AWS cli: Document LogGroupDeletionProtection in centralization rule output
Summary
Adds the LogGroupDeletionProtection field to the CentralizationRule response structure, describing that deletion protection persists on log groups even if the setting is removed or the rule deleted, plus CLI version bump.
Security assessment
Documents a protective control over centralized log groups and its persistence semantics, which helps prevent loss of audit data. It is security-relevant guidance, not a fix for a specific vulnerability.
Evidence
+>>>> If you remove this setting from the rule or delete the rule, deletion protection stays enabled on log groups that already have it. To delete one of these log groups, first disable deletion protection on the log group in the destination account.
Diff
diff --git a/cli/latest/reference/observabilityadmin/get-centralization-rule-for-organization.md b/cli/latest/reference/observabilityadmin/get-centralization-rule-for-organization.md index f134c28..6a155bb 100644 --- a//cli/latest/reference/observabilityadmin/get-centralization-rule-for-organization.md +++ b//cli/latest/reference/observabilityadmin/get-centralization-rule-for-organization.md @@ -15 +15 @@ - * [AWS CLI 2.38.1 Command Reference](../../index.html) » + * [AWS CLI 2.38.2 Command Reference](../../index.html) » @@ -585,0 +586,14 @@ CentralizationRule -> (structure) +>>> +>>> LogGroupDeletionProtection -> (string) +>>> +>>>> Specifies whether this centralization rule enables deletion protection on the destination log groups that it creates. If you don’t specify this setting, the rule doesn’t enable deletion protection on the log groups that it creates. If you specify a backup Region in `BackupConfiguration` , the setting also applies to the log groups that the rule creates in the backup Region. +>>>> +>>>> When you set this to `ENABLED` , the rule enables deletion protection only on log groups that it creates after you enable the setting. It does not add deletion protection to log groups the rule created before you enabled the setting. +>>>> +>>>> If you remove this setting from the rule or delete the rule, deletion protection stays enabled on log groups that already have it. To delete one of these log groups, first disable deletion protection on the log group in the destination account. +>>>> +>>>> Possible values: +>>>> +>>>> * `ENABLED` +>>>> + @@ -615 +629 @@ CentralizationRule -> (structure) - * [AWS CLI 2.38.1 Command Reference](../../index.html) » + * [AWS CLI 2.38.2 Command Reference](../../index.html) »