`boto3_cloudtrail`¶

Manage CloudTrail Objects using boto3.¶

Renamed from boto_cloudtrail to boto3_cloudtrail and updated to call the refactored boto3_cloudtrail execution module.

Create and destroy CloudTrail objects.

depends:

boto3 >= 1.28.0
botocore >= 1.31.0

This module uses boto3, which can be installed via package, or pip.

This module accepts explicit CloudTrail credentials but can also utilize IAM roles assigned to the instance through Instance Profiles. Dynamic credentials are then automatically obtained from AWS API and no further configuration is necessary. More Information available at:

http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html

If IAM roles are not used you need to specify them either in the minion’s config file or as a profile. For example, to specify them in the minion’s config file:

cloudtrail.keyid: GKTADJGHEIQSXMKKRBJ08H
cloudtrail.key: askdjghsdfjkghWupUjasdflkdfklgjsdfjajkghs

It’s also possible to specify key, keyid and region via a profile, either as a passed in dict, or as a string to pull from pillars or minion config:

myprofile:
    keyid: GKTADJGHEIQSXMKKRBJ08H
    key: askdjghsdfjkghWupUjasdflkdfklgjsdfjajkghs
    region: us-east-1

Manage my_trail CloudTrail trail:
    boto3_cloudtrail.present:
      - name: my_trail
      - S3BucketName: my_bucket
      - S3KeyPrefix: my_prefix
      - SnsTopicName: my_sns_topic
      - IncludeGlobalServiceEvents: True
      - IsMultiRegionTrail: False
      - EnableLogFileValidation: False
      - CloudWatchLogsLogGroupArn: my_log_group_arn
      - CloudWatchLogsRoleArn: my_log_role_arn
      - KmsKeyId: my_kms_key_id
      - LoggingEnabled: True
      - tags:
          testing_key: testing_value

Added in version 1.0.0.

saltext.boto3.states.boto3_cloudtrail.__virtual__()[source]¶: Only load if the boto3_cloudtrail execution module is available.

saltext.boto3.states.boto3_cloudtrail.present(name, Name, S3BucketName, S3KeyPrefix=None, SnsTopicName=None, IncludeGlobalServiceEvents=True, IsMultiRegionTrail=None, EnableLogFileValidation=False, CloudWatchLogsLogGroupArn=None, CloudWatchLogsRoleArn=None, KmsKeyId=None, LoggingEnabled=True, Tags=None, region=None, key=None, keyid=None, profile=None)[source]¶

Ensure trail exists.

name: The name of the state definition.
Name: Name of the trail.
S3BucketName: Specifies the name of the Amazon S3 bucket designated for publishing log files.
S3KeyPrefix: Specifies the Amazon S3 key prefix that comes after the name of the bucket.
SnsTopicName: Specifies the name of the Amazon SNS topic defined for notification of log file delivery.
IncludeGlobalServiceEvents: Specifies whether the trail is publishing events from global services.
EnableLogFileValidation: Specifies whether log file integrity validation is enabled.
CloudWatchLogsLogGroupArn: Specifies a log group ARN to which CloudTrail logs will be delivered.
CloudWatchLogsRoleArn: Specifies the role for the CloudWatch Logs endpoint to assume.
KmsKeyId: Specifies the KMS key ID to use to encrypt the logs delivered by CloudTrail.
LoggingEnabled: Whether logging should be enabled for the trail.
Tags: A dictionary of tags that should be set on the trail.
region: Region to connect to.
key: Secret key to be used.
keyid: Access key to be used.
profile: A dict with region, key and keyid, or a pillar key (string) that contains a dict with region, key and keyid.

Example:

ensure-present:
  boto3_cloudtrail.present:
    - name: example

saltext.boto3.states.boto3_cloudtrail.absent(name, Name, region=None, key=None, keyid=None, profile=None)[source]¶

Ensure trail with passed properties is absent.

name: The name of the state definition.
Name: Name of the trail.
region: Region to connect to.
key: Secret key to be used.
keyid: Access key to be used.
profile: A dict with region, key and keyid, or a pillar key (string) that contains a dict with region, key and keyid.

Example:

ensure-absent:
  boto3_cloudtrail.absent:
    - name: example

boto3_cloudtrail¶

Manage CloudTrail Objects using boto3.¶

`boto3_cloudtrail`¶