ansible / ansible.builtin / v2.9.0 / module / cloudtrail manage CloudTrail create, delete, update | "added in version" 2.0 of ansible.builtin" Authors: Ansible Core Team, Ted Timmons (@tedder), Daniel Shepherd (@shepdelacreme) preview | supported by communityansible.builtin.cloudtrail (v2.9.0) — module
pip
Install with pip install ansible==2.9.0
Creates, deletes, or updates CloudTrail configuration. Ensures logging is also enabled.
- name: create single region cloudtrail cloudtrail: state: present name: default s3_bucket_name: mylogbucket s3_key_prefix: cloudtrail region: us-east-1
- name: create multi-region trail with validation and tags cloudtrail: state: present name: default s3_bucket_name: mylogbucket region: us-east-1 is_multi_region_trail: true enable_log_file_validation: true cloudwatch_logs_role_arn: "arn:aws:iam::123456789012:role/CloudTrail_CloudWatchLogs_Role" cloudwatch_logs_log_group_arn: "arn:aws:logs:us-east-1:123456789012:log-group:CloudTrail/DefaultLogGroup:*" kms_key_id: "alias/MyAliasName" tags: environment: dev Name: default
- name: show another valid kms_key_id cloudtrail: state: present name: default s3_bucket_name: mylogbucket kms_key_id: "arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012"
# simply "12345678-1234-1234-1234-123456789012" would be valid too. - name: pause logging the trail we just created cloudtrail: state: present name: default enable_logging: false s3_bucket_name: mylogbucket region: us-east-1 is_multi_region_trail: true enable_log_file_validation: true tags: environment: dev Name: default
- name: delete a trail cloudtrail: state: absent name: default
name: description: - Name for the CloudTrail. - Names are unique per-region unless the CloudTrail is a multi-region trail, in which case it is unique per-account. required: true tags: default: {} description: - A hash/dictionary of tags to be applied to the CloudTrail resource. - Remove completely or specify an empty dictionary to remove all tags. version_added: '2.4' version_added_collection: ansible.builtin state: choices: - present - absent - enabled - disabled description: - Add or remove CloudTrail configuration. - The following states have been preserved for backwards compatibility. C(state=enabled) and C(state=disabled). - enabled=present and disabled=absent. required: true region: aliases: - aws_region - ec2_region description: - The AWS region to use. If not specified then the value of the AWS_REGION or EC2_REGION environment variable, if any, is used. See U(http://docs.aws.amazon.com/general/latest/gr/rande.html#ec2_region) type: str ec2_url: aliases: - aws_endpoint_url - endpoint_url description: - URL to use to connect to EC2 or your Eucalyptus cloud (by default the module will use EC2 endpoints). Ignored for modules where region is required. Must be specified for all other modules if region is not used. If not set then the value of the EC2_URL environment variable, if any, is used. type: str profile: aliases: - aws_profile description: - Using I(profile) will override I(aws_access_key), I(aws_secret_key) and I(security_token) and support for passing them at the same time as I(profile) has been deprecated. - I(aws_access_key), I(aws_secret_key) and I(security_token) will be made mutually exclusive with I(profile) after 2022-06-01. type: str aws_config: description: - A dictionary to modify the botocore configuration. - Parameters can be found at U(https://botocore.amazonaws.com/v1/documentation/api/latest/reference/config.html#botocore.config.Config). - Only the 'user_agent' key is used for boto modules. See U(http://boto.cloudhackers.com/en/latest/boto_config_tut.html#boto) for more boto configuration. type: dict kms_key_id: description: - Specifies the KMS key ID to use to encrypt the logs delivered by CloudTrail. This also has the effect of enabling log file encryption. - The value can be an alias name prefixed by "alias/", a fully specified ARN to an alias, a fully specified ARN to a key, or a globally unique identifier. - See U(https://docs.aws.amazon.com/awscloudtrail/latest/userguide/encrypting-cloudtrail-log-files-with-aws-kms.html). version_added: '2.4' version_added_collection: ansible.builtin aws_ca_bundle: description: - The location of a CA Bundle to use when validating SSL certificates. - Not used by boto 2 based modules. - 'Note: The CA Bundle is read ''module'' side and may need to be explicitly copied from the controller if not run locally.' type: path s3_key_prefix: description: - S3 Key prefix for delivered log files. A trailing slash is not necessary and will be removed. aws_access_key: aliases: - ec2_access_key - access_key description: - C(AWS access key). If not set then the value of the C(AWS_ACCESS_KEY_ID), C(AWS_ACCESS_KEY) or C(EC2_ACCESS_KEY) environment variable is used. - If I(profile) is set this parameter is ignored. - Passing the I(aws_access_key) and I(profile) options at the same time has been deprecated and the options will be made mutually exclusive after 2022-06-01. type: str aws_secret_key: aliases: - ec2_secret_key - secret_key description: - C(AWS secret key). If not set then the value of the C(AWS_SECRET_ACCESS_KEY), C(AWS_SECRET_KEY), or C(EC2_SECRET_KEY) environment variable is used. - If I(profile) is set this parameter is ignored. - Passing the I(aws_secret_key) and I(profile) options at the same time has been deprecated and the options will be made mutually exclusive after 2022-06-01. type: str enable_logging: default: true description: - Start or stop the CloudTrail logging. If stopped the trail will be paused and will not record events or deliver log files. type: bool version_added: '2.4' version_added_collection: ansible.builtin s3_bucket_name: description: - An existing S3 bucket where CloudTrail will deliver log files. - This bucket should exist and have the proper policy. - See U(https://docs.aws.amazon.com/awscloudtrail/latest/userguide/aggregating_logs_regions_bucket_policy.html). - Required when C(state=present). version_added: '2.4' version_added_collection: ansible.builtin security_token: aliases: - aws_session_token - session_token - aws_security_token - access_token description: - C(AWS STS security token). If not set then the value of the C(AWS_SECURITY_TOKEN) or C(EC2_SECURITY_TOKEN) environment variable is used. - If I(profile) is set this parameter is ignored. - Passing the I(security_token) and I(profile) options at the same time has been deprecated and the options will be made mutually exclusive after 2022-06-01. - Aliases I(aws_session_token) and I(session_token) have been added in version 3.2.0. type: str sns_topic_name: description: - SNS Topic name to send notifications to when a log file is delivered. version_added: '2.4' version_added_collection: ansible.builtin validate_certs: default: true description: - When set to "no", SSL certificates will not be validated for communication with the AWS APIs. type: bool include_global_events: aliases: - include_global_service_events default: true description: - Record API calls from global services such as IAM and STS. type: bool is_multi_region_trail: default: false description: - Specify whether the trail belongs only to one region or exists in all regions. type: bool version_added: '2.4' version_added_collection: ansible.builtin cloudwatch_logs_role_arn: description: - Specifies a full ARN for an IAM role that assigns the proper permissions for CloudTrail to create and write to the log group. - See U(https://docs.aws.amazon.com/awscloudtrail/latest/userguide/send-cloudtrail-events-to-cloudwatch-logs.html). - Required when C(cloudwatch_logs_log_group_arn). version_added: '2.4' version_added_collection: ansible.builtin enable_log_file_validation: aliases: - log_file_validation_enabled description: - Specifies whether log file integrity validation is enabled. - CloudTrail will create a hash for every log file delivered and produce a signed digest file that can be used to ensure log files have not been tampered. type: bool version_added: '2.4' version_added_collection: ansible.builtin debug_botocore_endpoint_logs: default: 'no' description: - Use a botocore.endpoint logger to parse the unique (rather than total) "resource:action" API calls made during a task, outputing the set to the resource_actions key in the task results. Use the aws_resource_action callback to output to total list made during a playbook. The ANSIBLE_DEBUG_BOTOCORE_LOGS environment variable may also be used. type: bool cloudwatch_logs_log_group_arn: description: - A full ARN specifying a valid CloudWatch log group to which CloudTrail logs will be delivered. The log group should already exist. - See U(https://docs.aws.amazon.com/awscloudtrail/latest/userguide/send-cloudtrail-events-to-cloudwatch-logs.html). - Required when C(cloudwatch_logs_role_arn). version_added: '2.4' version_added_collection: ansible.builtin
exists: description: whether the resource exists returned: always sample: true type: bool trail: contains: cloud_watch_logs_log_group_arn: description: Full ARN of the CloudWatch Logs log group where events are delivered. returned: success when present sample: arn:aws:logs:us-east-1:123456789012:log-group:CloudTrail/DefaultLogGroup:* type: str cloud_watch_logs_role_arn: description: Full ARN of the IAM role that CloudTrail assumes to deliver events. returned: success when present sample: arn:aws:iam::123456789012:role/CloudTrail_CloudWatchLogs_Role type: str has_custom_event_selectors: description: Whether any custom event selectors are used for this trail. returned: success sample: false type: bool home_region: description: The home region where the trail was originally created and must be edited. returned: success sample: us-east-1 type: str include_global_service_events: description: Whether global services (IAM, STS) are logged with this trail returned: success sample: true type: bool is_logging: description: Whether logging is turned on or paused for the Trail returned: success sample: true type: bool is_multi_region_trail: description: Whether the trail applies to all regions or just one returned: success sample: true type: bool kms_key_id: description: Full ARN of the KMS Key used to encrypt log files. returned: success when present sample: arn:aws:kms::123456789012:key/12345678-1234-1234-1234-123456789012 type: str log_file_validation_enabled: description: Whether log file validation is enabled on the trail returned: success sample: true type: bool name: description: Name of the CloudTrail resource returned: success sample: default type: str s3_bucket_name: description: S3 bucket name where log files are delivered returned: success sample: myBucket type: str s3_key_prefix: description: Key prefix in bucket where log files are delivered (if any) returned: success when present sample: myKeyPrefix type: str sns_topic_arn: description: Full ARN of the SNS topic where log delivery notifications are sent. returned: success when present sample: arn:aws:sns:us-east-1:123456789012:topic/myTopic type: str sns_topic_name: description: The SNS topic name where log delivery notifications are sent. returned: success when present sample: myTopic type: str tags: description: hash/dictionary of tags applied to this resource returned: success sample: Name: default environment: dev type: dict trail_arn: description: Full ARN of the CloudTrail resource returned: success sample: arn:aws:cloudtrail:us-east-1:123456789012:trail/default type: str description: CloudTrail resource details returned: always sample: hash/dictionary of values type: complex