cloudtrail

type EventDataStore struct {
	pulumi.CustomResourceState

	// The advanced event selectors to use to select the events for the data store. For more information about how to use advanced event selectors, see [Log events by using advanced event selectors](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html#creating-data-event-selectors-advanced) in the CloudTrail User Guide.
	AdvancedEventSelectors EventDataStoreAdvancedEventSelectorArrayOutput `pulumi:"advancedEventSelectors"`
	// ARN of the event data store.
	Arn pulumi.StringOutput `pulumi:"arn"`
	// The billing mode for the event data store. The valid values are `EXTENDABLE_RETENTION_PRICING` and `FIXED_RETENTION_PRICING`. Defaults to `EXTENDABLE_RETENTION_PRICING`.
	BillingMode pulumi.StringPtrOutput `pulumi:"billingMode"`
	// Specifies the AWS KMS key ID to use to encrypt the events delivered by CloudTrail. The value can be an alias name prefixed by alias/, a fully specified ARN to an alias, a fully specified ARN to a key, or a globally unique identifier.
	KmsKeyId pulumi.StringPtrOutput `pulumi:"kmsKeyId"`
	// Specifies whether the event data store includes events from all regions, or only from the region in which the event data store is created. Default: `true`.
	MultiRegionEnabled pulumi.BoolPtrOutput `pulumi:"multiRegionEnabled"`
	// The name of the event data store.
	Name pulumi.StringOutput `pulumi:"name"`
	// Specifies whether an event data store collects events logged for an organization in AWS Organizations. Default: `false`.
	OrganizationEnabled pulumi.BoolPtrOutput `pulumi:"organizationEnabled"`
	// Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.
	Region pulumi.StringOutput `pulumi:"region"`
	// The retention period of the event data store, in days. You can set a retention period of up to 2555 days, the equivalent of seven years. Default: `2555`.
	RetentionPeriod pulumi.IntPtrOutput `pulumi:"retentionPeriod"`
	// Specifies whether to stop ingesting new events into the event data store. If set to `true`, ingestion is suspended while maintaining the ability to query existing events. If set to `false`, ingestion is active.
	Suspend pulumi.StringPtrOutput `pulumi:"suspend"`
	// A map of tags to assign to the resource. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
	Tags pulumi.StringMapOutput `pulumi:"tags"`
	// Map of tags assigned to the resource, including those inherited from the provider `defaultTags` configuration block.
	TagsAll pulumi.StringMapOutput `pulumi:"tagsAll"`
	// Specifies whether termination protection is enabled for the event data store. If termination protection is enabled, you cannot delete the event data store until termination protection is disabled. Default: `true`.
	TerminationProtectionEnabled pulumi.BoolPtrOutput `pulumi:"terminationProtectionEnabled"`
}

type EventDataStoreAdvancedEventSelector struct {
	// Specifies the selector statements in an advanced event selector. Fields documented below.
	FieldSelectors []EventDataStoreAdvancedEventSelectorFieldSelector `pulumi:"fieldSelectors"`
	// Specifies the name of the advanced event selector.
	Name *string `pulumi:"name"`
}

type EventDataStoreAdvancedEventSelectorArgs struct {
	// Specifies the selector statements in an advanced event selector. Fields documented below.
	FieldSelectors EventDataStoreAdvancedEventSelectorFieldSelectorArrayInput `pulumi:"fieldSelectors"`
	// Specifies the name of the advanced event selector.
	Name pulumi.StringPtrInput `pulumi:"name"`
}

type EventDataStoreAdvancedEventSelectorArray []EventDataStoreAdvancedEventSelectorInput

type EventDataStoreAdvancedEventSelectorArrayInput interface {
	pulumi.Input

	ToEventDataStoreAdvancedEventSelectorArrayOutput() EventDataStoreAdvancedEventSelectorArrayOutput
	ToEventDataStoreAdvancedEventSelectorArrayOutputWithContext(context.Context) EventDataStoreAdvancedEventSelectorArrayOutput
}

type EventDataStoreAdvancedEventSelectorArrayOutput struct{ *pulumi.OutputState }

type EventDataStoreAdvancedEventSelectorFieldSelector struct {
	// A list of values that includes events that match the last few characters of the event record field specified as the value of `field`.
	EndsWiths []string `pulumi:"endsWiths"`
	// A list of values that includes events that match the exact value of the event record field specified as the value of `field`. This is the only valid operator that you can use with the `readOnly`, `eventCategory`, and `resources.type` fields.
	Equals []string `pulumi:"equals"`
	// Specifies a field in an event record on which to filter events to be logged. You can specify only the following values: `readOnly`, `eventSource`, `eventName`, `eventCategory`, `resources.type`, `resources.ARN`.
	Field *string `pulumi:"field"`
	// A list of values that excludes events that match the last few characters of the event record field specified as the value of `field`.
	NotEndsWiths []string `pulumi:"notEndsWiths"`
	// A list of values that excludes events that match the exact value of the event record field specified as the value of `field`.
	NotEquals []string `pulumi:"notEquals"`
	// A list of values that excludes events that match the first few characters of the event record field specified as the value of `field`.
	NotStartsWiths []string `pulumi:"notStartsWiths"`
	// A list of values that includes events that match the first few characters of the event record field specified as the value of `field`.
	StartsWiths []string `pulumi:"startsWiths"`
}

type EventDataStoreAdvancedEventSelectorFieldSelectorArgs struct {
	// A list of values that includes events that match the last few characters of the event record field specified as the value of `field`.
	EndsWiths pulumi.StringArrayInput `pulumi:"endsWiths"`
	// A list of values that includes events that match the exact value of the event record field specified as the value of `field`. This is the only valid operator that you can use with the `readOnly`, `eventCategory`, and `resources.type` fields.
	Equals pulumi.StringArrayInput `pulumi:"equals"`
	// Specifies a field in an event record on which to filter events to be logged. You can specify only the following values: `readOnly`, `eventSource`, `eventName`, `eventCategory`, `resources.type`, `resources.ARN`.
	Field pulumi.StringPtrInput `pulumi:"field"`
	// A list of values that excludes events that match the last few characters of the event record field specified as the value of `field`.
	NotEndsWiths pulumi.StringArrayInput `pulumi:"notEndsWiths"`
	// A list of values that excludes events that match the exact value of the event record field specified as the value of `field`.
	NotEquals pulumi.StringArrayInput `pulumi:"notEquals"`
	// A list of values that excludes events that match the first few characters of the event record field specified as the value of `field`.
	NotStartsWiths pulumi.StringArrayInput `pulumi:"notStartsWiths"`
	// A list of values that includes events that match the first few characters of the event record field specified as the value of `field`.
	StartsWiths pulumi.StringArrayInput `pulumi:"startsWiths"`
}

type EventDataStoreAdvancedEventSelectorFieldSelectorArray []EventDataStoreAdvancedEventSelectorFieldSelectorInput

type EventDataStoreAdvancedEventSelectorFieldSelectorArrayInput interface {
	pulumi.Input

	ToEventDataStoreAdvancedEventSelectorFieldSelectorArrayOutput() EventDataStoreAdvancedEventSelectorFieldSelectorArrayOutput
	ToEventDataStoreAdvancedEventSelectorFieldSelectorArrayOutputWithContext(context.Context) EventDataStoreAdvancedEventSelectorFieldSelectorArrayOutput
}

type EventDataStoreAdvancedEventSelectorFieldSelectorArrayOutput struct{ *pulumi.OutputState }

type EventDataStoreAdvancedEventSelectorFieldSelectorInput interface {
	pulumi.Input

	ToEventDataStoreAdvancedEventSelectorFieldSelectorOutput() EventDataStoreAdvancedEventSelectorFieldSelectorOutput
	ToEventDataStoreAdvancedEventSelectorFieldSelectorOutputWithContext(context.Context) EventDataStoreAdvancedEventSelectorFieldSelectorOutput
}

type EventDataStoreAdvancedEventSelectorFieldSelectorOutput struct{ *pulumi.OutputState }

type EventDataStoreAdvancedEventSelectorInput interface {
	pulumi.Input

	ToEventDataStoreAdvancedEventSelectorOutput() EventDataStoreAdvancedEventSelectorOutput
	ToEventDataStoreAdvancedEventSelectorOutputWithContext(context.Context) EventDataStoreAdvancedEventSelectorOutput
}

type EventDataStoreAdvancedEventSelectorOutput struct{ *pulumi.OutputState }

type EventDataStoreArgs struct {
	// The advanced event selectors to use to select the events for the data store. For more information about how to use advanced event selectors, see [Log events by using advanced event selectors](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html#creating-data-event-selectors-advanced) in the CloudTrail User Guide.
	AdvancedEventSelectors EventDataStoreAdvancedEventSelectorArrayInput
	// The billing mode for the event data store. The valid values are `EXTENDABLE_RETENTION_PRICING` and `FIXED_RETENTION_PRICING`. Defaults to `EXTENDABLE_RETENTION_PRICING`.
	BillingMode pulumi.StringPtrInput
	// Specifies the AWS KMS key ID to use to encrypt the events delivered by CloudTrail. The value can be an alias name prefixed by alias/, a fully specified ARN to an alias, a fully specified ARN to a key, or a globally unique identifier.
	KmsKeyId pulumi.StringPtrInput
	// Specifies whether the event data store includes events from all regions, or only from the region in which the event data store is created. Default: `true`.
	MultiRegionEnabled pulumi.BoolPtrInput
	// The name of the event data store.
	Name pulumi.StringPtrInput
	// Specifies whether an event data store collects events logged for an organization in AWS Organizations. Default: `false`.
	OrganizationEnabled pulumi.BoolPtrInput
	// Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.
	Region pulumi.StringPtrInput
	// The retention period of the event data store, in days. You can set a retention period of up to 2555 days, the equivalent of seven years. Default: `2555`.
	RetentionPeriod pulumi.IntPtrInput
	// Specifies whether to stop ingesting new events into the event data store. If set to `true`, ingestion is suspended while maintaining the ability to query existing events. If set to `false`, ingestion is active.
	Suspend pulumi.StringPtrInput
	// A map of tags to assign to the resource. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
	Tags pulumi.StringMapInput
	// Specifies whether termination protection is enabled for the event data store. If termination protection is enabled, you cannot delete the event data store until termination protection is disabled. Default: `true`.
	TerminationProtectionEnabled pulumi.BoolPtrInput
}

type EventDataStoreArray []EventDataStoreInput

type EventDataStoreArrayInput interface {
	pulumi.Input

	ToEventDataStoreArrayOutput() EventDataStoreArrayOutput
	ToEventDataStoreArrayOutputWithContext(context.Context) EventDataStoreArrayOutput
}

type EventDataStoreArrayOutput struct{ *pulumi.OutputState }

type EventDataStoreInput interface {
	pulumi.Input

	ToEventDataStoreOutput() EventDataStoreOutput
	ToEventDataStoreOutputWithContext(ctx context.Context) EventDataStoreOutput
}

type EventDataStoreMap map[string]EventDataStoreInput

type EventDataStoreMapInput interface {
	pulumi.Input

	ToEventDataStoreMapOutput() EventDataStoreMapOutput
	ToEventDataStoreMapOutputWithContext(context.Context) EventDataStoreMapOutput
}

type EventDataStoreMapOutput struct{ *pulumi.OutputState }

type EventDataStoreOutput struct{ *pulumi.OutputState }

type EventDataStoreState struct {
	// The advanced event selectors to use to select the events for the data store. For more information about how to use advanced event selectors, see [Log events by using advanced event selectors](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html#creating-data-event-selectors-advanced) in the CloudTrail User Guide.
	AdvancedEventSelectors EventDataStoreAdvancedEventSelectorArrayInput
	// ARN of the event data store.
	Arn pulumi.StringPtrInput
	// The billing mode for the event data store. The valid values are `EXTENDABLE_RETENTION_PRICING` and `FIXED_RETENTION_PRICING`. Defaults to `EXTENDABLE_RETENTION_PRICING`.
	BillingMode pulumi.StringPtrInput
	// Specifies the AWS KMS key ID to use to encrypt the events delivered by CloudTrail. The value can be an alias name prefixed by alias/, a fully specified ARN to an alias, a fully specified ARN to a key, or a globally unique identifier.
	KmsKeyId pulumi.StringPtrInput
	// Specifies whether the event data store includes events from all regions, or only from the region in which the event data store is created. Default: `true`.
	MultiRegionEnabled pulumi.BoolPtrInput
	// The name of the event data store.
	Name pulumi.StringPtrInput
	// Specifies whether an event data store collects events logged for an organization in AWS Organizations. Default: `false`.
	OrganizationEnabled pulumi.BoolPtrInput
	// Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.
	Region pulumi.StringPtrInput
	// The retention period of the event data store, in days. You can set a retention period of up to 2555 days, the equivalent of seven years. Default: `2555`.
	RetentionPeriod pulumi.IntPtrInput
	// Specifies whether to stop ingesting new events into the event data store. If set to `true`, ingestion is suspended while maintaining the ability to query existing events. If set to `false`, ingestion is active.
	Suspend pulumi.StringPtrInput
	// A map of tags to assign to the resource. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
	Tags pulumi.StringMapInput
	// Map of tags assigned to the resource, including those inherited from the provider `defaultTags` configuration block.
	TagsAll pulumi.StringMapInput
	// Specifies whether termination protection is enabled for the event data store. If termination protection is enabled, you cannot delete the event data store until termination protection is disabled. Default: `true`.
	TerminationProtectionEnabled pulumi.BoolPtrInput
}

type GetServiceAccountArgs struct {
	// Name of the Region whose AWS CloudTrail account ID is desired. Defaults to the Region set in the provider configuration.
	Region *string `pulumi:"region"`
}

type GetServiceAccountOutputArgs struct {
	// Name of the Region whose AWS CloudTrail account ID is desired. Defaults to the Region set in the provider configuration.
	Region pulumi.StringPtrInput `pulumi:"region"`
}

type GetServiceAccountResult struct {
	// ARN of the AWS CloudTrail service account in the selected Region.
	Arn string `pulumi:"arn"`
	// The provider-assigned unique ID for this managed resource.
	Id     string `pulumi:"id"`
	Region string `pulumi:"region"`
}

type GetServiceAccountResultOutput struct{ *pulumi.OutputState }

type OrganizationDelegatedAdminAccount struct {
	pulumi.CustomResourceState

	// An organization member account ID that you want to designate as a delegated administrator.
	AccountId pulumi.StringOutput `pulumi:"accountId"`
	// The Amazon Resource Name (ARN) of the delegated administrator's account.
	Arn pulumi.StringOutput `pulumi:"arn"`
	// The email address that is associated with the delegated administrator's AWS account.
	Email pulumi.StringOutput `pulumi:"email"`
	// The friendly name of the delegated administrator's account.
	Name pulumi.StringOutput `pulumi:"name"`
	// The AWS CloudTrail service principal name.
	ServicePrincipal pulumi.StringOutput `pulumi:"servicePrincipal"`
}

type OrganizationDelegatedAdminAccountArgs struct {
	// An organization member account ID that you want to designate as a delegated administrator.
	AccountId pulumi.StringInput
}

type OrganizationDelegatedAdminAccountArray []OrganizationDelegatedAdminAccountInput

type OrganizationDelegatedAdminAccountArrayInput interface {
	pulumi.Input

	ToOrganizationDelegatedAdminAccountArrayOutput() OrganizationDelegatedAdminAccountArrayOutput
	ToOrganizationDelegatedAdminAccountArrayOutputWithContext(context.Context) OrganizationDelegatedAdminAccountArrayOutput
}

type OrganizationDelegatedAdminAccountArrayOutput struct{ *pulumi.OutputState }

type OrganizationDelegatedAdminAccountInput interface {
	pulumi.Input

	ToOrganizationDelegatedAdminAccountOutput() OrganizationDelegatedAdminAccountOutput
	ToOrganizationDelegatedAdminAccountOutputWithContext(ctx context.Context) OrganizationDelegatedAdminAccountOutput
}

type OrganizationDelegatedAdminAccountMap map[string]OrganizationDelegatedAdminAccountInput

type OrganizationDelegatedAdminAccountMapInput interface {
	pulumi.Input

	ToOrganizationDelegatedAdminAccountMapOutput() OrganizationDelegatedAdminAccountMapOutput
	ToOrganizationDelegatedAdminAccountMapOutputWithContext(context.Context) OrganizationDelegatedAdminAccountMapOutput
}

type OrganizationDelegatedAdminAccountMapOutput struct{ *pulumi.OutputState }

type OrganizationDelegatedAdminAccountOutput struct{ *pulumi.OutputState }

type OrganizationDelegatedAdminAccountState struct {
	// An organization member account ID that you want to designate as a delegated administrator.
	AccountId pulumi.StringPtrInput
	// The Amazon Resource Name (ARN) of the delegated administrator's account.
	Arn pulumi.StringPtrInput
	// The email address that is associated with the delegated administrator's AWS account.
	Email pulumi.StringPtrInput
	// The friendly name of the delegated administrator's account.
	Name pulumi.StringPtrInput
	// The AWS CloudTrail service principal name.
	ServicePrincipal pulumi.StringPtrInput
}

type Trail struct {
	pulumi.CustomResourceState

	// Specifies an advanced event selector for enabling data event logging. Fields documented below. Conflicts with `eventSelector`.
	AdvancedEventSelectors TrailAdvancedEventSelectorArrayOutput `pulumi:"advancedEventSelectors"`
	// ARN of the trail.
	Arn pulumi.StringOutput `pulumi:"arn"`
	// Log group name using an ARN that represents the log group to which CloudTrail logs will be delivered. Note that CloudTrail requires the Log Stream wildcard.
	CloudWatchLogsGroupArn pulumi.StringPtrOutput `pulumi:"cloudWatchLogsGroupArn"`
	// Role for the CloudWatch Logs endpoint to assume to write to a user’s log group.
	CloudWatchLogsRoleArn pulumi.StringPtrOutput `pulumi:"cloudWatchLogsRoleArn"`
	// Whether log file integrity validation is enabled. Defaults to `false`.
	EnableLogFileValidation pulumi.BoolPtrOutput `pulumi:"enableLogFileValidation"`
	// Enables logging for the trail. When set to `true`, logging is started by calling the [`StartLogging`](https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_StartLogging.html) API. When set to `false`, logging is stopped by calling the [`StopLogging`](https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_StopLogging.html) API. Defaults to `true`.
	EnableLogging pulumi.BoolPtrOutput `pulumi:"enableLogging"`
	// Specifies an event selector for enabling data event logging. Fields documented below. Please note the [CloudTrail limits](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/WhatIsCloudTrail-Limits.html) when configuring these. Conflicts with `advancedEventSelector`.
	EventSelectors TrailEventSelectorArrayOutput `pulumi:"eventSelectors"`
	// Region in which the trail was created.
	HomeRegion pulumi.StringOutput `pulumi:"homeRegion"`
	// Whether the trail is publishing events from global services such as IAM to the log files. Defaults to `true`.
	IncludeGlobalServiceEvents pulumi.BoolPtrOutput `pulumi:"includeGlobalServiceEvents"`
	// Configuration block for identifying unusual operational activity. See details below.
	InsightSelectors TrailInsightSelectorArrayOutput `pulumi:"insightSelectors"`
	// Whether the trail is created in the current region or in all regions. Defaults to `false`.
	IsMultiRegionTrail pulumi.BoolPtrOutput `pulumi:"isMultiRegionTrail"`
	// Whether the trail is an AWS Organizations trail. Organization trails log events for the master account and all member accounts. Can only be created in the organization master account. Defaults to `false`.
	IsOrganizationTrail pulumi.BoolPtrOutput `pulumi:"isOrganizationTrail"`
	// KMS key ARN to use to encrypt the logs delivered by CloudTrail.
	KmsKeyId pulumi.StringPtrOutput `pulumi:"kmsKeyId"`
	// Name of the trail.
	Name pulumi.StringOutput `pulumi:"name"`
	// Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.
	Region pulumi.StringOutput `pulumi:"region"`
	// Name of the S3 bucket designated for publishing log files.
	//
	// The following arguments are optional:
	S3BucketName pulumi.StringOutput `pulumi:"s3BucketName"`
	// S3 key prefix that follows the name of the bucket you have designated for log file delivery.
	S3KeyPrefix pulumi.StringPtrOutput `pulumi:"s3KeyPrefix"`
	// ARN of the Amazon SNS topic that CloudTrail uses to send notifications when log files are delivered.
	SnsTopicArn pulumi.StringOutput `pulumi:"snsTopicArn"`
	// Name of the Amazon SNS topic defined for notification of log file delivery. Specify the SNS topic ARN if it resides in another region.
	SnsTopicName pulumi.StringPtrOutput `pulumi:"snsTopicName"`
	// Map of tags to assign to the trail. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
	Tags pulumi.StringMapOutput `pulumi:"tags"`
	// Map of tags assigned to the resource, including those inherited from the provider `defaultTags` configuration block.
	TagsAll pulumi.StringMapOutput `pulumi:"tagsAll"`
}

type TrailAdvancedEventSelector struct {
	// Specifies the selector statements in an advanced event selector. Fields documented below.
	FieldSelectors []TrailAdvancedEventSelectorFieldSelector `pulumi:"fieldSelectors"`
	// Name of the trail.
	Name *string `pulumi:"name"`
}

type TrailAdvancedEventSelectorArgs struct {
	// Specifies the selector statements in an advanced event selector. Fields documented below.
	FieldSelectors TrailAdvancedEventSelectorFieldSelectorArrayInput `pulumi:"fieldSelectors"`
	// Name of the trail.
	Name pulumi.StringPtrInput `pulumi:"name"`
}

type TrailAdvancedEventSelectorArray []TrailAdvancedEventSelectorInput

type TrailAdvancedEventSelectorArrayInput interface {
	pulumi.Input

	ToTrailAdvancedEventSelectorArrayOutput() TrailAdvancedEventSelectorArrayOutput
	ToTrailAdvancedEventSelectorArrayOutputWithContext(context.Context) TrailAdvancedEventSelectorArrayOutput
}

type TrailAdvancedEventSelectorArrayOutput struct{ *pulumi.OutputState }

type TrailAdvancedEventSelectorFieldSelector struct {
	// A list of values that includes events that match the last few characters of the event record field specified as the value of `field`.
	EndsWiths []string `pulumi:"endsWiths"`
	// A list of values that includes events that match the exact value of the event record field specified as the value of `field`. This is the only valid operator that you can use with the `readOnly`, `eventCategory`, and `resources.type` fields.
	Equals []string `pulumi:"equals"`
	// Field in an event record on which to filter events to be logged. You can specify only the following values: `readOnly`, `eventSource`, `eventName`, `eventCategory`, `resources.type`, `resources.ARN`.
	Field string `pulumi:"field"`
	// A list of values that excludes events that match the last few characters of the event record field specified as the value of `field`.
	NotEndsWiths []string `pulumi:"notEndsWiths"`
	// A list of values that excludes events that match the exact value of the event record field specified as the value of `field`.
	NotEquals []string `pulumi:"notEquals"`
	// A list of values that excludes events that match the first few characters of the event record field specified as the value of `field`.
	NotStartsWiths []string `pulumi:"notStartsWiths"`
	// A list of values that includes events that match the first few characters of the event record field specified as the value of `field`.
	StartsWiths []string `pulumi:"startsWiths"`
}

type TrailAdvancedEventSelectorFieldSelectorArgs struct {
	// A list of values that includes events that match the last few characters of the event record field specified as the value of `field`.
	EndsWiths pulumi.StringArrayInput `pulumi:"endsWiths"`
	// A list of values that includes events that match the exact value of the event record field specified as the value of `field`. This is the only valid operator that you can use with the `readOnly`, `eventCategory`, and `resources.type` fields.
	Equals pulumi.StringArrayInput `pulumi:"equals"`
	// Field in an event record on which to filter events to be logged. You can specify only the following values: `readOnly`, `eventSource`, `eventName`, `eventCategory`, `resources.type`, `resources.ARN`.
	Field pulumi.StringInput `pulumi:"field"`
	// A list of values that excludes events that match the last few characters of the event record field specified as the value of `field`.
	NotEndsWiths pulumi.StringArrayInput `pulumi:"notEndsWiths"`
	// A list of values that excludes events that match the exact value of the event record field specified as the value of `field`.
	NotEquals pulumi.StringArrayInput `pulumi:"notEquals"`
	// A list of values that excludes events that match the first few characters of the event record field specified as the value of `field`.
	NotStartsWiths pulumi.StringArrayInput `pulumi:"notStartsWiths"`
	// A list of values that includes events that match the first few characters of the event record field specified as the value of `field`.
	StartsWiths pulumi.StringArrayInput `pulumi:"startsWiths"`
}

type TrailAdvancedEventSelectorFieldSelectorArray []TrailAdvancedEventSelectorFieldSelectorInput

type TrailAdvancedEventSelectorFieldSelectorArrayInput interface {
	pulumi.Input

	ToTrailAdvancedEventSelectorFieldSelectorArrayOutput() TrailAdvancedEventSelectorFieldSelectorArrayOutput
	ToTrailAdvancedEventSelectorFieldSelectorArrayOutputWithContext(context.Context) TrailAdvancedEventSelectorFieldSelectorArrayOutput
}

type TrailAdvancedEventSelectorFieldSelectorArrayOutput struct{ *pulumi.OutputState }

type TrailAdvancedEventSelectorFieldSelectorInput interface {
	pulumi.Input

	ToTrailAdvancedEventSelectorFieldSelectorOutput() TrailAdvancedEventSelectorFieldSelectorOutput
	ToTrailAdvancedEventSelectorFieldSelectorOutputWithContext(context.Context) TrailAdvancedEventSelectorFieldSelectorOutput
}

type TrailAdvancedEventSelectorFieldSelectorOutput struct{ *pulumi.OutputState }

type TrailAdvancedEventSelectorInput interface {
	pulumi.Input

	ToTrailAdvancedEventSelectorOutput() TrailAdvancedEventSelectorOutput
	ToTrailAdvancedEventSelectorOutputWithContext(context.Context) TrailAdvancedEventSelectorOutput
}

type TrailAdvancedEventSelectorOutput struct{ *pulumi.OutputState }

type TrailArgs struct {
	// Specifies an advanced event selector for enabling data event logging. Fields documented below. Conflicts with `eventSelector`.
	AdvancedEventSelectors TrailAdvancedEventSelectorArrayInput
	// Log group name using an ARN that represents the log group to which CloudTrail logs will be delivered. Note that CloudTrail requires the Log Stream wildcard.
	CloudWatchLogsGroupArn pulumi.StringPtrInput
	// Role for the CloudWatch Logs endpoint to assume to write to a user’s log group.
	CloudWatchLogsRoleArn pulumi.StringPtrInput
	// Whether log file integrity validation is enabled. Defaults to `false`.
	EnableLogFileValidation pulumi.BoolPtrInput
	// Enables logging for the trail. When set to `true`, logging is started by calling the [`StartLogging`](https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_StartLogging.html) API. When set to `false`, logging is stopped by calling the [`StopLogging`](https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_StopLogging.html) API. Defaults to `true`.
	EnableLogging pulumi.BoolPtrInput
	// Specifies an event selector for enabling data event logging. Fields documented below. Please note the [CloudTrail limits](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/WhatIsCloudTrail-Limits.html) when configuring these. Conflicts with `advancedEventSelector`.
	EventSelectors TrailEventSelectorArrayInput
	// Whether the trail is publishing events from global services such as IAM to the log files. Defaults to `true`.
	IncludeGlobalServiceEvents pulumi.BoolPtrInput
	// Configuration block for identifying unusual operational activity. See details below.
	InsightSelectors TrailInsightSelectorArrayInput
	// Whether the trail is created in the current region or in all regions. Defaults to `false`.
	IsMultiRegionTrail pulumi.BoolPtrInput
	// Whether the trail is an AWS Organizations trail. Organization trails log events for the master account and all member accounts. Can only be created in the organization master account. Defaults to `false`.
	IsOrganizationTrail pulumi.BoolPtrInput
	// KMS key ARN to use to encrypt the logs delivered by CloudTrail.
	KmsKeyId pulumi.StringPtrInput
	// Name of the trail.
	Name pulumi.StringPtrInput
	// Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.
	Region pulumi.StringPtrInput
	// Name of the S3 bucket designated for publishing log files.
	//
	// The following arguments are optional:
	S3BucketName pulumi.StringInput
	// S3 key prefix that follows the name of the bucket you have designated for log file delivery.
	S3KeyPrefix pulumi.StringPtrInput
	// Name of the Amazon SNS topic defined for notification of log file delivery. Specify the SNS topic ARN if it resides in another region.
	SnsTopicName pulumi.StringPtrInput
	// Map of tags to assign to the trail. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
	Tags pulumi.StringMapInput
}

type TrailArray []TrailInput

type TrailArrayInput interface {
	pulumi.Input

	ToTrailArrayOutput() TrailArrayOutput
	ToTrailArrayOutputWithContext(context.Context) TrailArrayOutput
}

type TrailArrayOutput struct{ *pulumi.OutputState }

type TrailEventSelector struct {
	// Configuration block for data events. See details below.
	DataResources []TrailEventSelectorDataResource `pulumi:"dataResources"`
	// A set of event sources to exclude. Valid values include: `kms.amazonaws.com` and `rdsdata.amazonaws.com`. `includeManagementEvents` must be set to`true` to allow this.
	ExcludeManagementEventSources []string `pulumi:"excludeManagementEventSources"`
	// Whether to include management events for your trail. Defaults to `true`.
	IncludeManagementEvents *bool `pulumi:"includeManagementEvents"`
	// Type of events to log. Valid values are `ReadOnly`, `WriteOnly`, `All`. Default value is `All`.
	ReadWriteType *string `pulumi:"readWriteType"`
}

type TrailEventSelectorArgs struct {
	// Configuration block for data events. See details below.
	DataResources TrailEventSelectorDataResourceArrayInput `pulumi:"dataResources"`
	// A set of event sources to exclude. Valid values include: `kms.amazonaws.com` and `rdsdata.amazonaws.com`. `includeManagementEvents` must be set to`true` to allow this.
	ExcludeManagementEventSources pulumi.StringArrayInput `pulumi:"excludeManagementEventSources"`
	// Whether to include management events for your trail. Defaults to `true`.
	IncludeManagementEvents pulumi.BoolPtrInput `pulumi:"includeManagementEvents"`
	// Type of events to log. Valid values are `ReadOnly`, `WriteOnly`, `All`. Default value is `All`.
	ReadWriteType pulumi.StringPtrInput `pulumi:"readWriteType"`
}

type TrailEventSelectorArray []TrailEventSelectorInput

type TrailEventSelectorArrayInput interface {
	pulumi.Input

	ToTrailEventSelectorArrayOutput() TrailEventSelectorArrayOutput
	ToTrailEventSelectorArrayOutputWithContext(context.Context) TrailEventSelectorArrayOutput
}

type TrailEventSelectorArrayOutput struct{ *pulumi.OutputState }

type TrailEventSelectorDataResource struct {
	// Resource type in which you want to log data events. You can specify only the following value: "AWS::S3::Object", "AWS::Lambda::Function" and "AWS::DynamoDB::Table".
	Type string `pulumi:"type"`
	// List of ARN strings or partial ARN strings to specify selectors for data audit events over data resources. ARN list is specific to single-valued `type`. For example, `arn:aws:s3:::<bucket name>/` for all objects in a bucket, `arn:aws:s3:::<bucket name>/key` for specific objects, `arn:aws:lambda` for all lambda events within an account, `arn:aws:lambda:<region>:<account number>:function:<function name>` for a specific Lambda function, `arn:aws:dynamodb` for all DDB events for all tables within an account, or `arn:aws:dynamodb:<region>:<account number>:table/<table name>` for a specific DynamoDB table.
	Values []string `pulumi:"values"`
}

type TrailEventSelectorDataResourceArgs struct {
	// Resource type in which you want to log data events. You can specify only the following value: "AWS::S3::Object", "AWS::Lambda::Function" and "AWS::DynamoDB::Table".
	Type pulumi.StringInput `pulumi:"type"`
	// List of ARN strings or partial ARN strings to specify selectors for data audit events over data resources. ARN list is specific to single-valued `type`. For example, `arn:aws:s3:::<bucket name>/` for all objects in a bucket, `arn:aws:s3:::<bucket name>/key` for specific objects, `arn:aws:lambda` for all lambda events within an account, `arn:aws:lambda:<region>:<account number>:function:<function name>` for a specific Lambda function, `arn:aws:dynamodb` for all DDB events for all tables within an account, or `arn:aws:dynamodb:<region>:<account number>:table/<table name>` for a specific DynamoDB table.
	Values pulumi.StringArrayInput `pulumi:"values"`
}

type TrailEventSelectorDataResourceArray []TrailEventSelectorDataResourceInput

type TrailEventSelectorDataResourceArrayInput interface {
	pulumi.Input

	ToTrailEventSelectorDataResourceArrayOutput() TrailEventSelectorDataResourceArrayOutput
	ToTrailEventSelectorDataResourceArrayOutputWithContext(context.Context) TrailEventSelectorDataResourceArrayOutput
}

type TrailEventSelectorDataResourceArrayOutput struct{ *pulumi.OutputState }

type TrailEventSelectorDataResourceInput interface {
	pulumi.Input

	ToTrailEventSelectorDataResourceOutput() TrailEventSelectorDataResourceOutput
	ToTrailEventSelectorDataResourceOutputWithContext(context.Context) TrailEventSelectorDataResourceOutput
}

type TrailEventSelectorDataResourceOutput struct{ *pulumi.OutputState }

type TrailEventSelectorInput interface {
	pulumi.Input

	ToTrailEventSelectorOutput() TrailEventSelectorOutput
	ToTrailEventSelectorOutputWithContext(context.Context) TrailEventSelectorOutput
}

type TrailEventSelectorOutput struct{ *pulumi.OutputState }

type TrailInput interface {
	pulumi.Input

	ToTrailOutput() TrailOutput
	ToTrailOutputWithContext(ctx context.Context) TrailOutput
}

type TrailInsightSelector struct {
	// Type of insights to log on a trail. Valid values are: `ApiCallRateInsight` and `ApiErrorRateInsight`.
	InsightType string `pulumi:"insightType"`
}

type TrailInsightSelectorArgs struct {
	// Type of insights to log on a trail. Valid values are: `ApiCallRateInsight` and `ApiErrorRateInsight`.
	InsightType pulumi.StringInput `pulumi:"insightType"`
}

type TrailInsightSelectorArray []TrailInsightSelectorInput

type TrailInsightSelectorArrayInput interface {
	pulumi.Input

	ToTrailInsightSelectorArrayOutput() TrailInsightSelectorArrayOutput
	ToTrailInsightSelectorArrayOutputWithContext(context.Context) TrailInsightSelectorArrayOutput
}

type TrailInsightSelectorArrayOutput struct{ *pulumi.OutputState }

type TrailInsightSelectorInput interface {
	pulumi.Input

	ToTrailInsightSelectorOutput() TrailInsightSelectorOutput
	ToTrailInsightSelectorOutputWithContext(context.Context) TrailInsightSelectorOutput
}

type TrailInsightSelectorOutput struct{ *pulumi.OutputState }

type TrailMap map[string]TrailInput

type TrailMapInput interface {
	pulumi.Input

	ToTrailMapOutput() TrailMapOutput
	ToTrailMapOutputWithContext(context.Context) TrailMapOutput
}

type TrailMapOutput struct{ *pulumi.OutputState }

type TrailOutput struct{ *pulumi.OutputState }

type TrailState struct {
	// Specifies an advanced event selector for enabling data event logging. Fields documented below. Conflicts with `eventSelector`.
	AdvancedEventSelectors TrailAdvancedEventSelectorArrayInput
	// ARN of the trail.
	Arn pulumi.StringPtrInput
	// Log group name using an ARN that represents the log group to which CloudTrail logs will be delivered. Note that CloudTrail requires the Log Stream wildcard.
	CloudWatchLogsGroupArn pulumi.StringPtrInput
	// Role for the CloudWatch Logs endpoint to assume to write to a user’s log group.
	CloudWatchLogsRoleArn pulumi.StringPtrInput
	// Whether log file integrity validation is enabled. Defaults to `false`.
	EnableLogFileValidation pulumi.BoolPtrInput
	// Enables logging for the trail. When set to `true`, logging is started by calling the [`StartLogging`](https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_StartLogging.html) API. When set to `false`, logging is stopped by calling the [`StopLogging`](https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_StopLogging.html) API. Defaults to `true`.
	EnableLogging pulumi.BoolPtrInput
	// Specifies an event selector for enabling data event logging. Fields documented below. Please note the [CloudTrail limits](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/WhatIsCloudTrail-Limits.html) when configuring these. Conflicts with `advancedEventSelector`.
	EventSelectors TrailEventSelectorArrayInput
	// Region in which the trail was created.
	HomeRegion pulumi.StringPtrInput
	// Whether the trail is publishing events from global services such as IAM to the log files. Defaults to `true`.
	IncludeGlobalServiceEvents pulumi.BoolPtrInput
	// Configuration block for identifying unusual operational activity. See details below.
	InsightSelectors TrailInsightSelectorArrayInput
	// Whether the trail is created in the current region or in all regions. Defaults to `false`.
	IsMultiRegionTrail pulumi.BoolPtrInput
	// Whether the trail is an AWS Organizations trail. Organization trails log events for the master account and all member accounts. Can only be created in the organization master account. Defaults to `false`.
	IsOrganizationTrail pulumi.BoolPtrInput
	// KMS key ARN to use to encrypt the logs delivered by CloudTrail.
	KmsKeyId pulumi.StringPtrInput
	// Name of the trail.
	Name pulumi.StringPtrInput
	// Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.
	Region pulumi.StringPtrInput
	// Name of the S3 bucket designated for publishing log files.
	//
	// The following arguments are optional:
	S3BucketName pulumi.StringPtrInput
	// S3 key prefix that follows the name of the bucket you have designated for log file delivery.
	S3KeyPrefix pulumi.StringPtrInput
	// ARN of the Amazon SNS topic that CloudTrail uses to send notifications when log files are delivered.
	SnsTopicArn pulumi.StringPtrInput
	// Name of the Amazon SNS topic defined for notification of log file delivery. Specify the SNS topic ARN if it resides in another region.
	SnsTopicName pulumi.StringPtrInput
	// Map of tags to assign to the trail. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
	Tags pulumi.StringMapInput
	// Map of tags assigned to the resource, including those inherited from the provider `defaultTags` configuration block.
	TagsAll pulumi.StringMapInput
}