cloudtrail

package
v1.7.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 6, 2026 License: MIT Imports: 34 Imported by: 0

README

CloudTrail

Parity grade: A · SDK aws-sdk-go-v2/service/cloudtrail@v1.58.4 · last audited 2026-09-19 (d522d763f)

Coverage

Metric Value
PARITY entries audited 60 (49 ok, 11 partial)
Known gaps 7
Deferred items 0
Resource leaks fixed
Known gaps
  • ListInsightsData/ListPublicKeys/SearchSampleQueries return empty lists: Insights anomaly detection (no Insight events are ever generated), legacy digest public keys and the AWS-owned sample-query catalog are unmodeled; their StartTime/EndTime/DataType/MaxResults filters have no data to apply to. ListInsightsMetricData is computed from recorded events (2026-10-04).
  • gopherstack-53eh: Lake SQL subset omits cross-store JOIN/set-ops, SUM/AVG/MIN/MAX, subqueries and HAVING (such statements reach FAILED with an ErrorMessage); unaliased COUNT is named _col by position, inferred from Trino, not AWS-documented.
  • Org delegated-admin state is unmodeled (no read-back op upstream), so GetResourcePolicy's DelegatedAdminResourcePolicy is never populated.
  • gopherstack-53eh: wrapCloudTrailCapture's error-body extraction lacks query-protocol XML and CBOR shapes; it lives in pkgs/service, outside this directory.
  • gopherstack-6flj: GetChannel IngestionStatus/SourceConfig and GetEventDataStore PartitionKeys are AWS-computed with no modeled source or documented content; GetImport ImportStatistics needs real import execution.
  • gopherstack-2wvq: StartQuery QueryParameters and DescribeQuery RefreshId are dashboard-internal; no output echoes the former and StartDashboardRefresh creates no linked Query for the latter.
  • gopherstack-g9b4: log delivery writes one gzipped file per event instead of ~5-minute batches; batching needs a flush timer with goroutine lifecycle, a larger change.

More

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var (
	// ErrNotFound is returned when the requested resource does not exist.
	ErrNotFound = awserr.New("TrailNotFoundException", awserr.ErrNotFound)
	// ErrAlreadyExists is returned when a resource already exists.
	ErrAlreadyExists = awserr.New("TrailAlreadyExistsException", awserr.ErrConflict)
	// ErrValidation is returned when input validation fails.
	ErrValidation = awserr.New("InvalidParameterException", awserr.ErrInvalidParameter)
	// ErrChannelNotFound is returned when a channel is not found.
	ErrChannelNotFound = awserr.New("ChannelNotFoundException", awserr.ErrNotFound)
	// ErrEventDataStoreNotFound is returned when an event data store is not found.
	ErrEventDataStoreNotFound = awserr.New("EventDataStoreNotFoundException", awserr.ErrNotFound)
	// ErrResourceNotFound is returned when a tagged resource, or a dashboard,
	// is not found by ops whose own error model only types the generic
	// ResourceNotFoundException (AddTags/RemoveTags/DeleteDashboard/
	// GetDashboard/UpdateDashboard/StartDashboardRefresh) rather than a
	// resource-specific NotFound code.
	ErrResourceNotFound = awserr.New("ResourceNotFoundException", awserr.ErrNotFound)
	// ErrImportNotFound is returned when an import ID does not exist
	// (GetImport/StopImport).
	ErrImportNotFound = awserr.New("ImportNotFoundException", awserr.ErrNotFound)
	// ErrResourcePolicyNotFound is returned when no resource policy is
	// attached to a resource (GetResourcePolicy/DeleteResourcePolicy).
	ErrResourcePolicyNotFound = awserr.New("ResourcePolicyNotFoundException", awserr.ErrNotFound)
	// ErrChannelAlreadyExists is returned when CreateChannel targets a name
	// already in use.
	ErrChannelAlreadyExists = awserr.New("ChannelAlreadyExistsException", awserr.ErrAlreadyExists)
	// ErrEventDataStoreAlreadyExists is returned when CreateEventDataStore
	// targets a name already in use.
	ErrEventDataStoreAlreadyExists = awserr.New("EventDataStoreAlreadyExistsException", awserr.ErrAlreadyExists)
	// ErrDashboardConflict is returned when CreateDashboard targets a name
	// already in use. CreateDashboard's own error model has no
	// DashboardAlreadyExistsException; ConflictException is the closest
	// modelled code and the only one in its switch that fits (inference,
	// not verified against real AWS behavior).
	ErrDashboardConflict = awserr.New("ConflictException", awserr.ErrConflict)
	// ErrQueryIDNotFound is returned when a query ID does not exist or does not
	// map to a query (CancelQuery/DescribeQuery/GetQueryResults).
	ErrQueryIDNotFound = awserr.New("QueryIdNotFoundException", awserr.ErrNotFound)
	// ErrQueryInactive is returned when CancelQuery is called on a query that
	// is already in a terminal state (FINISHED/FAILED/TIMED_OUT/CANCELLED).
	ErrQueryInactive = awserr.New("InactiveQueryException", awserr.ErrInvalidParameter)
	// ErrTerminationProtected is returned when trying to delete a termination-protected resource.
	ErrTerminationProtected = awserr.New("EventDataStoreTerminationProtectedException", awserr.ErrConflict)
	// ErrInsightNotEnabled is returned when GetInsightSelectors is called on a trail with no
	// insight selectors configured. AWS returns InsightNotEnabledException in this case.
	ErrInsightNotEnabled = awserr.New("InsightNotEnabledException", awserr.ErrInvalidParameter)
	// ErrS3BucketNotFound is returned by CreateTrail/UpdateTrail when S3 is
	// wired (SetS3Backend) and the named S3BucketName does not exist. Real
	// CreateTrail/UpdateTrail both declare S3BucketDoesNotExistException
	// (cloudtrail@v1.58.4 deserializers.go's per-op error switches); see
	// PARITY.md for why it maps to 400 here.
	ErrS3BucketNotFound = awserr.New("S3BucketDoesNotExistException", awserr.ErrInvalidParameter)
)

Functions

This section is empty.

Types

type AdvancedEventSelector 

type AdvancedEventSelector struct {
	Name           string                  `json:"Name,omitempty"`
	FieldSelectors []AdvancedFieldSelector `json:"FieldSelectors"`
}

AdvancedEventSelector represents an advanced event selector that filters events based on field-level conditions. Mutually exclusive with basic EventSelectors.

type AdvancedFieldSelector 

type AdvancedFieldSelector struct {
	Field         string   `json:"Field"`
	Equals        []string `json:"Equals,omitempty"`
	StartsWith    []string `json:"StartsWith,omitempty"`
	EndsWith      []string `json:"EndsWith,omitempty"`
	NotEquals     []string `json:"NotEquals,omitempty"`
	NotStartsWith []string `json:"NotStartsWith,omitempty"`
	NotEndsWith   []string `json:"NotEndsWith,omitempty"`
}

AdvancedFieldSelector represents a filter condition in an advanced event selector. Each field selector specifies a field name and one or more comparison operators.

type Channel 

type Channel struct {
	Tags         *tags.Tags    `json:"tags,omitempty"`
	ChannelID    string        `json:"channelId"`
	ChannelARN   string        `json:"channelArn"`
	Name         string        `json:"name"`
	Source       string        `json:"source"`
	Destinations []Destination `json:"destinations,omitempty"`
}

Channel represents a CloudTrail channel resource.

type Dashboard 

type Dashboard struct {
	CreatedTimestamp             time.Time        `json:"createdTimestamp"`
	UpdatedTimestamp             time.Time        `json:"updatedTimestamp"`
	Tags                         *tags.Tags       `json:"tags,omitempty"`
	RefreshSchedule              *RefreshSchedule `json:"refreshSchedule,omitempty"`
	DashboardID                  string           `json:"dashboardId"`
	DashboardARN                 string           `json:"dashboardArn"`
	Name                         string           `json:"name"`
	Type                         string           `json:"type"`
	Status                       string           `json:"status"`
	LastRefreshID                string           `json:"lastRefreshId,omitempty"`
	LastRefreshFailureReason     string           `json:"lastRefreshFailureReason,omitempty"`
	Widgets                      []Widget         `json:"widgets,omitempty"`
	TerminationProtectionEnabled bool             `json:"terminationProtectionEnabled"`
}

Dashboard represents a CloudTrail dashboard resource.

type DataResource 

type DataResource struct {
	Type   string   `json:"Type"`
	Values []string `json:"Values"`
}

DataResource represents a resource type for event selector data resources.

type Destination 

type Destination struct {
	Type     string `json:"Type"`
	Location string `json:"Location"`
}

Destination represents a channel destination.

type Event 

type Event struct {
	EventTime   time.Time `json:"EventTime"`
	EventID     string    `json:"EventId"`
	EventName   string    `json:"EventName"`
	EventSource string    `json:"EventSource"`
	Username    string    `json:"Username,omitempty"`
	ReadOnly    string    `json:"ReadOnly,omitempty"`
	AccessKeyID string    `json:"AccessKeyId,omitempty"`
	// EventCategory mirrors the CloudTrail record's eventCategory field
	// ("Management" or "Insight"). Every event this backend records via
	// RecordManagementEvent is a management-plane API call, so it is always
	// "Management" -- this backend never synthesizes Insight events. Used to
	// filter LookupEvents by the LookupEventsInput.EventCategory input field
	// (real AWS: omit it and only Management events are returned; pass
	// "insight" and only Insight events are returned). Persisted (part of
	// backendSnapshot.Events) but intentionally excluded from the LookupEvents
	// wire response -- the real Event shape has no top-level EventCategory
	// field (cloudtrail@v1.58.4 types.go:283); see
	// handler_events.go:lookupEventsEventWire.
	EventCategory string `json:"EventCategory,omitempty"`
	// CloudTrailEvent is the full JSON-encoded event record (eventVersion,
	// userIdentity, eventTime, eventSource, eventName, awsRegion, requestID,
	// eventID, readOnly, eventType, managementEvent, eventCategory, ...),
	// matching the shape AWS embeds as a JSON string in LookupEvents results.
	CloudTrailEvent string          `json:"CloudTrailEvent,omitempty"`
	Resources       []EventResource `json:"Resources,omitempty"`
}

Event represents a recorded management or data event.

func (Event) MarshalJSON 

func (e Event) MarshalJSON() ([]byte, error)

MarshalJSON renders Event in the AWS JSON-protocol wire format. LookupEvents is a JSON-protocol operation whose EventTime shape is a unixTimestamp, so the SDK deserializer requires a JSON number of seconds since the epoch (see pkgs/awstime) rather than encoding/json's default RFC3339 string.

func (*Event) UnmarshalJSON added in v1.2.0 

func (e *Event) UnmarshalJSON(data []byte) error

UnmarshalJSON is the inverse of MarshalJSON: it decodes the epoch-seconds EventTime this type emits back into a time.Time. Without this, Event could be marshaled (e.g. into a Snapshot) but never restored -- encoding/json's default time.Time decoder rejects a JSON number ("parsing time ... as RFC3339: cannot parse ..."), so any snapshot containing a recorded event would fail Restore entirely. See persistence.go/backendSnapshot.Events.

type EventConfiguration 

type EventConfiguration struct {
	MaxEventSize              string           `json:"maxEventSize,omitempty"`
	AggregationConfigurations []map[string]any `json:"aggregationConfigurations,omitempty"`
	ContextKeySelectors       []map[string]any `json:"contextKeySelectors,omitempty"`
}

EventConfiguration holds the event-aggregation and enriched-context settings for a single trail or event data store (keyed by its ARN). AggregationConfigurations and ContextKeySelectors are stored as generic maps (rather than fully modeled types) because the backend only needs to persist and echo back exactly what the caller configured -- CloudTrail itself does not evaluate aggregation templates or context key matches.

type EventDataStore 

type EventDataStore struct {
	CreatedTimestamp       time.Time               `json:"createdTimestamp"`
	UpdatedTimestamp       time.Time               `json:"updatedTimestamp"`
	Tags                   *tags.Tags              `json:"tags,omitempty"`
	FederationRoleArn      string                  `json:"federationRoleArn,omitempty"`
	KMSKeyID               string                  `json:"kmsKeyId,omitempty"`
	Name                   string                  `json:"name"`
	Status                 string                  `json:"status"`
	FederationStatus       string                  `json:"federationStatus,omitempty"`
	EventDataStoreID       string                  `json:"eventDataStoreId"`
	BillingMode            string                  `json:"billingMode,omitempty"`
	EventDataStoreARN      string                  `json:"eventDataStoreArn"`
	InsightsDestination    string                  `json:"insightsDestination,omitempty"`
	InsightSelectors       []InsightSelector       `json:"insightSelectors,omitempty"`
	AdvancedEventSelectors []AdvancedEventSelector `json:"advancedEventSelectors,omitempty"`
	RetentionPeriod        int32                   `json:"retentionPeriod"`
	MultiRegionEnabled     bool                    `json:"multiRegionEnabled"`
	OrganizationEnabled    bool                    `json:"organizationEnabled"`
	TerminationProtected   bool                    `json:"terminationProtectionEnabled"`
}

EventDataStore represents a CloudTrail event data store resource.

type EventResource 

type EventResource struct {
	ResourceName string `json:"ResourceName,omitempty"`
	ResourceType string `json:"ResourceType,omitempty"`
}

EventResource represents a resource associated with a CloudTrail event.

type EventSelector 

type EventSelector struct {
	ReadWriteType           string         `json:"ReadWriteType"`
	DataResources           []DataResource `json:"DataResources"`
	IncludeManagementEvents bool           `json:"IncludeManagementEvents"`
}

EventSelector represents a CloudTrail event selector.

type GeneratedQuery 

type GeneratedQuery struct {
	QueryStatement string
	QueryAlias     string
	OwnerAccountID string
}

GeneratedQuery holds the result of a GenerateQuery call: a synthesized CloudTrail Lake SQL statement (and alias) for a natural-language prompt. Unlike StartQuery, GenerateQuery does not create a persisted, runnable query record -- AWS only returns the generated statement text.

type Handler 

type Handler struct {
	Backend *InMemoryBackend
	// contains filtered or unexported fields
}

Handler is the Echo HTTP handler for AWS CloudTrail operations (JSON-1.1 protocol).

func NewHandler 

func NewHandler(backend *InMemoryBackend) *Handler

NewHandler creates a new CloudTrail handler.

func (*Handler) BackendFor 

func (h *Handler) BackendFor(region string) *InMemoryBackend

BackendFor returns the backend serving region: the home backend, or the sibling built on first use.

func (*Handler) ChaosOperations 

func (h *Handler) ChaosOperations() []string

ChaosOperations returns all operations that can be fault-injected.

func (*Handler) ChaosRegions 

func (h *Handler) ChaosRegions() []string

ChaosRegions returns all regions this CloudTrail instance handles.

func (*Handler) ChaosServiceName 

func (h *Handler) ChaosServiceName() string

ChaosServiceName returns the lowercase AWS service name for fault rule matching.

func (*Handler) EnableRegions 

func (h *Handler) EnableRegions()

EnableRegions makes h serve every other region through lazily built per-region siblings.

func (*Handler) ExtractOperation 

func (h *Handler) ExtractOperation(c *echo.Context) string

ExtractOperation extracts the CloudTrail operation name from the X-Amz-Target header.

func (*Handler) ExtractResource 

func (h *Handler) ExtractResource(_ *echo.Context) string

ExtractResource extracts the primary resource identifier from the request body.

func (*Handler) GetSupportedOperations 

func (h *Handler) GetSupportedOperations() []string

GetSupportedOperations returns the list of supported CloudTrail operations.

func (*Handler) Handler 

func (h *Handler) Handler() echo.HandlerFunc

Handler returns the Echo handler function for CloudTrail requests.

func (*Handler) MatchPriority 

func (h *Handler) MatchPriority() int

MatchPriority returns the routing priority.

func (*Handler) Name 

func (h *Handler) Name() string

Name returns the service name.

func (*Handler) RecordManagementEvent 

func (h *Handler) RecordManagementEvent(ev service.CloudTrailEventInput)

RecordManagementEvent implements service.CloudTrailRecorder, allowing the central service registry to reach this live backend directly (no second, disconnected CloudTrail backend is created).

func (*Handler) RegionBackends 

func (h *Handler) RegionBackends() []*InMemoryBackend

RegionBackends returns the home backend followed by every sibling built so far.

func (*Handler) RegionHandler 

func (h *Handler) RegionHandler(region string) *Handler

RegionHandler returns the handler serving region: h itself for the home region, else its sibling.

func (*Handler) Reset 

func (h *Handler) Reset()

Reset clears the backend state (test helper).

func (*Handler) Restore 

func (h *Handler) Restore(ctx context.Context, data []byte) error

Restore implements persistence.Persistable.

func (*Handler) RouteMatcher 

func (h *Handler) RouteMatcher() service.Matcher

RouteMatcher returns a function that matches AWS CloudTrail JSON requests.

func (*Handler) Snapshot 

func (h *Handler) Snapshot(ctx context.Context) []byte

Snapshot implements persistence.Persistable; other regions ride in an additive "regions" key.

type Import 

type Import struct {
	CreatedTimestamp time.Time     `json:"createdTimestamp"`
	UpdatedTimestamp time.Time     `json:"updatedTimestamp"`
	ImportSource     *ImportSource `json:"importSource,omitempty"`
	StartEventTime   *time.Time    `json:"startEventTime,omitempty"`
	EndEventTime     *time.Time    `json:"endEventTime,omitempty"`
	ImportID         string        `json:"importId"`
	ImportStatus     string        `json:"importStatus"`
	Destinations     []string      `json:"destinations,omitempty"`
}

Import represents a CloudTrail import resource.

type ImportSource added in v1.2.0 

type ImportSource struct {
	S3 *S3ImportSource `json:"S3,omitempty"`
}

ImportSource is the S3 source location for a StartImport request, matching the real ImportSource{S3: *S3ImportSource} wire shape (S3LocationUri, S3BucketRegion, S3BucketAccessRoleArn are all required fields on the real S3ImportSource -- previously only S3LocationUri was modeled/echoed).

type InMemoryBackend 

type InMemoryBackend struct {
	// contains filtered or unexported fields
}

InMemoryBackend is the in-memory store for CloudTrail resources.

func NewInMemoryBackend 

func NewInMemoryBackend(accountID, region string) *InMemoryBackend

NewInMemoryBackend creates a new in-memory CloudTrail backend.

func (*InMemoryBackend) AccountID added in v1.2.0 

func (b *InMemoryBackend) AccountID() string

AccountID returns the AWS account ID this backend is configured for.

func (*InMemoryBackend) AddTags 

func (b *InMemoryBackend) AddTags(resourceID string, kv map[string]string) error

AddTags adds tags to a resource by ARN or ID.

func (*InMemoryBackend) CancelQuery 

func (b *InMemoryBackend) CancelQuery(queryID string) (*Query, error)

CancelQuery cancels a running (non-terminal) query.

func (*InMemoryBackend) CreateChannel 

func (b *InMemoryBackend) CreateChannel(
	name, source string,
	destinations []Destination,
	kv map[string]string,
) (*Channel, error)

CreateChannel creates a new CloudTrail channel.

func (*InMemoryBackend) CreateDashboard 

func (b *InMemoryBackend) CreateDashboard(
	name, dashType string,
	kv map[string]string,
	widgets []Widget,
	refreshSchedule *RefreshSchedule,
	terminationProtected bool,
) (*Dashboard, error)

CreateDashboard creates a new CloudTrail dashboard.

func (*InMemoryBackend) CreateEventDataStore 

func (b *InMemoryBackend) CreateEventDataStore(
	name string,
	multiRegionEnabled, organizationEnabled, terminationProtected bool,
	retentionPeriod int32,
	advancedEventSelectors []AdvancedEventSelector,
	billingMode, kmsKeyID string,
	kv map[string]string,
	startIngestion bool,
) (*EventDataStore, error)

CreateEventDataStore creates a new CloudTrail event data store.

func (*InMemoryBackend) CreateTrail 

func (b *InMemoryBackend) CreateTrail(
	name, s3BucketName, s3KeyPrefix, snsTopicName,
	cloudWatchLogsLogGroupARN, cloudWatchLogsRoleARN, kmsKeyID string,
	includeGlobalServiceEvents, isMultiRegionTrail, enableLogFileValidation bool,
	kv map[string]string,
	isOrganizationTrail bool,
) (*Trail, error)

CreateTrail creates a new CloudTrail trail.

func (*InMemoryBackend) DeleteChannel 

func (b *InMemoryBackend) DeleteChannel(channelIDOrARN string) error

DeleteChannel deletes a channel by ID or ARN.

func (*InMemoryBackend) DeleteDashboard 

func (b *InMemoryBackend) DeleteDashboard(dashboardIDOrARN string) error

DeleteDashboard deletes a dashboard by ID or ARN.

func (*InMemoryBackend) DeleteEventDataStore 

func (b *InMemoryBackend) DeleteEventDataStore(edsIDOrARN string) error

DeleteEventDataStore deletes an event data store by ID or ARN. Returns ErrTerminationProtected if termination protection is enabled.

func (*InMemoryBackend) DeleteResourcePolicy 

func (b *InMemoryBackend) DeleteResourcePolicy(resourceARN string) error

DeleteResourcePolicy removes the resource-based policy from a CloudTrail resource.

func (*InMemoryBackend) DeleteTrail 

func (b *InMemoryBackend) DeleteTrail(nameOrARN string) error

DeleteTrail deletes a trail by name or ARN.

func (*InMemoryBackend) DeregisterOrganizationDelegatedAdmin 

func (b *InMemoryBackend) DeregisterOrganizationDelegatedAdmin(delegatedAdminAccountID string) error

DeregisterOrganizationDelegatedAdmin deregisters an organization delegated admin account. This is a no-op in the in-memory backend (returns success).

func (*InMemoryBackend) DescribeQuery 

func (b *InMemoryBackend) DescribeQuery(queryID string) (*Query, error)

DescribeQuery returns details about a specific query, materializing (lazily executing) it first if it hasn't been read yet. See materializeQueryLocked.

func (*InMemoryBackend) DescribeQueryByAlias added in v1.5.0 

func (b *InMemoryBackend) DescribeQueryByAlias(alias string) (*Query, error)

DescribeQueryByAlias returns details about the last query started under alias, per DescribeQueryInput's documented alternative to QueryId: "Specifying the QueryAlias parameter returns information about the last query run for the alias." Materializes the query first if unread, same as DescribeQuery. b.queriesByAlias groups queries in StartQuery call order, so the last element of the group is the most recently started one.

func (*InMemoryBackend) DescribeTrails 

func (b *InMemoryBackend) DescribeTrails(nameList []string) []*Trail

DescribeTrails returns trails matching the given name list. If nameList is empty, all trails are returned.

func (*InMemoryBackend) DisableFederation 

func (b *InMemoryBackend) DisableFederation(edsIDOrARN string) (*EventDataStore, error)

DisableFederation disables federation for an event data store.

func (*InMemoryBackend) EnableFederation 

func (b *InMemoryBackend) EnableFederation(edsIDOrARN, federationRoleArn string) (*EventDataStore, error)

EnableFederation enables federation for an event data store, storing the role ARN.

func (*InMemoryBackend) GenerateQuery 

func (b *InMemoryBackend) GenerateQuery(eventDataStores []string, prompt string) *GeneratedQuery

GenerateQuery synthesizes a CloudTrail Lake SQL query statement from a natural-language prompt against the given event data stores.

func (*InMemoryBackend) GetChannel 

func (b *InMemoryBackend) GetChannel(channelIDOrARN string) (*Channel, error)

GetChannel returns a channel by ID or ARN.

func (*InMemoryBackend) GetDashboard 

func (b *InMemoryBackend) GetDashboard(dashIDOrARN string) (*Dashboard, error)

GetDashboard returns a dashboard by ID or ARN.

func (*InMemoryBackend) GetEDSInsightSelectors 

func (b *InMemoryBackend) GetEDSInsightSelectors(edsIDOrARN string) (string, string, []InsightSelector, error)

GetEDSInsightSelectors returns insight selectors for an event data store, along with the destination event data store ARN (InsightsDestination) that was set alongside them by PutEDSInsightSelectors. AWS returns InsightNotEnabledException when no insight selectors are configured.

func (*InMemoryBackend) GetEventConfiguration 

func (b *InMemoryBackend) GetEventConfiguration(resourceARN string) *EventConfiguration

GetEventConfiguration returns the event configuration for a trail or event data store ARN. AWS returns an empty configuration when none has been set.

func (*InMemoryBackend) GetEventDataStore 

func (b *InMemoryBackend) GetEventDataStore(edsIDOrARN string) (*EventDataStore, error)

GetEventDataStore returns an event data store by ID or ARN.

func (*InMemoryBackend) GetEventSelectors 

func (b *InMemoryBackend) GetEventSelectors(
	nameOrARN string,
) (string, []EventSelector, []AdvancedEventSelector, error)

GetEventSelectors returns both basic and advanced event selectors for a trail.

func (*InMemoryBackend) GetImport 

func (b *InMemoryBackend) GetImport(importID string) (*Import, error)

GetImport returns an import by ID.

func (*InMemoryBackend) GetInsightSelectors 

func (b *InMemoryBackend) GetInsightSelectors(trailNameOrARN string) (string, []InsightSelector, error)

GetInsightSelectors returns insight selectors for a trail. AWS returns InsightNotEnabledException when no insight selectors are configured.

func (*InMemoryBackend) GetQueryResults 

func (b *InMemoryBackend) GetQueryResults(queryID string) (*Query, error)

GetQueryResults returns results for a query, materializing (lazily executing) it first if it hasn't been read yet. See materializeQueryLocked.

func (*InMemoryBackend) GetResourcePolicy 

func (b *InMemoryBackend) GetResourcePolicy(resourceARN string) (*ResourcePolicy, error)

GetResourcePolicy returns the resource policy for the given ARN.

func (*InMemoryBackend) GetTrail 

func (b *InMemoryBackend) GetTrail(nameOrARN string) (*Trail, error)

GetTrail returns a trail by name or ARN.

func (*InMemoryBackend) GetTrailStatus 

func (b *InMemoryBackend) GetTrailStatus(nameOrARN string) (*Trail, error)

GetTrailStatus returns the full logging status of a trail.

func (*InMemoryBackend) ListChannels 

func (b *InMemoryBackend) ListChannels() []*Channel

ListChannels returns all channels.

func (*InMemoryBackend) ListDashboards 

func (b *InMemoryBackend) ListDashboards() []*Dashboard

ListDashboards returns all dashboards.

func (*InMemoryBackend) ListEventDataStores 

func (b *InMemoryBackend) ListEventDataStores() []*EventDataStore

ListEventDataStores returns all event data stores.

func (*InMemoryBackend) ListImportFailures 

func (b *InMemoryBackend) ListImportFailures(_ string) []map[string]any

ListImportFailures returns empty import failures (stub).

func (*InMemoryBackend) ListImports 

func (b *InMemoryBackend) ListImports() []*Import

ListImports returns all imports.

func (*InMemoryBackend) ListInsightsData 

func (b *InMemoryBackend) ListInsightsData() []map[string]any

ListInsightsData returns empty insights data (stub).

func (*InMemoryBackend) ListInsightsMetricData 

func (b *InMemoryBackend) ListInsightsMetricData(in *InsightsMetricInput) (*InsightsMetricOutput, error)

ListInsightsMetricData returns the per-period count of recorded management API calls (or errors) for an event source/name, the series ApiCallRateInsight/ApiErrorRateInsight analyze.

func (*InMemoryBackend) ListPublicKeys 

func (b *InMemoryBackend) ListPublicKeys() []map[string]any

ListPublicKeys returns empty public keys (stub).

func (*InMemoryBackend) ListQueries 

func (b *InMemoryBackend) ListQueries() []*Query

ListQueries returns all queries.

func (*InMemoryBackend) ListTags 

func (b *InMemoryBackend) ListTags(resourceIDs []string) map[string]map[string]string

ListTags returns tags for the given resource ARNs or IDs.

func (*InMemoryBackend) ListTrails 

func (b *InMemoryBackend) ListTrails() []*Trail

ListTrails returns all trails.

func (*InMemoryBackend) LookupEvents 

func (b *InMemoryBackend) LookupEvents(input LookupEventsInput) LookupEventsOutput

LookupEvents returns recorded events matching the given filters. Events are returned newest-first (matching AWS) and honor StartTime/EndTime, the lookup attributes (ANDed together), MaxResults, and NextToken pagination.

func (*InMemoryBackend) PutEDSInsightSelectors 

func (b *InMemoryBackend) PutEDSInsightSelectors(
	edsIDOrARN, insightsDestination string,
	selectors []InsightSelector,
) (*EventDataStore, error)

PutEDSInsightSelectors sets insight selectors for an event data store, and the destination event data store ARN (InsightsDestination) that logs the resulting Insights events -- PutInsightSelectorsInput.InsightsDestination, required alongside EventDataStore to enable Insights on an event data store (cloudtrail@v1.58.4 api_op_PutInsightSelectors.go:90-95).

func (*InMemoryBackend) PutEventConfiguration 

func (b *InMemoryBackend) PutEventConfiguration(
	resourceARN string,
	aggregationConfigurations, contextKeySelectors []map[string]any,
	maxEventSize string,
) *EventConfiguration

PutEventConfiguration sets the event configuration for a trail or event data store ARN.

func (*InMemoryBackend) PutEventSelectors 

func (b *InMemoryBackend) PutEventSelectors(
	nameOrARN string,
	selectors []EventSelector,
	advancedSelectors []AdvancedEventSelector,
) (*Trail, error)

PutEventSelectors sets event selectors for a trail. Basic and advanced selectors are mutually exclusive: providing AdvancedEventSelectors clears EventSelectors and vice versa.

func (*InMemoryBackend) PutInsightSelectors 

func (b *InMemoryBackend) PutInsightSelectors(trailNameOrARN string, selectors []InsightSelector) (*Trail, error)

PutInsightSelectors sets insight selectors for a trail, updating HasInsightSelectors.

func (*InMemoryBackend) PutResourcePolicy 

func (b *InMemoryBackend) PutResourcePolicy(resourceARN, policy string) *ResourcePolicy

PutResourcePolicy sets the resource policy for the given ARN.

func (*InMemoryBackend) RecordEvent 

func (b *InMemoryBackend) RecordEvent(ev Event)

RecordEvent stores a management/data event so it can later be returned by LookupEvents. The event is assigned an EventID, EventTime, and EventCategory if not already set (every event this backend records is a management-plane API call; it never synthesizes Insight events).

func (*InMemoryBackend) RecordManagementEvent 

func (b *InMemoryBackend) RecordManagementEvent(ev service.CloudTrailEventInput)

RecordManagementEvent implements service.CloudTrailRecorder. It is invoked by the central service registry (pkgs/service.Registry) after every mutating API call made against any registered emulator service. This is what turns the previously-unused RecordEvent path into a real, globally wired CloudTrail capture point (the LocalStack model: CloudTrail records mutating control-plane calls regardless of which service handled them), so LookupEvents returns genuine activity instead of always being empty.

func (*InMemoryBackend) Region 

func (b *InMemoryBackend) Region() string

Region returns the AWS region this backend is configured for.

func (*InMemoryBackend) RegisterOrganizationDelegatedAdmin 

func (b *InMemoryBackend) RegisterOrganizationDelegatedAdmin(accountID string) error

RegisterOrganizationDelegatedAdmin is a no-op that registers an org delegated admin.

func (*InMemoryBackend) RemoveTags 

func (b *InMemoryBackend) RemoveTags(resourceID string, keys []string) error

RemoveTags removes tags from a resource by ARN or ID.

func (*InMemoryBackend) Reset 

func (b *InMemoryBackend) Reset()

Reset clears all state in the backend.

func (*InMemoryBackend) Restore 

func (b *InMemoryBackend) Restore(ctx context.Context, data []byte) error

Restore loads backend state from a JSON snapshot. It implements persistence.Persistable.

func (*InMemoryBackend) RestoreEventDataStore 

func (b *InMemoryBackend) RestoreEventDataStore(edsIDOrARN string) (*EventDataStore, error)

RestoreEventDataStore restores a deleted event data store (sets status to ENABLED).

func (*InMemoryBackend) RetryImport 

func (b *InMemoryBackend) RetryImport(importID string) (*Import, error)

RetryImport restarts a stopped or failed import by ID.

func (*InMemoryBackend) SearchSampleQueries 

func (b *InMemoryBackend) SearchSampleQueries() []map[string]any

SearchSampleQueries returns empty sample queries (stub).

func (*InMemoryBackend) SetS3Backend 

func (b *InMemoryBackend) SetS3Backend(s3 S3Backend)

SetS3Backend wires S3 so CreateTrail/UpdateTrail validate the configured bucket exists and recorded management events are actually delivered as log files, instead of S3BucketName being stored/echoed with no validation and no delivery (gopherstack-g9b4).

func (*InMemoryBackend) Snapshot 

func (b *InMemoryBackend) Snapshot(ctx context.Context) []byte

Snapshot serialises the backend state to JSON. It implements persistence.Persistable.

func (*InMemoryBackend) StartDashboardRefresh 

func (b *InMemoryBackend) StartDashboardRefresh(dashIDOrARN string) (*Dashboard, error)

StartDashboardRefresh triggers a refresh of a dashboard, recording a new LastRefreshId. "REFRESHING" is not a valid DashboardStatus (real values are CREATING/CREATED/UPDATING/UPDATED/DELETING only) -- a previous version of this backend set it as the dashboard's Status, which real StartDashboardRefreshOutput has no Status field on anyway (it returns only RefreshId; see handleStartDashboardRefresh).

func (*InMemoryBackend) StartEventDataStoreIngestion 

func (b *InMemoryBackend) StartEventDataStoreIngestion(edsIDOrARN string) error

StartEventDataStoreIngestion starts ingestion for an event data store.

func (*InMemoryBackend) StartImport 

func (b *InMemoryBackend) StartImport(
	destinations []string, importSource *ImportSource, startEventTime, endEventTime *time.Time,
) (*Import, error)

StartImport creates an import job; importSource may be nil for callers that only pass Destinations.

func (*InMemoryBackend) StartLogging 

func (b *InMemoryBackend) StartLogging(nameOrARN string) error

StartLogging sets the isLogging flag for a trail to true and records the start time.

func (*InMemoryBackend) StartQuery 

func (b *InMemoryBackend) StartQuery(
	queryString, edsARN, deliveryS3URI, queryAlias, ownerAccountID string,
) (*Query, error)

StartQuery creates a new query against an event data store. queryAlias is optional (StartQuery accepts QueryStatement alone); when set it is stored so a later DescribeQuery can resolve "the last query run for the alias" -- see DescribeQueryByAlias.

func (*InMemoryBackend) StopEventDataStoreIngestion 

func (b *InMemoryBackend) StopEventDataStoreIngestion(edsIDOrARN string) error

StopEventDataStoreIngestion stops ingestion for an event data store.

func (*InMemoryBackend) StopImport 

func (b *InMemoryBackend) StopImport(importID string) (*Import, error)

StopImport stops an in-progress import.

func (*InMemoryBackend) StopLogging 

func (b *InMemoryBackend) StopLogging(nameOrARN string) error

StopLogging sets the isLogging flag for a trail to false and records the stop time.

func (*InMemoryBackend) UpdateChannel 

func (b *InMemoryBackend) UpdateChannel(
	channelIDOrARN, name string,
	destinations []Destination,
) (*Channel, error)

UpdateChannel updates an existing channel's name and/or destinations.

func (*InMemoryBackend) UpdateDashboard 

func (b *InMemoryBackend) UpdateDashboard(
	dashIDOrARN string,
	widgets []Widget,
	refreshSchedule *RefreshSchedule,
	terminationProtected *bool,
) (*Dashboard, error)

UpdateDashboard updates an existing dashboard's refresh schedule, widgets, and/or termination protection. Real UpdateDashboardInput has no Name field (dashboards cannot be renamed) -- a previous version of this backend accepted a rename-via-Name parameter that does not exist on the real API; it has been removed.

func (*InMemoryBackend) UpdateEventDataStore 

func (b *InMemoryBackend) UpdateEventDataStore(
	edsIDOrARN string,
	name string,
	multiRegionEnabled, organizationEnabled, terminationProtected *bool,
	retentionPeriod *int32,
	advancedEventSelectors []AdvancedEventSelector,
	billingMode, kmsKeyID string,
) (*EventDataStore, error)

UpdateEventDataStore updates an existing event data store.

func (*InMemoryBackend) UpdateTrail 

func (b *InMemoryBackend) UpdateTrail(
	name, s3BucketName, s3KeyPrefix, snsTopicName,
	cloudWatchLogsLogGroupARN, cloudWatchLogsRoleARN, kmsKeyID string,
	includeGlobalServiceEvents, isMultiRegionTrail, enableLogFileValidation *bool,
	isOrganizationTrail *bool,
) (*Trail, error)

UpdateTrail updates an existing trail's configuration.

type InsightSelector 

type InsightSelector struct {
	InsightType string `json:"InsightType"`
}

InsightSelector represents a CloudTrail insight selector.

type InsightsMetricInput 

type InsightsMetricInput struct {
	Start       *time.Time
	End         *time.Time
	EventName   string
	EventSource string
	InsightType string
	ErrorCode   string
	DataType    string
	NextToken   string
	Period      int
	MaxResults  int
}

InsightsMetricInput is the ListInsightsMetricData request.

type InsightsMetricOutput 

type InsightsMetricOutput struct {
	NextToken  string
	Timestamps []float64
	Values     []float64
}

InsightsMetricOutput is the ListInsightsMetricData time series (epoch-second timestamps).

type LookupAttribute 

type LookupAttribute struct {
	AttributeKey   string `json:"AttributeKey"`
	AttributeValue string `json:"AttributeValue"`
}

LookupAttribute represents a filter attribute for LookupEvents.

type LookupEventsInput 

type LookupEventsInput struct {
	StartTime        *time.Time
	EndTime          *time.Time
	NextToken        string
	EventCategory    string
	LookupAttributes []LookupAttribute
	MaxResults       int32
}

LookupEventsInput holds parameters for a LookupEvents call.

type LookupEventsOutput 

type LookupEventsOutput struct {
	NextToken string
	Events    []Event
}

LookupEventsOutput holds the result of a LookupEvents call.

type Provider 

type Provider struct{}

Provider implements service.Provider for AWS CloudTrail.

func (*Provider) Init 

func (p *Provider) Init(ctx *service.AppContext) (service.Registerable, error)

Init initializes the CloudTrail service backend and handler.

func (*Provider) Name 

func (p *Provider) Name() string

Name returns the provider name.

type Query 

type Query struct {
	CreationTime          time.Time             `json:"creationTime"`
	QueryResultRows       [][]map[string]string `json:"queryResultRows,omitempty"`
	QueryID               string                `json:"queryId"`
	EventDataStoreARN     string                `json:"eventDataStoreArn"`
	QueryString           string                `json:"queryString"`
	QueryStatus           string                `json:"queryStatus"`
	DeliveryS3URI         string                `json:"deliveryS3Uri,omitempty"`
	ErrorMessage          string                `json:"errorMessage,omitempty"`
	QueryAlias            string                `json:"queryAlias,omitempty"`
	EventDataStoreOwnerID string                `json:"eventDataStoreOwnerId,omitempty"`
	DeliveryStatus        string                `json:"deliveryStatus,omitempty"`
	QueryParameters       []string              `json:"queryParameters,omitempty"`
	EventsScanned         int64                 `json:"eventsScanned,omitempty"`
	EventsMatched         int64                 `json:"eventsMatched,omitempty"`
	BytesScanned          int64                 `json:"bytesScanned,omitempty"`
	ExecutionTimeInMillis int32                 `json:"executionTimeInMillis,omitempty"`
}

Query represents a CloudTrail query resource.

QueryResultRows/EventsScanned/EventsMatched/BytesScanned/ExecutionTimeInMillis are populated lazily: StartQuery leaves the query QUEUED and unexecuted so it stays cancellable (matching AWS's async model), and the first GetQueryResults or DescribeQuery call against it runs materializeQueryLocked, which executes the recognized SELECT/FROM/WHERE/LIMIT subset of the QueryStatement against the backend's recorded events and flips QueryStatus to FINISHED. See query_exec.go.

type RefreshSchedule added in v1.2.0 

type RefreshSchedule struct {
	Frequency *RefreshScheduleFrequency `json:"Frequency,omitempty"`
	Status    string                    `json:"Status,omitempty"`
	TimeOfDay string                    `json:"TimeOfDay,omitempty"`
}

RefreshSchedule is the refresh-schedule configuration for a dashboard.

type RefreshScheduleFrequency added in v1.2.0 

type RefreshScheduleFrequency struct {
	Unit  string `json:"Unit,omitempty"`
	Value int32  `json:"Value,omitempty"`
}

RefreshScheduleFrequency specifies how often a dashboard refresh runs.

type ResourcePolicy 

type ResourcePolicy struct {
	ResourceARN    string `json:"resourceArn"`
	ResourcePolicy string `json:"resourcePolicy"`
}

ResourcePolicy represents a resource-based policy attached to a CloudTrail resource.

type S3Backend 

type S3Backend interface {
	HeadBucket(ctx context.Context, input *sdk_s3.HeadBucketInput) (*sdk_s3.HeadBucketOutput, error)
	PutObject(ctx context.Context, input *sdk_s3.PutObjectInput) (*sdk_s3.PutObjectOutput, error)
}

S3Backend is the subset of S3 operations CloudTrail needs to validate a trail's configured bucket (HeadBucket, used by CreateTrail/UpdateTrail) and to deliver recorded management events as log files to it (PutObject), wired via SetS3Backend. When unset, CreateTrail/UpdateTrail skip bucket validation and no log files are ever written -- S3BucketName is only stored/echoed, matching this repo's unwired-hook-stays-permissive convention.

type S3ImportSource added in v1.2.0 

type S3ImportSource struct {
	S3LocationURI         string `json:"S3LocationUri,omitempty"`
	S3BucketRegion        string `json:"S3BucketRegion,omitempty"`
	S3BucketAccessRoleArn string `json:"S3BucketAccessRoleArn,omitempty"`
}

S3ImportSource is the S3 bucket location and access role for an import.

type Trail 

type Trail struct {
	CreationTime               time.Time               `json:"creationTime"`
	StartLoggingTime           *time.Time              `json:"startLoggingTime,omitempty"`
	StopLoggingTime            *time.Time              `json:"stopLoggingTime,omitempty"`
	LatestDeliveryTime         *time.Time              `json:"latestDeliveryTime,omitempty"`
	Tags                       *tags.Tags              `json:"tags,omitempty"`
	KMSKeyID                   string                  `json:"kmsKeyId,omitempty"`
	TrailARN                   string                  `json:"trailArn"`
	S3BucketName               string                  `json:"s3BucketName"`
	S3KeyPrefix                string                  `json:"s3KeyPrefix,omitempty"`
	SnsTopicName               string                  `json:"snsTopicName,omitempty"`
	SnsTopicARN                string                  `json:"snsTopicArn,omitempty"`
	CloudWatchLogsLogGroupARN  string                  `json:"cloudWatchLogsLogGroupArn,omitempty"`
	CloudWatchLogsRoleARN      string                  `json:"cloudWatchLogsRoleArn,omitempty"`
	Region                     string                  `json:"region"`
	Name                       string                  `json:"name"`
	HomeRegion                 string                  `json:"homeRegion"`
	AccountID                  string                  `json:"accountId"`
	EventSelectors             []EventSelector         `json:"eventSelectors,omitempty"`
	AdvancedEventSelectors     []AdvancedEventSelector `json:"advancedEventSelectors,omitempty"`
	InsightSelectors           []InsightSelector       `json:"insightSelectors,omitempty"`
	IncludeGlobalServiceEvents bool                    `json:"includeGlobalServiceEvents"`
	IsMultiRegionTrail         bool                    `json:"isMultiRegionTrail"`
	LogFileValidationEnabled   bool                    `json:"logFileValidationEnabled"`
	IsLogging                  bool                    `json:"isLogging"`
	HasCustomEventSelectors    bool                    `json:"hasCustomEventSelectors"`
	HasInsightSelectors        bool                    `json:"hasInsightSelectors"`
	IsOrganizationTrail        bool                    `json:"isOrganizationTrail"`
}

Trail represents an AWS CloudTrail trail.

The Tags field is backend-owned. Callers must treat the returned pointer as read-only; mutate tags only via AddTags / CreateTrail.

type Widget added in v1.2.0 

type Widget struct {
	ViewProperties  map[string]string `json:"ViewProperties,omitempty"`
	QueryAlias      string            `json:"QueryAlias,omitempty"`
	QueryStatement  string            `json:"QueryStatement,omitempty"`
	QueryParameters []string          `json:"QueryParameters,omitempty"`
}

Widget represents a widget on a CloudTrail Lake dashboard.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.