Amazon CloudWatch Cloudwatch Account Policy API

openapi: 3.1.0
info:
  title: Amazon CloudWatch Account Policy API
  version: '2010-08-01'
  description: Generated from AWS's published Smithy model for Amazon CloudWatch. 3 operation(s).
  contact:
    name: Amazon Web Services
    url: https://aws.amazon.com/contact-us/
  license:
    name: Apache 2.0
    identifier: Apache-2.0
    url: https://github.com/aws/api-models-aws/blob/main/LICENSE
servers:
- url: https://logs.{region}.amazonaws.com
  variables:
    region:
      default: us-east-1
security:
- sigv4: []
paths:
  /#DeleteAccountPolicy:
    post:
      operationId: DeleteAccountPolicy
      summary: Delete Account Policy
      description: 'Deletes a CloudWatch Logs account policy. This stops the account-wide policy from applying to log groups
        or data sources in the account. If you delete a data protection policy or subscription filter policy, any log-group
        level policies of those types remain in effect. If you delete a retention policy, the log groups that it applied to
        use their own retention setting, unless another retention policy applies to them. Deleting a retention policy does
        not restore log events that CloudWatch Logs has already deleted. This operation supports deletion of data source-based
        field index policies, including facet configurations, in addition to log group-based policies. To use this operation,
        you must be signed on with the correct permissions depending on the type of policy that you are deleting. To delete
        a data protection policy, you must have the logs:DeleteDataProtectionPolicy and logs:DeleteAccountPolicy permissions.
        To delete a subscription filter policy, you must have the logs:DeleteSubscriptionFilter and logs:DeleteAccountPolicy
        permissions. To delete a transformer policy, you must have the logs:DeleteTransformer and logs:DeleteAccountPolicy
        permissions. To delete a field index policy, '
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/DeleteAccountPolicyResponse'
        '400':
          description: InvalidParameterException; OperationAbortedException; ResourceNotFoundException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/InvalidParameterException'
        '500':
          description: ServiceUnavailableException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ServiceUnavailableException'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - Logs_20140328.DeleteAccountPolicy
      requestBody:
        required: true
        content:
          application/x-amz-json-1.1:
            schema:
              $ref: '#/components/schemas/DeleteAccountPolicyRequest'
      tags:
      - Account Policy
  /#DescribeAccountPolicies:
    post:
      operationId: DescribeAccountPolicies
      summary: Describe Account Policies
      description: Returns a list of all CloudWatch Logs account policies in the account. To use this operation, you must
        be signed on with the correct permissions depending on the type of policy that you are retrieving information for.
        To see data protection policies, you must have the logs:GetDataProtectionPolicy and logs:DescribeAccountPolicies permissions.
        To see subscription filter policies, you must have the logs:DescribeSubscriptionFilters and logs:DescribeAccountPolicies
        permissions. To see transformer policies, you must have the logs:GetTransformer and logs:DescribeAccountPolicies permissions.
        To see field index policies, you must have the logs:DescribeIndexPolicies and logs:DescribeAccountPolicies permissions.
        To see retention policies, you must have the logs:DescribeAccountPolicies permission.
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/DescribeAccountPoliciesResponse'
        '400':
          description: InvalidParameterException; OperationAbortedException; ResourceNotFoundException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/InvalidParameterException'
        '500':
          description: ServiceUnavailableException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ServiceUnavailableException'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - Logs_20140328.DescribeAccountPolicies
      requestBody:
        required: true
        content:
          application/x-amz-json-1.1:
            schema:
              $ref: '#/components/schemas/DescribeAccountPoliciesRequest'
      tags:
      - Account Policy
  /#PutAccountPolicy:
    post:
      operationId: PutAccountPolicy
      summary: Put Account Policy
      description: 'Creates an account-level data protection policy, subscription filter policy, field index policy, transformer
        policy, metric extraction policy, or retention policy that applies to all log groups, a subset of log groups, or a
        data source name and type combination in the account. Account-level policies are Region-specific: a policy applies
        only to log groups in the Region where you create it. To apply a policy across multiple Regions, create the policy
        separately in each Region. PutAccountPolicy is an account-wide administrative operation intended for CloudWatch Logs
        administrators. Because it affects all log groups (or a broad subset) in the account, you should grant logs:PutAccountPolicy
        permissions only to administrators who manage logging configuration across the account, not to application teams or
        individual log group owners. Conflict resolution between account-level and log-group-level policies When both an account-level
        policy and a log-group-level policy of the same type apply to a log group, the resolution depends on the policy type:
        Data protection — The two policies are cumulative. Any sensitive term specified in either the account-level or the
        log-group-level policy is ma'
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/PutAccountPolicyResponse'
        '400':
          description: InvalidParameterException; LimitExceededException; OperationAbortedException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/InvalidParameterException'
        '500':
          description: ServiceUnavailableException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ServiceUnavailableException'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - Logs_20140328.PutAccountPolicy
      requestBody:
        required: true
        content:
          application/x-amz-json-1.1:
            schema:
              $ref: '#/components/schemas/PutAccountPolicyRequest'
      tags:
      - Account Policy
components:
  securitySchemes:
    sigv4:
      type: apiKey
      in: header
      name: Authorization
      description: AWS Signature Version 4. The Authorization header carries an AWS4-HMAC-SHA256 signature over the canonical
        request, with X-Amz-Date (and X-Amz-Security-Token for temporary credentials). Not a bearer token.
      x-aws-sigv4:
        signingName: logs
  schemas:
    AccountPolicy:
      type: object
      properties:
        policyName:
          type: string
          description: The name of the account policy.
        policyDocument:
          type: string
          description: The policy document for this account policy. The JSON specified in policyDocument can be up to 30,720
            characters.
        lastUpdatedTime:
          type: integer
          description: The date and time that this policy was most recently updated.
        policyType:
          type: string
          enum:
          - DATA_PROTECTION_POLICY
          - SUBSCRIPTION_FILTER_POLICY
          - FIELD_INDEX_POLICY
          - TRANSFORMER_POLICY
          - METRIC_EXTRACTION_POLICY
          - RETENTION_POLICY
          description: The type of policy for this account policy.
        scope:
          type: string
          enum:
          - ALL
          description: The scope of the account policy.
        selectionCriteria:
          type: string
          description: The log group selection criteria that is used for this policy.
        accountId:
          type: string
          description: The Amazon Web Services account ID that the policy applies to.
    DeleteAccountPolicyRequest:
      type: object
      properties:
        policyName:
          type: string
          description: The name of the policy to delete.
        policyType:
          type: string
          enum:
          - DATA_PROTECTION_POLICY
          - SUBSCRIPTION_FILTER_POLICY
          - FIELD_INDEX_POLICY
          - TRANSFORMER_POLICY
          - METRIC_EXTRACTION_POLICY
          - RETENTION_POLICY
          description: The type of policy to delete.
        dryRun:
          type: boolean
          description: Specifies whether to preview the impact of deleting the policy without deleting it. If you specify
            true, CloudWatch Logs does not delete the policy and returns the estimated impact in dryRunResult. The default
            is false. Specifying dryRun is valid only when you specify RETENTION_POLICY for policyType. Only one dry run can
            be in progress for an account at a time.
      required:
      - policyName
      - policyType
    DeleteAccountPolicyResponse:
      type: object
      properties:
        dryRunResult:
          $ref: '#/components/schemas/DryRunResult'
    DescribeAccountPoliciesRequest:
      type: object
      properties:
        policyType:
          type: string
          enum:
          - DATA_PROTECTION_POLICY
          - SUBSCRIPTION_FILTER_POLICY
          - FIELD_INDEX_POLICY
          - TRANSFORMER_POLICY
          - METRIC_EXTRACTION_POLICY
          - RETENTION_POLICY
          description: Use this parameter to limit the returned policies to only the policies that match the policy type that
            you specify.
        policyName:
          type: string
          description: Use this parameter to limit the returned policies to only the policy with the name that you specify.
        accountIdentifiers:
          type: array
          items:
            type: string
          description: If you are using an account that is set up as a monitoring account for CloudWatch unified cross-account
            observability, you can use this to specify the account ID of a source account. If you do, the operation returns
            the account policy for the specified account. Currently, you can specify only one account ID in this parameter.
            If you omit this parameter, only the policy in the current account is returned.
        nextToken:
          type: string
          description: The token for the next set of items to return. (You received this token from a previous call.)
      required:
      - policyType
    DescribeAccountPoliciesResponse:
      type: object
      properties:
        accountPolicies:
          type: array
          items:
            $ref: '#/components/schemas/AccountPolicy'
          description: An array of structures that contain information about the CloudWatch Logs account policies that match
            the specified filters.
        nextToken:
          type: string
          description: The token to use when requesting the next set of items. The token expires after 24 hours.
    DryRunResult:
      type: object
      properties:
        totalMatchedLogGroups:
          type: integer
          description: The number of log groups in the scope of the policy that were analyzed. This value is the sum of increasedRetentionLogGroupCount,
            decreasedRetentionLogGroupCount, and unchangedRetentionLogGroupCount, and does not include log groups that could
            not be analyzed.
        increasedRetentionLogGroupCount:
          type: integer
          description: The number of log groups whose effective retention period would become longer.
        decreasedRetentionLogGroupCount:
          type: integer
          description: The number of log groups whose effective retention period would become shorter.
        unchangedRetentionLogGroupCount:
          type: integer
          description: The number of log groups whose effective retention period would not change.
        failedAnalysisCount:
          type: integer
          description: The number of log groups in the scope of the policy that could not be analyzed. These log groups are
            not included in totalMatchedLogGroups.
        topLogGroupsImpacted:
          type: array
          items:
            $ref: '#/components/schemas/LogGroupImpact'
          description: Up to 20 log groups in the scope of the policy, sorted by stored bytes in descending order. This list
            can include log groups whose effective retention period would not change.
    InvalidParameterException:
      type: object
      properties:
        message:
          type: string
    LogGroupImpact:
      type: object
      properties:
        logGroupName:
          type: string
          description: The name of the log group.
        currentRetention:
          type: string
          description: The current effective retention period of the log group, in days. A value of NEVER_EXPIRE indicates
            that log events in the log group never expire.
        proposedRetention:
          type: string
          description: The effective retention period of the log group, in days, after the change. A value of NEVER_EXPIRE
            indicates that log events in the log group would never expire.
        storedBytes:
          type: integer
          description: The number of bytes stored in the log group.
    PutAccountPolicyRequest:
      type: object
      properties:
        policyName:
          type: string
          description: A name for the policy. This must be unique within the account and cannot start with aws/.
        policyDocument:
          type: string
          description: 'Specify the policy, in JSON. Data protection policy A data protection policy must include two JSON
            blocks: The first block must include both a DataIdentifer array and an Operation property with an Audit action.
            The DataIdentifer array lists the types of sensitive data that you want to mask. For more information about the
            available options, see Types of data that you can mask. The Operation property with an Audit action is required
            to find the sensitive data terms. This Audit action must contain a FindingsDestination object. You can optionally
            use that FindingsDestination object to list one or '
        policyType:
          type: string
          enum:
          - DATA_PROTECTION_POLICY
          - SUBSCRIPTION_FILTER_POLICY
          - FIELD_INDEX_POLICY
          - TRANSFORMER_POLICY
          - METRIC_EXTRACTION_POLICY
          - RETENTION_POLICY
          description: The type of policy that you're creating or updating.
        scope:
          type: string
          enum:
          - ALL
          description: Currently the only valid value for this parameter is ALL, which specifies that the data protection
            policy applies to all log groups in the account. If you omit this parameter, the default of ALL is used.
        selectionCriteria:
          type: string
          description: 'Use this parameter to apply the new policy to a subset of log groups in the account or a data source
            name and type combination. Specifying selectionCriteria is valid only when you specify SUBSCRIPTION_FILTER_POLICY,
            FIELD_INDEX_POLICY, TRANSFORMER_POLICY, or RETENTION_POLICY for policyType. If policyType is SUBSCRIPTION_FILTER_POLICY,
            the only supported selectionCriteria filter is LogGroupName NOT IN [] If policyType is TRANSFORMER_POLICY, the
            only supported selectionCriteria filter is LogGroupNamePrefix If policyType is FIELD_INDEX_POLICY, the supported
            selectionCriteria filters are: LogGroup'
        dryRun:
          type: boolean
          description: Specifies whether to preview the impact of the policy without creating or updating it. If you specify
            true, CloudWatch Logs validates the request, does not save the policy, and returns the estimated impact in dryRunResult
            instead of accountPolicy. The default is false. Specifying dryRun is valid only when you specify RETENTION_POLICY
            for policyType. Only one dry run can be in progress for an account at a time.
      required:
      - policyName
      - policyDocument
      - policyType
    PutAccountPolicyResponse:
      type: object
      properties:
        accountPolicy:
          $ref: '#/components/schemas/AccountPolicy'
        dryRunResult:
          $ref: '#/components/schemas/DryRunResult'
    ServiceUnavailableException:
      type: object
      properties:
        message:
          type: string
x-provenance:
  method: harvested
  publisher: Amazon Web Services
  source: https://raw.githubusercontent.com/aws/api-models-aws/3cd98287b471c106254abd89279cc87308d38bfd/models/cloudwatch-logs/service/2014-03-28/cloudwatch-logs-2014-03-28.json
  note: converted by smithy-to-openapi.py from AWS's Smithy model (roadmap#1001)