AWS cli: Add LogGroupDeletionProtection option to centralization rule
Summary
Documents a new LogGroupDeletionProtection parameter (ENABLED) that turns on deletion protection for destination log groups created by the centralization rule, including backup Region log groups, plus the JSON syntax example and CLI version bump.
Security assessment
The new setting lets administrators protect centralized log groups from deletion (accidental or malicious), preserving audit/telemetry data integrity. It is a data-protection hardening feature rather than a fix for a specific vulnerability, so it is security documentation with medium impact.
Evidence
+>>>> Specifies whether this centralization rule enables deletion protection on the destination log groups that it creates. If you don’t specify this setting, the rule doesn’t enable deletion protection on the log groups that it creates. If you specify a backup Region in `BackupConfiguration` , the setting also applies to the log groups that the rule creates in the backup Region.
Diff
diff --git a/cli/latest/reference/observabilityadmin/create-centralization-rule-for-organization.md b/cli/latest/reference/observabilityadmin/create-centralization-rule-for-organization.md index 47d8590..b852215 100644 --- a//cli/latest/reference/observabilityadmin/create-centralization-rule-for-organization.md +++ b//cli/latest/reference/observabilityadmin/create-centralization-rule-for-organization.md @@ -15 +15 @@ - * [AWS CLI 2.38.1 Command Reference](../../index.html) » + * [AWS CLI 2.38.2 Command Reference](../../index.html) » @@ -371,0 +372,14 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/observ +>>> +>>> LogGroupDeletionProtection -> (string) +>>> +>>>> Specifies whether this centralization rule enables deletion protection on the destination log groups that it creates. If you don’t specify this setting, the rule doesn’t enable deletion protection on the log groups that it creates. If you specify a backup Region in `BackupConfiguration` , the setting also applies to the log groups that the rule creates in the backup Region. +>>>> +>>>> When you set this to `ENABLED` , the rule enables deletion protection only on log groups that it creates after you enable the setting. It does not add deletion protection to log groups the rule created before you enabled the setting. +>>>> +>>>> If you remove this setting from the rule or delete the rule, deletion protection stays enabled on log groups that already have it. To delete one of these log groups, first disable deletion protection on the log group in the destination account. +>>>> +>>>> Possible values: +>>>> +>>>> * `ENABLED` +>>>> + @@ -430 +444,2 @@ JSON Syntax: - } + }, + "LogGroupDeletionProtection": "ENABLED" @@ -620 +635 @@ RuleArn -> (string) - * [AWS CLI 2.38.1 Command Reference](../../index.html) » + * [AWS CLI 2.38.2 Command Reference](../../index.html) »