Optional ReadonlyreadWhether to capture read events, write events, or both. Omit for both.
Use cases: Capturing only mutating calls; Reducing data event volume
AWS: CloudTrail advanced event selector readOnly field
Validation: Optional; one of 'All', 'ReadOnly', 'WriteOnly'
Optional ReadonlyresourceResource ARNs to scope the selector to, matched as prefixes. If omitted, data events for every resource of the type are captured, which can be costly on busy resources.
Use cases: Scoping capture to one runtime; Controlling data event costs
AWS: CloudTrail advanced event selector resources.ARN field (StartsWith)
Validation: Optional; ARNs or SSM parameter references
ReadonlyresourceThe CloudTrail resources.type whose data events will be captured, such as
AWS::BedrockAgentCore::Runtime or AWS::Lambda::Function. See the CloudTrail
"Data events" documentation for the supported values.
CloudTrail accepts exactly one resource type per selector, so capturing several
types means several entries in dataEventSelectors.
Use cases: Capturing AgentCore runtime invocations; Auditing Lambda invocations
AWS: CloudTrail advanced event selector resources.type field
Validation: Required; must be a resource type CloudTrail supports for data events, otherwise the deploy is rejected
Data event selector for any CloudTrail-supported resource type, rendered as an advanced event selector. Where
eventSelectorscovers S3 only, this covers anyresources.typeCloudTrail supports -- Lambda, DynamoDB, Bedrock AgentCore, and so on.Mutually exclusive with
eventSelectorson the same trail: CloudTrail accepts either basic or advanced event selectors, never both.Use cases: AgentCore runtime invocation auditing; Lambda or DynamoDB data events; EventBridge detection of invocation-level auth failures
AWS: CloudTrail advanced event selector (eventCategory Data with resources.type)
Validation: resourceType required; resourceArns and readWriteType optional