{
  "typeName" : "AWS::CloudTrail::EventDataStore",
  "description" : "A storage lake of event data against which you can run complex SQL-based queries. An event data store can include events that you have logged on your account from the last 7 to 2557 or 3653 days (about seven or ten years) depending on the selected BillingMode.",
  "sourceUrl" : "https://github.com/aws-cloudformation/aws-cloudformation-resource-providers-cloudtrail.git",
  "definitions" : {
    "AdvancedFieldSelector" : {
      "description" : "A single selector statement in an advanced event selector.",
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "Field" : {
          "description" : "A field in an event record on which to filter events to be logged. Supported fields include readOnly, eventCategory, eventSource (for management events), eventName, resources.type, and resources.ARN.",
          "type" : "string",
          "pattern" : "([\\w|\\d|\\.|_]+)",
          "minLength" : 1,
          "maxLength" : 1000
        },
        "Equals" : {
          "description" : "An operator that includes events that match the exact value of the event record field specified as the value of Field. This is the only valid operator that you can use with the readOnly, eventCategory, and resources.type fields.",
          "type" : "array",
          "uniqueItems" : true,
          "insertionOrder" : false,
          "minItems" : 1,
          "items" : {
            "type" : "string",
            "pattern" : "(.+)",
            "minLength" : 1,
            "maxLength" : 2048
          }
        },
        "StartsWith" : {
          "description" : "An operator that includes events that match the first few characters of the event record field specified as the value of Field.",
          "type" : "array",
          "uniqueItems" : true,
          "insertionOrder" : false,
          "minItems" : 1,
          "items" : {
            "type" : "string",
            "pattern" : "(.+)",
            "minLength" : 1,
            "maxLength" : 2048
          }
        },
        "EndsWith" : {
          "description" : "An operator that includes events that match the last few characters of the event record field specified as the value of Field.",
          "type" : "array",
          "uniqueItems" : true,
          "insertionOrder" : false,
          "minItems" : 1,
          "items" : {
            "type" : "string",
            "pattern" : "(.+)",
            "minLength" : 1,
            "maxLength" : 2048
          }
        },
        "NotEquals" : {
          "description" : "An operator that excludes events that match the exact value of the event record field specified as the value of Field.",
          "type" : "array",
          "uniqueItems" : true,
          "insertionOrder" : false,
          "minItems" : 1,
          "items" : {
            "type" : "string",
            "pattern" : "(.+)",
            "minLength" : 1,
            "maxLength" : 2048
          }
        },
        "NotStartsWith" : {
          "description" : "An operator that excludes events that match the first few characters of the event record field specified as the value of Field.",
          "type" : "array",
          "uniqueItems" : true,
          "insertionOrder" : false,
          "minItems" : 1,
          "items" : {
            "type" : "string",
            "pattern" : "(.+)",
            "minLength" : 1,
            "maxLength" : 2048
          }
        },
        "NotEndsWith" : {
          "description" : "An operator that excludes events that match the last few characters of the event record field specified as the value of Field.",
          "type" : "array",
          "uniqueItems" : true,
          "insertionOrder" : false,
          "minItems" : 1,
          "items" : {
            "type" : "string",
            "pattern" : "(.+)",
            "minLength" : 1,
            "maxLength" : 2048
          }
        }
      },
      "required" : [ "Field" ]
    },
    "AdvancedEventSelector" : {
      "description" : "Advanced event selectors let you create fine-grained selectors for the following AWS CloudTrail event record ﬁelds. They help you control costs by logging only those events that are important to you.",
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "Name" : {
          "description" : "An optional, descriptive name for an advanced event selector, such as \"Log data events for only two S3 buckets\".",
          "type" : "string",
          "minLength" : 1,
          "maxLength" : 1000
        },
        "FieldSelectors" : {
          "description" : "Contains all selector statements in an advanced event selector.",
          "type" : "array",
          "uniqueItems" : true,
          "insertionOrder" : false,
          "minItems" : 1,
          "items" : {
            "$ref" : "#/definitions/AdvancedFieldSelector"
          }
        }
      },
      "required" : [ "FieldSelectors" ]
    },
    "Tag" : {
      "description" : "An arbitrary set of tags (key-value pairs) for this event data store.",
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "Key" : {
          "description" : "The key name of the tag. You can specify a value that is 1 to 127 Unicode characters in length and cannot be prefixed with aws:. You can use any of the following characters: the set of Unicode letters, digits, whitespace, _, ., /, =, +, and -.",
          "type" : "string"
        },
        "Value" : {
          "description" : "The value for the tag. You can specify a value that is 1 to 255 Unicode characters in length and cannot be prefixed with aws:. You can use any of the following characters: the set of Unicode letters, digits, whitespace, _, ., /, =, +, and -.",
          "type" : "string"
        }
      },
      "required" : [ "Value", "Key" ]
    },
    "InsightSelector" : {
      "description" : "A string that contains Insights types that are logged on an event data store.",
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "InsightType" : {
          "description" : "The type of Insights to log on an event data store.",
          "type" : "string"
        }
      }
    },
    "ContextKeySelector" : {
      "description" : "An object that contains information types to be included in CloudTrail enriched events.",
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "Type" : {
          "description" : "Specifies the type of the event record field in ContextKeySelector. Valid values include RequestContext, TagContext.",
          "type" : "string",
          "enum" : [ "RequestContext", "TagContext" ]
        },
        "Equals" : {
          "description" : "An operator that includes events that match the exact value of the event record field specified in Type.",
          "type" : "array",
          "uniqueItems" : true,
          "insertionOrder" : false,
          "minItems" : 1,
          "maxItems" : 50,
          "items" : {
            "type" : "string",
            "pattern" : "(.+)",
            "minLength" : 1,
            "maxLength" : 128
          }
        }
      },
      "required" : [ "Type", "Equals" ]
    },
    "Timestamp" : {
      "type" : "string"
    }
  },
  "properties" : {
    "AdvancedEventSelectors" : {
      "description" : "The advanced event selectors that were used to select events for the data store.",
      "type" : "array",
      "items" : {
        "$ref" : "#/definitions/AdvancedEventSelector"
      },
      "uniqueItems" : true,
      "insertionOrder" : false
    },
    "CreatedTimestamp" : {
      "description" : "The timestamp of the event data store's creation.",
      "$ref" : "#/definitions/Timestamp"
    },
    "EventDataStoreArn" : {
      "description" : "The ARN of the event data store.",
      "type" : "string"
    },
    "FederationEnabled" : {
      "description" : "Indicates whether federation is enabled on an event data store.",
      "type" : "boolean"
    },
    "FederationRoleArn" : {
      "description" : "The ARN of the role used for event data store federation.",
      "type" : "string"
    },
    "MultiRegionEnabled" : {
      "description" : "Indicates whether the event data store includes events from all regions, or only from the region in which it was created.",
      "type" : "boolean"
    },
    "Name" : {
      "description" : "The name of the event data store.",
      "type" : "string"
    },
    "OrganizationEnabled" : {
      "description" : "Indicates that an event data store is collecting logged events for an organization.",
      "type" : "boolean"
    },
    "BillingMode" : {
      "description" : "The mode that the event data store will use to charge for event storage.",
      "type" : "string"
    },
    "RetentionPeriod" : {
      "description" : "The retention period, in days.",
      "type" : "integer"
    },
    "Status" : {
      "description" : "The status of an event data store. Values are STARTING_INGESTION, ENABLED, STOPPING_INGESTION, STOPPED_INGESTION and PENDING_DELETION.",
      "type" : "string"
    },
    "TerminationProtectionEnabled" : {
      "description" : "Indicates whether the event data store is protected from termination.",
      "type" : "boolean"
    },
    "UpdatedTimestamp" : {
      "description" : "The timestamp showing when an event data store was updated, if applicable. UpdatedTimestamp is always either the same or newer than the time shown in CreatedTimestamp.",
      "$ref" : "#/definitions/Timestamp"
    },
    "KmsKeyId" : {
      "description" : "Specifies the KMS key ID to use to encrypt the events delivered by CloudTrail. The value can be an alias name prefixed by 'alias/', a fully specified ARN to an alias, a fully specified ARN to a key, or a globally unique identifier.",
      "type" : "string"
    },
    "Tags" : {
      "type" : "array",
      "uniqueItems" : false,
      "insertionOrder" : false,
      "items" : {
        "$ref" : "#/definitions/Tag"
      }
    },
    "InsightSelectors" : {
      "description" : "Lets you enable Insights event logging by specifying the Insights selectors that you want to enable on an existing event data store. Both InsightSelectors and InsightsDestination need to have a value in order to enable Insights events on an event data store.",
      "type" : "array",
      "items" : {
        "$ref" : "#/definitions/InsightSelector"
      },
      "uniqueItems" : true,
      "insertionOrder" : false
    },
    "InsightsDestination" : {
      "description" : "Specifies the ARN of the event data store that will collect Insights events. Both InsightSelectors and InsightsDestination need to have a value in order to enable Insights events on an event data store",
      "type" : "string"
    },
    "MaxEventSize" : {
      "description" : "Specifies the maximum size allowed for the event. Valid values are Standard and Large. If you add ContextKeySelectors, this value must be set to Large.",
      "type" : "string",
      "enum" : [ "Standard", "Large" ]
    },
    "ContextKeySelectors" : {
      "description" : "An array that enriches event records in an existing event data store by including additional information specified in individual ContexKeySelector entries. If you add ContextKeySelectors, you must set MaxEventSize to Large.",
      "type" : "array",
      "items" : {
        "$ref" : "#/definitions/ContextKeySelector"
      },
      "maxItems" : 2,
      "uniqueItems" : true,
      "insertionOrder" : false
    },
    "IngestionEnabled" : {
      "description" : "Indicates whether the event data store is ingesting events.",
      "type" : "boolean"
    }
  },
  "required" : [ ],
  "readOnlyProperties" : [ "/properties/EventDataStoreArn", "/properties/CreatedTimestamp", "/properties/UpdatedTimestamp", "/properties/Status" ],
  "primaryIdentifier" : [ "/properties/EventDataStoreArn" ],
  "propertyTransform" : {
    "/properties/KmsKeyId" : "$join([\"arn:(aws)[-]{0,1}[a-z]{0,2}[-]{0,1}[a-z]{0,3}:kms:[a-z]{2}[-]{1}[a-z]{3,10}[-]{0,1}[a-z]{0,10}[-]{1}[1-3]{1}:[0-9]{12}[:]{1}key\\/\", KmsKeyId])"
  },
  "handlers" : {
    "create" : {
      "permissions" : [ "CloudTrail:CreateEventDataStore", "CloudTrail:AddTags", "CloudTrail:PutInsightSelectors", "CloudTrail:EnableFederation", "CloudTrail:GetEventDataStore", "CloudTrail:PutEventConfiguration", "iam:PassRole", "iam:GetRole", "iam:CreateServiceLinkedRole", "organizations:DescribeOrganization", "organizations:ListAWSServiceAccessForOrganization", "kms:GenerateDataKey", "kms:Decrypt", "glue:CreateDatabase", "glue:CreateTable", "glue:PassConnection", "lakeformation:RegisterResource" ]
    },
    "read" : {
      "permissions" : [ "CloudTrail:GetEventDataStore", "CloudTrail:ListEventDataStores", "CloudTrail:GetInsightSelectors", "CloudTrail:GetEventConfiguration", "CloudTrail:ListTags" ]
    },
    "update" : {
      "permissions" : [ "CloudTrail:UpdateEventDataStore", "CloudTrail:RestoreEventDataStore", "CloudTrail:AddTags", "CloudTrail:RemoveTags", "CloudTrail:StartEventDataStoreIngestion", "CloudTrail:StopEventDataStoreIngestion", "CloudTrail:GetEventDataStore", "CloudTrail:PutInsightSelectors", "CloudTrail:GetInsightSelectors", "CloudTrail:EnableFederation", "CloudTrail:DisableFederation", "CloudTrail:PutEventConfiguration", "iam:PassRole", "iam:GetRole", "iam:CreateServiceLinkedRole", "organizations:DescribeOrganization", "organizations:ListAWSServiceAccessForOrganization", "glue:CreateDatabase", "glue:CreateTable", "glue:PassConnection", "lakeformation:RegisterResource", "glue:DeleteTable", "lakeformation:DeregisterResource", "kms:DescribeKey" ]
    },
    "delete" : {
      "permissions" : [ "CloudTrail:DeleteEventDataStore", "CloudTrail:GetEventDataStore", "CloudTrail:DisableFederation", "glue:DeleteTable", "lakeformation:DeregisterResource" ]
    },
    "list" : {
      "permissions" : [ "CloudTrail:ListEventDataStores", "CloudTrail:GetEventDataStore", "CloudTrail:GetInsightSelectors", "CloudTrail:ListTags" ]
    }
  },
  "additionalProperties" : false,
  "tagging" : {
    "taggable" : true,
    "tagOnCreate" : true,
    "tagUpdatable" : true,
    "cloudFormationSystemTags" : false,
    "tagProperty" : "/properties/Tags",
    "permissions" : [ "CloudTrail:AddTags", "CloudTrail:RemoveTags", "CloudTrail:ListTags" ]
  }
}