Skip to content

Commit 2d2dab3

Browse files
Add CMK encryption support for CloudWatch Logs Insights query result data
1 parent 1196707 commit 2d2dab3

20 files changed

+1052
-165
lines changed

generator/ServiceModels/logs/logs-2014-03-28.api.json

Lines changed: 17 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -779,13 +779,11 @@
779779
"Arn":{"type":"string"},
780780
"AssociateKmsKeyRequest":{
781781
"type":"structure",
782-
"required":[
783-
"logGroupName",
784-
"kmsKeyId"
785-
],
782+
"required":["kmsKeyId"],
786783
"members":{
787784
"logGroupName":{"shape":"LogGroupName"},
788-
"kmsKeyId":{"shape":"KmsKeyId"}
785+
"kmsKeyId":{"shape":"KmsKeyId"},
786+
"resourceIdentifier":{"shape":"ResourceIdentifier"}
789787
}
790788
},
791789
"CancelExportTaskRequest":{
@@ -1163,9 +1161,9 @@
11631161
},
11641162
"DisassociateKmsKeyRequest":{
11651163
"type":"structure",
1166-
"required":["logGroupName"],
11671164
"members":{
1168-
"logGroupName":{"shape":"LogGroupName"}
1165+
"logGroupName":{"shape":"LogGroupName"},
1166+
"resourceIdentifier":{"shape":"ResourceIdentifier"}
11691167
}
11701168
},
11711169
"Distribution":{
@@ -1175,6 +1173,10 @@
11751173
"ByLogStream"
11761174
]
11771175
},
1176+
"EncryptionKey":{
1177+
"type":"string",
1178+
"max":256
1179+
},
11781180
"EventId":{"type":"string"},
11791181
"EventMessage":{
11801182
"type":"string",
@@ -1385,7 +1387,8 @@
13851387
"members":{
13861388
"results":{"shape":"QueryResults"},
13871389
"statistics":{"shape":"QueryStatistics"},
1388-
"status":{"shape":"QueryStatus"}
1390+
"status":{"shape":"QueryStatus"},
1391+
"encryptionKey":{"shape":"EncryptionKey"}
13891392
}
13901393
},
13911394
"IncludeLinkedAccounts":{"type":"boolean"},
@@ -1957,6 +1960,12 @@
19571960
},
19581961
"exception":true
19591962
},
1963+
"ResourceIdentifier":{
1964+
"type":"string",
1965+
"max":2048,
1966+
"min":1,
1967+
"pattern":"[\\w+=/:,.@\\-\\*]*"
1968+
},
19601969
"ResourceNotFoundException":{
19611970
"type":"structure",
19621971
"members":{

generator/ServiceModels/logs/logs-2014-03-28.docs.json

Lines changed: 25 additions & 12 deletions
Large diffs are not rendered by default.

generator/ServiceModels/logs/logs-2014-03-28.normal.json

Lines changed: 35 additions & 17 deletions
Large diffs are not rendered by default.

sdk/code-analysis/ServiceAnalysis/CloudWatchLogs/Generated/PropertyValueRules.xml

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,12 @@
1010
<max>512</max>
1111
<pattern>[\.\-_/#A-Za-z0-9]+</pattern>
1212
</property-value-rule>
13+
<property-value-rule>
14+
<property>Amazon.CloudWatchLogs.Model.AssociateKmsKeyRequest.ResourceIdentifier</property>
15+
<min>1</min>
16+
<max>2048</max>
17+
<pattern>[\w+=/:,.@\-\*]*</pattern>
18+
</property-value-rule>
1319
<property-value-rule>
1420
<property>Amazon.CloudWatchLogs.Model.CancelExportTaskRequest.TaskId</property>
1521
<min>1</min>
@@ -346,6 +352,12 @@
346352
<max>512</max>
347353
<pattern>[\.\-_/#A-Za-z0-9]+</pattern>
348354
</property-value-rule>
355+
<property-value-rule>
356+
<property>Amazon.CloudWatchLogs.Model.DisassociateKmsKeyRequest.ResourceIdentifier</property>
357+
<min>1</min>
358+
<max>2048</max>
359+
<pattern>[\w+=/:,.@\-\*]*</pattern>
360+
</property-value-rule>
349361
<property-value-rule>
350362
<property>Amazon.CloudWatchLogs.Model.FilterLogEventsRequest.EndTime</property>
351363
<min>0</min>
@@ -470,6 +482,10 @@
470482
<min>0</min>
471483
<max>256</max>
472484
</property-value-rule>
485+
<property-value-rule>
486+
<property>Amazon.CloudWatchLogs.Model.GetQueryResultsResponse.EncryptionKey</property>
487+
<max>256</max>
488+
</property-value-rule>
473489
<property-value-rule>
474490
<property>Amazon.CloudWatchLogs.Model.ListTagsForResourceRequest.ResourceArn</property>
475491
<min>1</min>

sdk/src/Services/CloudWatchLogs/Generated/Model/AssociateKmsKeyRequest.cs

Lines changed: 101 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -30,23 +30,66 @@ namespace Amazon.CloudWatchLogs.Model
3030
{
3131
/// <summary>
3232
/// Container for the parameters to the AssociateKmsKey operation.
33-
/// Associates the specified KMS key with the specified log group.
33+
/// Associates the specified KMS key with either one log group in the account, or with
34+
/// all stored CloudWatch Logs query insights results in the account.
3435
///
3536
///
3637
/// <para>
38+
/// When you use <code>AssociateKmsKey</code>, you specify either the <code>logGroupName</code>
39+
/// parameter or the <code>resourceIdentifier</code> parameter. You can't specify both
40+
/// of those parameters in the same operation.
41+
/// </para>
42+
/// <ul> <li>
43+
/// <para>
44+
/// Specify the <code>logGroupName</code> parameter to cause all log events stored in
45+
/// the log group to be encrypted with that key. Only the log events ingested after the
46+
/// key is associated are encrypted with that key.
47+
/// </para>
48+
///
49+
/// <para>
3750
/// Associating a KMS key with a log group overrides any existing associations between
3851
/// the log group and a KMS key. After a KMS key is associated with a log group, all newly
3952
/// ingested data for the log group is encrypted using the KMS key. This association is
40-
/// stored as long as the data encrypted with the KMS keyis still within CloudWatch Logs.
53+
/// stored as long as the data encrypted with the KMS key is still within CloudWatch Logs.
4154
/// This enables CloudWatch Logs to decrypt this data whenever it is requested.
4255
/// </para>
43-
/// <important>
56+
///
57+
/// <para>
58+
/// Associating a key with a log group does not cause the results of queries of that log
59+
/// group to be encrypted with that key. To have query results encrypted with a KMS key,
60+
/// you must use an <code>AssociateKmsKey</code> operation with the <code>resourceIdentifier</code>
61+
/// parameter that specifies a <code>query-result</code> resource.
62+
/// </para>
63+
/// </li> <li>
64+
/// <para>
65+
/// Specify the <code>resourceIdentifier</code> parameter with a <code>query-result</code>
66+
/// resource, to use that key to encrypt the stored results of all future <a href="https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_StartQuery.html">StartQuery</a>
67+
/// operations in the account. The response from a <a href="https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_GetQueryResults.html">GetQueryResults</a>
68+
/// operation will still return the query results in plain text.
69+
/// </para>
70+
///
71+
/// <para>
72+
/// Even if you have not associated a key with your query results, the query results are
73+
/// encrypted when stored, using the default CloudWatch Logs method.
74+
/// </para>
75+
///
76+
/// <para>
77+
/// If you run a query from a monitoring account that queries logs in a source account,
78+
/// the query results key from the monitoring account, if any, is used.
79+
/// </para>
80+
/// </li> </ul> <important>
81+
/// <para>
82+
/// If you delete the key that is used to encrypt log events or log group query results,
83+
/// then all the associated stored log events or query results that were encrypted with
84+
/// that key will be unencryptable and unusable.
85+
/// </para>
86+
/// </important> <note>
4487
/// <para>
4588
/// CloudWatch Logs supports only symmetric KMS keys. Do not use an associate an asymmetric
46-
/// KMS key with your log group. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">Using
89+
/// KMS key with your log group or query results. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">Using
4790
/// Symmetric and Asymmetric Keys</a>.
4891
/// </para>
49-
/// </important>
92+
/// </note>
5093
/// <para>
5194
/// It can take up to 5 minutes for this operation to take effect.
5295
/// </para>
@@ -61,6 +104,7 @@ public partial class AssociateKmsKeyRequest : AmazonCloudWatchLogsRequest
61104
{
62105
private string _kmsKeyId;
63106
private string _logGroupName;
107+
private string _resourceIdentifier;
64108

65109
/// <summary>
66110
/// Gets and sets the property KmsKeyId.
@@ -89,8 +133,13 @@ internal bool IsSetKmsKeyId()
89133
/// <para>
90134
/// The name of the log group.
91135
/// </para>
136+
///
137+
/// <para>
138+
/// In your <code>AssociateKmsKey</code> operation, you must specify either the <code>resourceIdentifier</code>
139+
/// parameter or the <code>logGroup</code> parameter, but you can't specify both.
140+
/// </para>
92141
/// </summary>
93-
[AWSProperty(Required=true, Min=1, Max=512)]
142+
[AWSProperty(Min=1, Max=512)]
94143
public string LogGroupName
95144
{
96145
get { return this._logGroupName; }
@@ -103,5 +152,51 @@ internal bool IsSetLogGroupName()
103152
return this._logGroupName != null;
104153
}
105154

155+
/// <summary>
156+
/// Gets and sets the property ResourceIdentifier.
157+
/// <para>
158+
/// Specifies the target for this operation. You must specify one of the following:
159+
/// </para>
160+
/// <ul> <li>
161+
/// <para>
162+
/// Specify the following ARN to have future <a href="https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_GetQueryResults.html">GetQueryResults</a>
163+
/// operations in this account encrypt the results with the specified KMS key. Replace
164+
/// <i>REGION</i> and <i>ACCOUNT_ID</i> with your Region and account ID.
165+
/// </para>
166+
///
167+
/// <para>
168+
/// <code>arn:aws:logs:<i>REGION</i>:<i>ACCOUNT_ID</i>:query-result:*</code>
169+
/// </para>
170+
/// </li> <li>
171+
/// <para>
172+
/// Specify the ARN of a log group to have CloudWatch Logs use the KMS key to encrypt
173+
/// log events that are ingested and stored by that log group. The log group ARN must
174+
/// be in the following format. Replace <i>REGION</i> and <i>ACCOUNT_ID</i> with your
175+
/// Region and account ID.
176+
/// </para>
177+
///
178+
/// <para>
179+
/// <code>arn:aws:logs:<i>REGION</i>:<i>ACCOUNT_ID</i>:log-group:<i>LOG_GROUP_NAME</i>
180+
/// </code>
181+
/// </para>
182+
/// </li> </ul>
183+
/// <para>
184+
/// In your <code>AssociateKmsKey</code> operation, you must specify either the <code>resourceIdentifier</code>
185+
/// parameter or the <code>logGroup</code> parameter, but you can't specify both.
186+
/// </para>
187+
/// </summary>
188+
[AWSProperty(Min=1, Max=2048)]
189+
public string ResourceIdentifier
190+
{
191+
get { return this._resourceIdentifier; }
192+
set { this._resourceIdentifier = value; }
193+
}
194+
195+
// Check to see if ResourceIdentifier property is set
196+
internal bool IsSetResourceIdentifier()
197+
{
198+
return this._resourceIdentifier != null;
199+
}
200+
106201
}
107202
}

sdk/src/Services/CloudWatchLogs/Generated/Model/DisassociateKmsKeyRequest.cs

Lines changed: 79 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -30,31 +30,54 @@ namespace Amazon.CloudWatchLogs.Model
3030
{
3131
/// <summary>
3232
/// Container for the parameters to the DisassociateKmsKey operation.
33-
/// Disassociates the associated KMS key from the specified log group.
33+
/// Disassociates the specified KMS key from the specified log group or from all CloudWatch
34+
/// Logs Insights query results in the account.
3435
///
3536
///
3637
/// <para>
37-
/// After the KMS key is disassociated from the log group, CloudWatch Logs stops encrypting
38-
/// newly ingested data for the log group. All previously ingested data remains encrypted,
39-
/// and CloudWatch Logs requires permissions for the KMS key whenever the encrypted data
40-
/// is requested.
38+
/// When you use <code>DisassociateKmsKey</code>, you specify either the <code>logGroupName</code>
39+
/// parameter or the <code>resourceIdentifier</code> parameter. You can't specify both
40+
/// of those parameters in the same operation.
4141
/// </para>
42-
///
42+
/// <ul> <li>
43+
/// <para>
44+
/// Specify the <code>logGroupName</code> parameter to stop using the KMS key to encrypt
45+
/// future log events ingested and stored in the log group. Instead, they will be encrypted
46+
/// with the default CloudWatch Logs method. The log events that were ingested while the
47+
/// key was associated with the log group are still encrypted with that key. Therefore,
48+
/// CloudWatch Logs will need permissions for the key whenever that data is accessed.
49+
/// </para>
50+
/// </li> <li>
4351
/// <para>
44-
/// Note that it can take up to 5 minutes for this operation to take effect.
52+
/// Specify the <code>resourceIdentifier</code> parameter with the <code>query-result</code>
53+
/// resource to stop using the KMS key to encrypt the results of all future <a href="https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_StartQuery.html">StartQuery</a>
54+
/// operations in the account. They will instead be encrypted with the default CloudWatch
55+
/// Logs method. The results from queries that ran while the key was associated with the
56+
/// account are still encrypted with that key. Therefore, CloudWatch Logs will need permissions
57+
/// for the key whenever that data is accessed.
58+
/// </para>
59+
/// </li> </ul>
60+
/// <para>
61+
/// It can take up to 5 minutes for this operation to take effect.
4562
/// </para>
4663
/// </summary>
4764
public partial class DisassociateKmsKeyRequest : AmazonCloudWatchLogsRequest
4865
{
4966
private string _logGroupName;
67+
private string _resourceIdentifier;
5068

5169
/// <summary>
5270
/// Gets and sets the property LogGroupName.
5371
/// <para>
5472
/// The name of the log group.
5573
/// </para>
74+
///
75+
/// <para>
76+
/// In your <code>DisassociateKmsKey</code> operation, you must specify either the <code>resourceIdentifier</code>
77+
/// parameter or the <code>logGroup</code> parameter, but you can't specify both.
78+
/// </para>
5679
/// </summary>
57-
[AWSProperty(Required=true, Min=1, Max=512)]
80+
[AWSProperty(Min=1, Max=512)]
5881
public string LogGroupName
5982
{
6083
get { return this._logGroupName; }
@@ -67,5 +90,53 @@ internal bool IsSetLogGroupName()
6790
return this._logGroupName != null;
6891
}
6992

93+
/// <summary>
94+
/// Gets and sets the property ResourceIdentifier.
95+
/// <para>
96+
/// Specifies the target for this operation. You must specify one of the following:
97+
/// </para>
98+
/// <ul> <li>
99+
/// <para>
100+
/// Specify the ARN of a log group to stop having CloudWatch Logs use the KMS key to encrypt
101+
/// log events that are ingested and stored by that log group. After you run this operation,
102+
/// CloudWatch Logs encrypts ingested log events with the default CloudWatch Logs method.
103+
/// The log group ARN must be in the following format. Replace <i>REGION</i> and <i>ACCOUNT_ID</i>
104+
/// with your Region and account ID.
105+
/// </para>
106+
///
107+
/// <para>
108+
/// <code>arn:aws:logs:<i>REGION</i>:<i>ACCOUNT_ID</i>:log-group:<i>LOG_GROUP_NAME</i>
109+
/// </code>
110+
/// </para>
111+
/// </li> <li>
112+
/// <para>
113+
/// Specify the following ARN to stop using this key to encrypt the results of future
114+
/// <a href="https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_StartQuery.html">StartQuery</a>
115+
/// operations in this account. Replace <i>REGION</i> and <i>ACCOUNT_ID</i> with your
116+
/// Region and account ID.
117+
/// </para>
118+
///
119+
/// <para>
120+
/// <code>arn:aws:logs:<i>REGION</i>:<i>ACCOUNT_ID</i>:query-result:*</code>
121+
/// </para>
122+
/// </li> </ul>
123+
/// <para>
124+
/// In your <code>DisssociateKmsKey</code> operation, you must specify either the <code>resourceIdentifier</code>
125+
/// parameter or the <code>logGroup</code> parameter, but you can't specify both.
126+
/// </para>
127+
/// </summary>
128+
[AWSProperty(Min=1, Max=2048)]
129+
public string ResourceIdentifier
130+
{
131+
get { return this._resourceIdentifier; }
132+
set { this._resourceIdentifier = value; }
133+
}
134+
135+
// Check to see if ResourceIdentifier property is set
136+
internal bool IsSetResourceIdentifier()
137+
{
138+
return this._resourceIdentifier != null;
139+
}
140+
70141
}
71142
}

sdk/src/Services/CloudWatchLogs/Generated/Model/GetLogGroupFieldsRequest.cs

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -121,8 +121,8 @@ internal bool IsSetLogGroupName()
121121
/// Gets and sets the property Time.
122122
/// <para>
123123
/// The time to set as the center of the query. If you specify <code>time</code>, the
124-
/// 15 minutes before this time are queries. If you omit <code>time</code>, the 8 minutes
125-
/// before and 8 minutes after this time are searched.
124+
/// 8 minutes before and 8 minutes after this time are searched. If you omit <code>time</code>,
125+
/// the most recent 15 minutes up to the current time are searched.
126126
/// </para>
127127
///
128128
/// <para>

0 commit comments

Comments
 (0)