture point (the LocalStack model: CloudTrail records mutating control-plane calls regardless of which service handled them), so LookupEvents returns genuine activity instead of always being empty.

func (*InMemoryBackend) Region 

func (b *InMemoryBackend) Region() string

Region returns the AWS region this backend is configured for.

func (*InMemoryBackend) RegisterOrganizationDelegatedAdmin 

func (b *InMemoryBackend) RegisterOrganizationDelegatedAdmin(accountID string) error

RegisterOrganizationDelegatedAdmin is a no-op that registers an org delegated admin.

func (*InMemoryBackend) RemoveTags 

func (b *InMemoryBackend) RemoveTags(resourceID string, keys []string) error

RemoveTags removes tags from a resource by ARN or ID.

func (*InMemoryBackend) Reset 

func (b *InMemoryBackend) Reset()

Reset clears all state in the backend.

func (*InMemoryBackend) Restore 

func (b *InMemoryBackend) Restore(ctx context.Context, data []byte) error

Restore loads backend state from a JSON snapshot. It implements persistence.Persistable.

func (*InMemoryBackend) RestoreEventDataStore 

func (b *InMemoryBackend) RestoreEventDataStore(edsIDOrARN string) (*EventDataStore, error)

RestoreEventDataStore restores a deleted event data store (sets status to ENABLED).

func (*InMemoryBackend) SearchSampleQueries 

func (b *InMemoryBackend) SearchSampleQueries() []map[string]any

SearchSampleQueries returns empty sample queries (stub).

func (*InMemoryBackend) Snapshot 

func (b *InMemoryBackend) Snapshot(ctx context.Context) []byte

Snapshot serialises the backend state to JSON. It implements persistence.Persistable.

func (*InMemoryBackend) StartDashboardRefresh 

func (b *InMemoryBackend) StartDashboardRefresh(dashIDOrARN string) (*Dashboard, error)

StartDashboardRefresh triggers a refresh of a dashboard, recording a new LastRefreshId. "REFRESHING" is not a valid DashboardStatus (real values are CREATING/CREATED/UPDATING/UPDATED/DELETING only) -- a previous version of this backend set it as the dashboard's Status, which real StartDashboardRefreshOutput has no Status field on anyway (it returns only RefreshId; see handleStartDashboardRefresh).

func (*InMemoryBackend) StartEventDataStoreIngestion 

func (b *InMemoryBackend) StartEventDataStoreIngestion(edsIDOrARN string) error

StartEventDataStoreIngestion starts ingestion for an event data store.

func (*InMemoryBackend) StartImport 

func (b *InMemoryBackend) StartImport(destinations []string, importSource *ImportSource) (*Import, error)

StartImport creates an import job. importSource may be nil (matching real StartImportInput, where ImportSource is optional when ImportId is set to retry an existing import -- this backend does not model retry-by-ImportId, but tolerates a nil source for callers that only pass Destinations).

func (*InMemoryBackend) StartLogging 

func (b *InMemoryBackend) StartLogging(nameOrARN string) error

StartLogging sets the isLogging flag for a trail to true and records the start time.

func (*InMemoryBackend) StartQuery 

func (b *InMemoryBackend) StartQuery(queryString, edsARN, deliveryS3URI string) (*Query, error)

StartQuery creates a new query against an event data store.

func (*InMemoryBackend) StopEventDataStoreIngestion 

func (b *InMemoryBackend) StopEventDataStoreIngestion(edsIDOrARN string) error

StopEventDataStoreIngestion stops ingestion for an event data store.

func (*InMemoryBackend) StopImport 

func (b *InMemoryBackend) StopImport(importID string) (*Import, error)

StopImport stops an in-progress import.

func (*InMemoryBackend) StopLogging 

func (b *InMemoryBackend) StopLogging(nameOrARN string) error

StopLogging sets the isLogging flag for a trail to false and records the stop time.

func (*InMemoryBackend) UpdateChannel 

func (b *InMemoryBackend) UpdateChannel(
	channelIDOrARN, name string,
	destinations []Destination,
) (*Channel, error)

UpdateChannel updates an existing channel's name and/or destinations.

func (*InMemoryBackend) UpdateDashboard 

func (b *InMemoryBackend) UpdateDashboard(
	dashIDOrARN string,
	widgets []Widget,
	refreshSchedule *RefreshSchedule,
	terminationProtected *bool,
) (*Dashboard, error)

UpdateDashboard updates an existing dashboard's refresh schedule, widgets, and/or termination protection. Real UpdateDashboardInput has no Name field (dashboards cannot be renamed) -- a previous version of this backend accepted a rename-via-Name parameter that does not exist on the real API; it has been removed.

func (*InMemoryBackend) UpdateEventDataStore 

func (b *InMemoryBackend) UpdateEventDataStore(
	edsIDOrARN string,
	name string,
	multiRegionEnabled, organizationEnabled, terminationProtected *bool,
	retentionPeriod *int32,
	advancedEventSelectors []AdvancedEventSelector,
	billingMode, kmsKeyID string,
) (*EventDataStore, error)

UpdateEventDataStore updates an existing event data store.

func (*InMemoryBackend) UpdateTrail 

func (b *InMemoryBackend) UpdateTrail(
	name, s3BucketName, s3KeyPrefix, snsTopicName,
	cloudWatchLogsLogGroupARN, cloudWatchLogsRoleARN, kmsKeyID string,
	includeGlobalServiceEvents, isMultiRegionTrail, enableLogFileValidation *bool,
) (*Trail, error)

UpdateTrail updates an existing trail's configuration.

type InsightSelector 

type InsightSelector struct {
	InsightType string `json:"InsightType"`
}

InsightSelector represents a CloudTrail insight selector.

type LookupAttribute 

type LookupAttribute struct {
	AttributeKey   string `json:"AttributeKey"`
	AttributeValue string `json:"AttributeValue"`
}

LookupAttribute represents a filter attribute for LookupEvents.

type LookupEventsInput 

type LookupEventsInput struct {
	StartTime        *time.Time
	EndTime          *time.Time
	NextToken        string
	EventCategory    string
	LookupAttributes []LookupAttribute
	MaxResults       int32
}

LookupEventsInput holds parameters for a LookupEvents call.

type LookupEventsOutput 

type LookupEventsOutput struct {
	NextToken string
	Events    []Event
}

LookupEventsOutput holds the result of a LookupEvents call.

type Provider 

type Provider struct{}

Provider implements service.Provider for AWS CloudTrail.

func (*Provider) Init 

func (p *Provider) Init(ctx *service.AppContext) (service.Registerable, error)

Init initializes the CloudTrail service backend and handler.

func (*Provider) Name 

func (p *Provider) Name() string

Name returns the provider name.

type Query 

type Query struct {
	CreationTime          time.Time             `json:"creationTime"`
	QueryResultRows       [][]map[string]string `json:"queryResultRows,omitempty"`
	QueryID               string                `json:"queryId"`
	EventDataStoreARN     string                `json:"eventDataStoreArn"`
	QueryString           string                `json:"queryString"`
	QueryStatus           string                `json:"queryStatus"`
	DeliveryS3URI         string                `json:"deliveryS3Uri,omitempty"`
	ErrorMessage          string                `json:"errorMessage,omitempty"`
	QueryAlias            string                `json:"queryAlias,omitempty"`
	EventDataStoreOwnerID string                `json:"eventDataStoreOwnerId,omitempty"`
	DeliveryStatus        string                `json:"deliveryStatus,omitempty"`
	QueryParameters       []string              `json:"queryParameters,omitempty"`
	EventsScanned         int64                 `json:"eventsScanned,omitempty"`
	EventsMatched         int64                 `json:"eventsMatched,omitempty"`
	BytesScanned          int64                 `json:"bytesScanned,omitempty"`
	ExecutionTimeInMillis int32                 `json:"executionTimeInMillis,omitempty"`
}

Query represents a CloudTrail query resource.

QueryResultRows/EventsScanned/EventsMatched/BytesScanned/ExecutionTimeInMillis are populated lazily: StartQuery leaves the query QUEUED and unexecuted so it stays cancellable (matching AWS's async model), and the first GetQueryResults or DescribeQuery call against it runs materializeQueryLocked, which executes the recognized SELECT/FROM/WHERE/LIMIT subset of the QueryStatement against the backend's recorded events and flips QueryStatus to FINISHED. See query_exec.go.

type RefreshSchedule added in v1.2.0 

type RefreshSchedule struct {
	Frequency *RefreshScheduleFrequency `json:"Frequency,omitempty"`
	Status    string                    `json:"Status,omitempty"`
	TimeOfDay string                    `json:"TimeOfDay,omitempty"`
}

RefreshSchedule is the refresh-schedule configuration for a dashboard.

type RefreshScheduleFrequency added in v1.2.0 

type RefreshScheduleFrequency struct {
	Unit  string `json:"Unit,omitempty"`
	Value int32  `json:"Value,omitempty"`
}

RefreshScheduleFrequency specifies how often a dashboard refresh runs.

type ResourcePolicy 

type ResourcePolicy struct {
	ResourceARN    string `json:"resourceArn"`
	ResourcePolicy string `json:"resourcePolicy"`
}

ResourcePolicy represents a resource-based policy attached to a CloudTrail resource.

type S3ImportSource added in v1.2.0 

type S3ImportSource struct {
	S3LocationURI         string `json:"S3LocationUri,omitempty"`
	S3BucketRegion        string `json:"S3BucketRegion,omitempty"`
	S3BucketAccessRoleArn string `json:"S3BucketAccessRoleArn,omitempty"`
}

S3ImportSource is the S3 bucket location and access role for an import.

type Trail 

type Trail struct {
	CreationTime               time.Time               `json:"creationTime"`
	StartLoggingTime           *time.Time              `json:"startLoggingTime,omitempty"`
	StopLoggingTime            *time.Time              `json:"stopLoggingTime,omitempty"`
	LatestDeliveryTime         *time.Time              `json:"latestDeliveryTime,omitempty"`
	Tags                       *tags.Tags              `json:"tags,omitempty"`
	KMSKeyID                   string                  `json:"kmsKeyId,omitempty"`
	TrailARN                   string                  `json:"trailArn"`
	S3BucketName               string                  `json:"s3BucketName"`
	S3KeyPrefix                string                  `json:"s3KeyPrefix,omitempty"`
	SnsTopicName               string                  `json:"snsTopicName,omitempty"`
	SnsTopicARN                string                  `json:"snsTopicArn,omitempty"`
	CloudWatchLogsLogGroupARN  string                  `json:"cloudWatchLogsLogGroupArn,omitempty"`
	CloudWatchLogsRoleARN      string                  `json:"cloudWatchLogsRoleArn,omitempty"`
	Region                     string                  `json:"region"`
	Name                       string                  `json:"name"`
	HomeRegion                 string                  `json:"homeRegion"`
	AccountID                  string                  `json:"accountId"`
	EventSelectors             []EventSelector         `json:"eventSelectors,omitempty"`
	AdvancedEventSelectors     []AdvancedEventSelector `json:"advancedEventSelectors,omitempty"`
	InsightSelectors           []InsightSelector       `json:"insightSelectors,omitempty"`
	IncludeGlobalServiceEvents bool                    `json:"includeGlobalServiceEvents"`
	IsMultiRegionTrail         bool                    `json:"isMultiRegionTrail"`
	LogFileValidationEnabled   bool                    `json:"logFileValidationEnabled"`
	IsLogging                  bool                    `json:"isLogging"`
	HasCustomEventSelectors    bool                    `json:"hasCustomEventSelectors"`
	HasInsightSelectors        bool                    `json:"hasInsightSelectors"`
	IsOrganizationTrail        bool                    `json:"isOrganizationTrail"`
}

Trail represents an AWS CloudTrail trail.

The Tags field is backend-owned. Callers must treat the returned pointer as read-only; mutate tags only via AddTags / CreateTrail.

type Widget added in v1.2.0 

type Widget struct {
	ViewProperties  map[string]string `json:"ViewProperties,omitempty"`
	QueryAlias      string            `json:"QueryAlias,omitempty"`
	QueryStatement  string            `json:"QueryStatement,omitempty"`
	QueryParameters []string          `json:"QueryParameters,omitempty"`
}

Widget represents a widget on a CloudTrail Lake dashboard.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.