CloudTrailDataService / Client / put_audit_events
put_audit_events#
- CloudTrailDataService.Client.put_audit_events(**kwargs)#
Ingests your application events into CloudTrail Lake. A required parameter,
auditEvents
, accepts the JSON records (also called payload) of events that you want CloudTrail to ingest. You can add up to 100 of these events (or up to 1 MB) perPutAuditEvents
request.See also: AWS API Documentation
Request Syntax
response = client.put_audit_events( auditEvents=[ { 'eventData': 'string', 'eventDataChecksum': 'string', 'id': 'string' }, ], channelArn='string', externalId='string' )
- Parameters:
auditEvents (list) –
[REQUIRED]
The JSON payload of events that you want to ingest. You can also point to the JSON event payload in a file.
(dict) –
An event from a source outside of Amazon Web Services that you want CloudTrail to log.
eventData (string) – [REQUIRED]
The content of an audit event that comes from the event, such as
userIdentity
,userAgent
, andeventSource
.eventDataChecksum (string) –
A checksum is a base64-SHA256 algorithm that helps you verify that CloudTrail receives the event that matches with the checksum. Calculate the checksum by running a command like the following:
printf %s $eventdata | openssl dgst -binary -sha256 | base64
id (string) – [REQUIRED]
The original event ID from the source event.
channelArn (string) –
[REQUIRED]
The ARN or ID (the ARN suffix) of a channel.
externalId (string) – A unique identifier that is conditionally required when the channel’s resource policy includes an external ID. This value can be any string, such as a passphrase or account number.
- Return type:
dict
- Returns:
Response Syntax
{ 'failed': [ { 'errorCode': 'string', 'errorMessage': 'string', 'id': 'string' }, ], 'successful': [ { 'eventID': 'string', 'id': 'string' }, ] }
Response Structure
(dict) –
failed (list) –
Lists events in the provided event payload that could not be ingested into CloudTrail, and includes the error code and error message returned for events that could not be ingested.
(dict) –
Includes the error code and error message for events that could not be ingested by CloudTrail.
errorCode (string) –
The error code for events that could not be ingested by CloudTrail. Possible error codes include:
FieldTooLong
,FieldNotFound
,InvalidChecksum
,InvalidData
,InvalidRecipient
,InvalidEventSource
,AccountNotSubscribed
,Throttling
, andInternalFailure
.errorMessage (string) –
The message that describes the error for events that could not be ingested by CloudTrail.
id (string) –
The original event ID from the source event that could not be ingested by CloudTrail.
successful (list) –
Lists events in the provided event payload that were successfully ingested into CloudTrail.
(dict) –
A response that includes successful and failed event results.
eventID (string) –
The event ID assigned by CloudTrail.
id (string) –
The original event ID from the source event.
Exceptions
CloudTrailDataService.Client.exceptions.ChannelInsufficientPermission
CloudTrailDataService.Client.exceptions.ChannelNotFound
CloudTrailDataService.Client.exceptions.InvalidChannelARN
CloudTrailDataService.Client.exceptions.ChannelUnsupportedSchema
CloudTrailDataService.Client.exceptions.DuplicatedAuditEventId
CloudTrailDataService.Client.exceptions.UnsupportedOperationException