AWS AWSCloudFormation documentation change
Summary
Added detailed documentation for LinkFilter property including filtering syntax, examples, and sharing controls for metrics/logs
Security assessment
Documents granular access controls for data sharing with monitoring accounts, enhancing security documentation but not addressing a specific vulnerability
Diff
diff --git a/AWSCloudFormation/latest/UserGuide/aws-properties-oam-link-linkfilter.md b/AWSCloudFormation/latest/UserGuide/aws-properties-oam-link-linkfilter.md index 296d6e30b..a9c322ed2 100644 --- a/AWSCloudFormation/latest/UserGuide/aws-properties-oam-link-linkfilter.md +++ b/AWSCloudFormation/latest/UserGuide/aws-properties-oam-link-linkfilter.md @@ -7 +7,3 @@ SyntaxProperties -The `LinkFilter` property type specifies Property description not available. for an [AWS::Oam::Link](./aws-resource-oam-link.html). +When used in `MetricConfiguration` this field specifies which metric namespaces are to be shared with the monitoring account + +When used in `LogGroupConfiguration` this field specifies which log groups are to share their log events with the monitoring account. Use the term `LogGroupName` and one or more of the following operands. @@ -32 +34,41 @@ To declare this entity in your AWS CloudFormation template, use the following sy -Property description not available. +When used in `MetricConfiguration` this field specifies which metric namespaces are to be shared with the monitoring account + +When used in `LogGroupConfiguration` this field specifies which log groups are to share their log events with the monitoring account. Use the term `LogGroupName` and one or more of the following operands. + +Use single quotation marks (') around log group names and metric namespaces. + +The matching of log group names and metric namespaces is case sensitive. Each filter has a limit of five conditional operands. Conditional operands are `AND` and `OR`. + + * `=` and `!=` + + * `AND` + + * `OR` + + * `LIKE` and `NOT LIKE`. These can be used only as prefix searches. Include a `%` at the end of the string that you want to search for and include. + + * `IN` and `NOT IN`, using parentheses `( )` + + + + +Examples: + + * `Namespace NOT LIKE 'AWS/%'` includes only namespaces that don't start with `AWS/`, such as custom namespaces. + + * `Namespace IN ('AWS/EC2', 'AWS/ELB', 'AWS/S3')` includes only the metrics in the EC2, Elastic Load Balancing, and Amazon S3 namespaces. + + * `Namespace = 'AWS/EC2' OR Namespace NOT LIKE 'AWS/%'` includes only the EC2 namespace and your custom namespaces. + + * `LogGroupName IN ('This-Log-Group', 'Other-Log-Group')` includes only the log groups with names `This-Log-Group` and `Other-Log-Group`. + + * `LogGroupName NOT IN ('Private-Log-Group', 'Private-Log-Group-2')` includes all log groups except the log groups with names `Private-Log-Group` and `Private-Log-Group-2`. + + * `LogGroupName LIKE 'aws/lambda/%' OR LogGroupName LIKE 'AWSLogs%'` includes all log groups that have names that start with `aws/lambda/` or `AWSLogs`. + + + + +###### Note + +If you are updating a link that uses filters, you can specify `*` as the only value for the `filter` parameter to delete the filter and share all log groups with the monitoring account.