AWS AWSCloudFormation medium security documentation change
Summary
Added detailed filter syntax for controlling metric namespace and log group sharing with monitoring accounts, including examples and security notes.
Security assessment
Enables precise access control over observability data sharing through filter patterns, implementing least-privilege principles. The documentation explicitly addresses security configuration.
Diff
diff --git a/AWSCloudFormation/latest/UserGuide/aws-properties-oam-link-linkfilter.md b/AWSCloudFormation/latest/UserGuide/aws-properties-oam-link-linkfilter.md index 296d6e30b..a9c322ed2 100644 --- a//AWSCloudFormation/latest/UserGuide/aws-properties-oam-link-linkfilter.md +++ b//AWSCloudFormation/latest/UserGuide/aws-properties-oam-link-linkfilter.md @@ -7 +7,3 @@ SyntaxProperties -The `LinkFilter` property type specifies Property description not available. for an [AWS::Oam::Link](./aws-resource-oam-link.html). +When used in `MetricConfiguration` this field specifies which metric namespaces are to be shared with the monitoring account + +When used in `LogGroupConfiguration` this field specifies which log groups are to share their log events with the monitoring account. Use the term `LogGroupName` and one or more of the following operands. @@ -32 +34,41 @@ To declare this entity in your AWS CloudFormation template, use the following sy -Property description not available. +When used in `MetricConfiguration` this field specifies which metric namespaces are to be shared with the monitoring account + +When used in `LogGroupConfiguration` this field specifies which log groups are to share their log events with the monitoring account. Use the term `LogGroupName` and one or more of the following operands. + +Use single quotation marks (') around log group names and metric namespaces. + +The matching of log group names and metric namespaces is case sensitive. Each filter has a limit of five conditional operands. Conditional operands are `AND` and `OR`. + + * `=` and `!=` + + * `AND` + + * `OR` + + * `LIKE` and `NOT LIKE`. These can be used only as prefix searches. Include a `%` at the end of the string that you want to search for and include. + + * `IN` and `NOT IN`, using parentheses `( )` + + + + +Examples: + + * `Namespace NOT LIKE 'AWS/%'` includes only namespaces that don't start with `AWS/`, such as custom namespaces. + + * `Namespace IN ('AWS/EC2', 'AWS/ELB', 'AWS/S3')` includes only the metrics in the EC2, Elastic Load Balancing, and Amazon S3 namespaces. + + * `Namespace = 'AWS/EC2' OR Namespace NOT LIKE 'AWS/%'` includes only the EC2 namespace and your custom namespaces. + + * `LogGroupName IN ('This-Log-Group', 'Other-Log-Group')` includes only the log groups with names `This-Log-Group` and `Other-Log-Group`. + + * `LogGroupName NOT IN ('Private-Log-Group', 'Private-Log-Group-2')` includes all log groups except the log groups with names `Private-Log-Group` and `Private-Log-Group-2`. + + * `LogGroupName LIKE 'aws/lambda/%' OR LogGroupName LIKE 'AWSLogs%'` includes all log groups that have names that start with `aws/lambda/` or `AWSLogs`. + + + + +###### Note + +If you are updating a link that uses filters, you can specify `*` as the only value for the `filter` parameter to delete the filter and share all log groups with the monitoring account.