AWS cli: Document LogGroupDeletionProtection for centralization rules
Summary
Adds documentation and JSON syntax for the new `LogGroupDeletionProtection` setting, which enables deletion protection on destination log groups created by an organization centralization rule, including backup Region behavior and the fact that protection persists after the setting is removed.
Security assessment
Deletion protection on centralized log groups guards the integrity/availability of audit and telemetry logs against accidental or malicious deletion, a security-relevant hardening control, though it is not tied to a specific vulnerability or incident.
Evidence
+>>>> When you set this to `ENABLED` , the rule enables deletion protection only on log groups that it creates after you enable the setting. It does not add deletion protection to log groups the rule created before you enabled the setting.
Diff
diff --git a/cli/latest/reference/observabilityadmin/update-centralization-rule-for-organization.md b/cli/latest/reference/observabilityadmin/update-centralization-rule-for-organization.md index d641cc2..d16f973 100644 --- a//cli/latest/reference/observabilityadmin/update-centralization-rule-for-organization.md +++ b//cli/latest/reference/observabilityadmin/update-centralization-rule-for-organization.md @@ -15 +15 @@ - * [AWS CLI 2.38.1 Command Reference](../../index.html) » + * [AWS CLI 2.38.2 Command Reference](../../index.html) » @@ -369,0 +370,14 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/observ +>>> +>>> LogGroupDeletionProtection -> (string) +>>> +>>>> Specifies whether this centralization rule enables deletion protection on the destination log groups that it creates. If you don’t specify this setting, the rule doesn’t enable deletion protection on the log groups that it creates. If you specify a backup Region in `BackupConfiguration` , the setting also applies to the log groups that the rule creates in the backup Region. +>>>> +>>>> When you set this to `ENABLED` , the rule enables deletion protection only on log groups that it creates after you enable the setting. It does not add deletion protection to log groups the rule created before you enabled the setting. +>>>> +>>>> If you remove this setting from the rule or delete the rule, deletion protection stays enabled on log groups that already have it. To delete one of these log groups, first disable deletion protection on the log group in the destination account. +>>>> +>>>> Possible values: +>>>> +>>>> * `ENABLED` +>>>> + @@ -428 +442,2 @@ JSON Syntax: - } + }, + "LogGroupDeletionProtection": "ENABLED" @@ -574 +589 @@ RuleArn -> (string) - * [AWS CLI 2.38.1 Command Reference](../../index.html) » + * [AWS CLI 2.38.2 Command Reference](../../index.html) »