{
  "typeName" : "AWS::ObservabilityAdmin::TelemetryRule",
  "description" : "The AWS::ObservabilityAdmin::TelemetryRule resource defines a CloudWatch Observability Admin Telemetry Rule.",
  "sourceUrl" : "https://github.com/aws-cloudformation/aws-cloudformation-rpdk.git",
  "tagging" : {
    "taggable" : true,
    "tagOnCreate" : true,
    "tagUpdatable" : true,
    "cloudFormationSystemTags" : true,
    "tagProperty" : "/properties/Tags",
    "permissions" : [ "observabilityadmin:TagResource", "observabilityadmin:UntagResource", "observabilityadmin:ListTagsForResource" ]
  },
  "definitions" : {
    "ResourceType" : {
      "description" : "Resource Type associated with the Telemetry Rule",
      "type" : "string",
      "enum" : [ "AWS::EC2::VPC", "AWS::WAFv2::WebACL", "AWS::CloudTrail", "AWS::EKS::Cluster", "AWS::ElasticLoadBalancingV2::LoadBalancer", "AWS::EC2::Instance", "AWS::BedrockAgentCore::Runtime", "AWS::BedrockAgentCore::Browser", "AWS::BedrockAgentCore::CodeInterpreter", "AWS::SecurityHub::Hub" ]
    },
    "TelemetryType" : {
      "description" : "Telemetry Type associated with the Telemetry Rule",
      "type" : "string",
      "enum" : [ "Logs", "Traces", "Metrics" ]
    },
    "Scope" : {
      "description" : "Selection Criteria on scope level for rule application",
      "type" : "string"
    },
    "SelectionCriteria" : {
      "description" : "Selection Criteria on resource level for rule application",
      "type" : "string"
    },
    "AllowFieldUpdates" : {
      "description" : "When true, configuration drift in managed telemetry resources will be detected and remediated for resource-level fields.",
      "type" : "boolean",
      "default" : false
    },
    "DestinationType" : {
      "description" : "Type of telemetry destination",
      "type" : "string",
      "enum" : [ "cloud-watch-logs" ]
    },
    "DestinationPattern" : {
      "description" : "Pattern for telemetry data destination",
      "type" : "string"
    },
    "RetentionInDays" : {
      "description" : "Number of days to retain the telemetry data in the specified destination",
      "type" : "integer"
    },
    "VPCFlowLogParameters" : {
      "description" : "Telemetry parameters for VPC Flow logs",
      "type" : "object",
      "properties" : {
        "LogFormat" : {
          "description" : "The fields to include in the flow log record. If you omit this parameter, the flow log is created using the default format.",
          "type" : "string"
        },
        "TrafficType" : {
          "description" : "The type of traffic captured for the flow log. Default is ALL",
          "type" : "string"
        },
        "MaxAggregationInterval" : {
          "description" : "The maximum interval of time, in seconds, during which a flow of packets is captured and aggregated into a flow log record. Default is 600s.",
          "type" : "integer"
        }
      },
      "required" : [ ],
      "additionalProperties" : false
    },
    "WAFLoggingParameters" : {
      "description" : "Telemetry parameters for WAF v2 Web ACL",
      "type" : "object",
      "properties" : {
        "RedactedFields" : {
          "description" : "Fields not to be included in the logs.",
          "$ref" : "#/definitions/RedactedFields"
        },
        "LoggingFilter" : {
          "$ref" : "#/definitions/LoggingFilter"
        },
        "LogType" : {
          "$ref" : "#/definitions/WAFLogType"
        }
      }
    },
    "CloudtrailParameters" : {
      "description" : "Telemetry parameters for Cloudtrail",
      "type" : "object",
      "properties" : {
        "AdvancedEventSelectors" : {
          "description" : "Create fine-grained selectors for AWS CloudTrail management and data.",
          "type" : "array",
          "uniqueItems" : true,
          "insertionOrder" : false,
          "items" : {
            "$ref" : "#/definitions/AdvancedEventSelector"
          }
        }
      },
      "required" : [ "AdvancedEventSelectors" ],
      "additionalProperties" : false
    },
    "AdvancedEventSelector" : {
      "description" : "An advanced event selector that includes optional name and field selectors",
      "type" : "object",
      "properties" : {
        "Name" : {
          "description" : "An optional descriptive name for the advanced event selector",
          "type" : "string"
        },
        "FieldSelectors" : {
          "description" : "Contains all selector statements in an advanced event selector.",
          "type" : "array",
          "uniqueItems" : true,
          "insertionOrder" : false,
          "items" : {
            "$ref" : "#/definitions/AdvancedFieldSelector"
          }
        }
      },
      "required" : [ "FieldSelectors" ],
      "additionalProperties" : false
    },
    "ELBLoadBalancerLoggingParameters" : {
      "description" : "Telemetry parameters for ELB/NLB Load Balancer Logs",
      "type" : "object",
      "properties" : {
        "OutputFormat" : {
          "type" : "string",
          "enum" : [ "plain", "json" ]
        },
        "FieldDelimiter" : {
          "description" : "A delimiter to delineate log fields",
          "type" : "string"
        }
      }
    },
    "TelemetryDestinationConfiguration" : {
      "description" : "The destination configuration for telemetry data",
      "type" : "object",
      "properties" : {
        "DestinationType" : {
          "$ref" : "#/definitions/DestinationType"
        },
        "DestinationPattern" : {
          "$ref" : "#/definitions/DestinationPattern"
        },
        "RetentionInDays" : {
          "$ref" : "#/definitions/RetentionInDays"
        },
        "VPCFlowLogParameters" : {
          "$ref" : "#/definitions/VPCFlowLogParameters"
        },
        "CloudtrailParameters" : {
          "$ref" : "#/definitions/CloudtrailParameters"
        },
        "ELBLoadBalancerLoggingParameters" : {
          "$ref" : "#/definitions/ELBLoadBalancerLoggingParameters"
        },
        "WAFLoggingParameters" : {
          "$ref" : "#/definitions/WAFLoggingParameters"
        },
        "LogDeliveryParameters" : {
          "description" : "Parameters for log delivery configuration",
          "type" : "object",
          "properties" : {
            "LogTypes" : {
              "description" : "Types of logs to deliver",
              "type" : "array",
              "uniqueItems" : true,
              "insertionOrder" : false,
              "minItems" : 1,
              "items" : {
                "type" : "string",
                "enum" : [ "APPLICATION_LOGS", "USAGE_LOGS", "SECURITY_FINDING_LOGS" ]
              }
            }
          },
          "additionalProperties" : false
        }
      },
      "required" : [ ],
      "additionalProperties" : false
    },
    "TelemetryRule" : {
      "description" : "The telemetry rule",
      "type" : "object",
      "properties" : {
        "ResourceType" : {
          "$ref" : "#/definitions/ResourceType"
        },
        "TelemetryType" : {
          "$ref" : "#/definitions/TelemetryType"
        },
        "TelemetrySourceTypes" : {
          "$ref" : "#/definitions/TelemetrySourceTypes"
        },
        "DestinationConfiguration" : {
          "$ref" : "#/definitions/TelemetryDestinationConfiguration"
        },
        "SelectionCriteria" : {
          "$ref" : "#/definitions/SelectionCriteria"
        },
        "AllowFieldUpdates" : {
          "$ref" : "#/definitions/AllowFieldUpdates"
        },
        "Regions" : {
          "description" : "List of AWS region codes where the rule should be replicated",
          "type" : "array",
          "uniqueItems" : true,
          "insertionOrder" : false,
          "items" : {
            "type" : "string"
          }
        },
        "AllRegions" : {
          "description" : "When true, the rule is replicated to all supported regions",
          "type" : "boolean"
        }
      },
      "required" : [ "ResourceType", "TelemetryType" ],
      "additionalProperties" : false
    },
    "Tag" : {
      "description" : "A key-value pair to associate with a resource",
      "type" : "object",
      "properties" : {
        "Key" : {
          "type" : "string",
          "description" : "The key name of the tag. You can specify a value that is 1 to 128 Unicode characters in length and cannot be prefixed with aws:. You can use any of the following characters: the set of Unicode letters, digits, whitespace, _, ., /, =, +, and -.",
          "minLength" : 1,
          "maxLength" : 128
        },
        "Value" : {
          "type" : "string",
          "description" : "The value for the tag. You can specify a value that is 0 to 256 Unicode characters in length and cannot be prefixed with aws:. You can use any of the following characters: the set of Unicode letters, digits, whitespace, _, ., /, =, +, and -.",
          "minLength" : 0,
          "maxLength" : 256
        }
      },
      "required" : [ "Key", "Value" ],
      "additionalProperties" : false
    },
    "AdvancedFieldSelector" : {
      "description" : "A single selector statement in an advanced event selector.",
      "type" : "object",
      "properties" : {
        "Field" : {
          "description" : "A field in a CloudTrail event record on which to filter events to be logged",
          "type" : "string",
          "minLength" : 1,
          "maxLength" : 1000
        },
        "EndsWith" : {
          "description" : "An operator that includes events that match the last few characters of the event record field specified as the value of Field.",
          "type" : "array",
          "uniqueItems" : true,
          "insertionOrder" : false,
          "items" : {
            "type" : "string"
          }
        },
        "Equals" : {
          "description" : "An operator that includes events that match the exact value of the event record field specified as the value of Field.",
          "type" : "array",
          "uniqueItems" : true,
          "insertionOrder" : false,
          "items" : {
            "type" : "string"
          }
        },
        "NotEndsWith" : {
          "description" : "An operator that excludes events that match the last few characters of the event record field specified as the value of Field.",
          "type" : "array",
          "uniqueItems" : true,
          "insertionOrder" : false,
          "items" : {
            "type" : "string"
          }
        },
        "NotEquals" : {
          "description" : "An operator that excludes events that match the exact value of the event record field specified as the value of Field.",
          "type" : "array",
          "uniqueItems" : true,
          "insertionOrder" : false,
          "items" : {
            "type" : "string"
          }
        },
        "NotStartsWith" : {
          "description" : "An operator that excludes events that match the first few characters of the event record field specified as the value of Field.",
          "type" : "array",
          "uniqueItems" : true,
          "insertionOrder" : false,
          "items" : {
            "type" : "string"
          }
        },
        "StartsWith" : {
          "description" : "An operator that includes events that match the first few characters of the event record field specified as the value of Field.",
          "type" : "array",
          "uniqueItems" : true,
          "insertionOrder" : false,
          "items" : {
            "type" : "string"
          }
        }
      }
    },
    "RedactedFields" : {
      "description" : "Fields not to be included in the logs.",
      "type" : "array",
      "maxItems" : 100,
      "uniqueItems" : true,
      "insertionOrder" : false,
      "items" : {
        "$ref" : "#/definitions/FieldToMatch"
      }
    },
    "FieldToMatch" : {
      "description" : "The field that we want to match this rule to.",
      "type" : "object",
      "properties" : {
        "SingleHeader" : {
          "$ref" : "#/definitions/SingleHeader"
        },
        "UriPath" : {
          "description" : "This is the URI path to match this rule to.",
          "type" : "string"
        },
        "QueryString" : {
          "description" : "The query string to find the resource to match this field to.",
          "type" : "string"
        },
        "Method" : {
          "description" : "The method with which to match this rule.",
          "type" : "string"
        }
      }
    },
    "SingleHeader" : {
      "description" : "Header for the field to match.",
      "type" : "object",
      "properties" : {
        "Name" : {
          "description" : "The name of the header",
          "type" : "string",
          "minLength" : 1,
          "maxLength" : 64
        }
      },
      "required" : [ "Name" ],
      "additionalProperties" : false
    },
    "LoggingFilter" : {
      "description" : "Default handling for logs that don't match any of the specified filtering conditions.",
      "type" : "object",
      "properties" : {
        "Filters" : {
          "$ref" : "#/definitions/Filters"
        },
        "DefaultBehavior" : {
          "$ref" : "#/definitions/FilterBehavior"
        }
      }
    },
    "Filters" : {
      "description" : "A list of filters to be applied.",
      "type" : "array",
      "uniqueItems" : true,
      "insertionOrder" : false,
      "minLength" : 1,
      "items" : {
        "$ref" : "#/definitions/Filter"
      }
    },
    "Filter" : {
      "description" : "A filter to be applied",
      "type" : "object",
      "properties" : {
        "Behavior" : {
          "$ref" : "#/definitions/FilterBehavior"
        },
        "Requirement" : {
          "$ref" : "#/definitions/FilterRequirement"
        },
        "Conditions" : {
          "$ref" : "#/definitions/Conditions"
        }
      }
    },
    "FilterBehavior" : {
      "description" : "The behavior required of the filter.",
      "type" : "string",
      "enum" : [ "KEEP", "DROP" ]
    },
    "FilterRequirement" : {
      "description" : "The requirement portion of the filter.",
      "type" : "string",
      "enum" : [ "MEETS_ALL", "MEETS_ANY" ]
    },
    "Conditions" : {
      "description" : "A list of conditions for a filter.",
      "type" : "array",
      "uniqueItems" : true,
      "insertionOrder" : false,
      "minLength" : 1,
      "items" : {
        "$ref" : "#/definitions/Condition"
      }
    },
    "Condition" : {
      "description" : "A condition for a filter.",
      "type" : "object",
      "properties" : {
        "ActionCondition" : {
          "$ref" : "#/definitions/ActionCondition"
        },
        "LabelNameCondition" : {
          "$ref" : "#/definitions/LabelNameCondition"
        }
      }
    },
    "ActionCondition" : {
      "description" : "The condition of the action desired in the filter.",
      "type" : "object",
      "properties" : {
        "Action" : {
          "$ref" : "#/definitions/Action"
        }
      }
    },
    "Action" : {
      "description" : "The enumerated action to take.",
      "type" : "string",
      "enum" : [ "ALLOW", "BLOCK", "COUNT", "CAPTCHA", "CHALLENGE", "EXCLUDED_AS_COUNT" ]
    },
    "LabelNameCondition" : {
      "description" : "The label name of the condition.",
      "type" : "object",
      "properties" : {
        "LabelName" : {
          "description" : "The label name of the condition.",
          "type" : "string",
          "minLength" : 1,
          "maxLength" : 1024,
          "pattern" : "^[0-9A-Za-z_\\-:]+$"
        }
      }
    },
    "WAFLogType" : {
      "description" : "The type of logs to generate for WAF.",
      "type" : "string",
      "enum" : [ "WAF_LOGS" ]
    },
    "TelemetrySourceTypes" : {
      "description" : "The telemetry source types for a telemetry rule.",
      "type" : "array",
      "uniqueItems" : true,
      "insertionOrder" : false,
      "items" : {
        "$ref" : "#/definitions/TelemetrySourceType"
      }
    },
    "TelemetrySourceType" : {
      "description" : "The telemetry source type that goes into the array.",
      "type" : "string",
      "enum" : [ "VPC_FLOW_LOGS", "ROUTE53_RESOLVER_QUERY_LOGS", "EKS_AUDIT_LOGS", "EKS_AUTHENTICATOR_LOGS", "EKS_CONTROLLER_MANAGER_LOGS", "EKS_SCHEDULER_LOGS", "EKS_API_LOGS" ]
    },
    "RegionStatus" : {
      "description" : "Status of a telemetry rule in a specific region",
      "type" : "object",
      "properties" : {
        "Region" : {
          "description" : "The AWS region code",
          "type" : "string"
        },
        "Status" : {
          "description" : "The replication status of the rule in this region",
          "type" : "string"
        },
        "RuleArn" : {
          "description" : "The ARN of the rule in this region",
          "type" : "string"
        }
      },
      "additionalProperties" : false
    }
  },
  "properties" : {
    "RuleName" : {
      "description" : "The name of the telemetry rule",
      "type" : "string",
      "minLength" : 1,
      "maxLength" : 100,
      "pattern" : "^[0-9A-Za-z-]+$"
    },
    "Rule" : {
      "$ref" : "#/definitions/TelemetryRule"
    },
    "RuleArn" : {
      "description" : "The arn of the telemetry rule",
      "type" : "string",
      "minLength" : 1,
      "maxLength" : 1011,
      "pattern" : "^arn:aws([a-z0-9\\-]+)?:([a-zA-Z0-9\\-]+):([a-z0-9\\-]+)?:([0-9]{12})?:(.+)$"
    },
    "Tags" : {
      "description" : "An array of key-value pairs to apply to this resource",
      "type" : "array",
      "uniqueItems" : true,
      "insertionOrder" : false,
      "items" : {
        "$ref" : "#/definitions/Tag"
      }
    },
    "RegionStatuses" : {
      "description" : "Per-region replication status of the rule",
      "type" : "array",
      "insertionOrder" : false,
      "items" : {
        "$ref" : "#/definitions/RegionStatus"
      }
    }
  },
  "additionalProperties" : false,
  "required" : [ "RuleName", "Rule" ],
  "createOnlyProperties" : [ "/properties/RuleName", "/properties/Rule/AllRegions" ],
  "readOnlyProperties" : [ "/properties/RuleArn", "/properties/RegionStatuses" ],
  "primaryIdentifier" : [ "/properties/RuleArn" ],
  "handlers" : {
    "create" : {
      "permissions" : [ "observabilityadmin:CreateTelemetryRule", "observabilityadmin:GetTelemetryRule", "observabilityadmin:TagResource", "observabilityadmin:ListTagsForResource", "observabilityadmin:GetTelemetryEvaluationStatus", "iam:CreateServiceLinkedRole", "xray:GetTraceSegmentDestination" ]
    },
    "read" : {
      "permissions" : [ "observabilityadmin:GetTelemetryRule", "observabilityadmin:ListTagsForResource", "observabilityadmin:GetTelemetryEvaluationStatus" ]
    },
    "update" : {
      "permissions" : [ "observabilityadmin:UpdateTelemetryRule", "observabilityadmin:GetTelemetryRule", "observabilityadmin:TagResource", "observabilityadmin:UntagResource", "observabilityadmin:ListTagsForResource", "observabilityadmin:GetTelemetryEvaluationStatus", "xray:GetTraceSegmentDestination" ]
    },
    "delete" : {
      "permissions" : [ "observabilityadmin:DeleteTelemetryRule", "observabilityadmin:GetTelemetryEvaluationStatus" ]
    },
    "list" : {
      "permissions" : [ "observabilityadmin:ListTelemetryRules", "observabilityadmin:GetTelemetryEvaluationStatus" ]
    }
  }
}