ReadonlycloudS3 bucket name where CloudTrail audit logs are stored. Accepts bucket names or SSM parameter references.
Use cases: Centralized audit log collection; Compliance log storage
AWS: CloudTrail S3 destination bucket
Validation: Required; must be existing S3 bucket name or SSM parameter path
ReadonlycloudKMS key ARN for encrypting CloudTrail logs written to S3. Accepts key ARNs or SSM parameter references.
Use cases: Audit log encryption; Data protection compliance
AWS: KMS key for CloudTrail log encryption
Validation: Required; must be valid KMS key ARN or SSM parameter path
Optional ReadonlydataOptional list of data event selectors for any CloudTrail-supported resource type,
rendered as advanced event selectors. Use this for non-S3 data events, such as
AWS::BedrockAgentCore::Runtime invocations.
Mutually exclusive with eventSelectors: CloudTrail accepts either basic or advanced
event selectors on a trail, never both. Setting both fails at synth.
Data events are billed per event and can be high volume, so scope with resourceArns
where practical.
Use cases: AgentCore invocation auditing; EventBridge alerting on invocation auth failures; Lambda or DynamoDB data events
AWS: CloudTrail advanced event selectors (AdvancedEventSelectors on the trail)
Validation: Optional; keys become the CloudTrail selector names; values must be valid DataEventSelectorConfig
Optional ReadonlyeventOptional list of S3 event selectors to scope CloudTrail data event capture to specific buckets and prefixes. If omitted, the trail captures all S3 data events in the account.
Mutually exclusive with dataEventSelectors.
Use cases: Audit specific data lake buckets; Reduce CloudTrail costs; Targeted compliance logging
AWS: CloudTrail S3 data event selectors (DataResources on the trail)
Validation: Optional; array of EventSelectorConfig objects with required bucketName
Optional ReadonlyincludeIf true, management/control plane events will be included in trail. Otherwise, only Data Events will be included.
This matters most alongside dataEventSelectors: advanced event selectors replace a
trail's default selectors outright, so without this flag such a trail captures no
control plane events at all.
CloudTrail audit trail configuration for data event logging with KMS encryption. Logs are written to the specified S3 bucket encrypted with the specified KMS key. Optionally includes management/control plane events.
Use cases: Compliance auditing; S3 data access logging; Security monitoring; Regulatory compliance
AWS: CloudTrail trail with data events, KMS encryption, and optional management events
Validation: cloudTrailAuditBucketName and cloudTrailAuditKmsKeyArn required