PutAccountPolicyRequest

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/amazon-cloudwatch/json-schema/amazon-cloudwatch-put-account-policy-request-schema.json",
  "title": "PutAccountPolicyRequest",
  "x-generated": "2026-11-11",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/amazon-cloudwatch-account-policy-api-openapi.yml#/components/schemas/PutAccountPolicyRequest",
  "type": "object",
  "properties": {
    "policyName": {
      "type": "string",
      "description": "A name for the policy. This must be unique within the account and cannot start with aws/."
    },
    "policyDocument": {
      "type": "string",
      "description": "Specify the policy, in JSON. Data protection policy A data protection policy must include two JSON blocks: The first block must include both a DataIdentifer array and an Operation property with an Audit action. The DataIdentifer array lists the types of sensitive data that you want to mask. For more information about the available options, see Types of data that you can mask. The Operation property with an Audit action is required to find the sensitive data terms. This Audit action must contain a FindingsDestination object. You can optionally use that FindingsDestination object to list one or "
    },
    "policyType": {
      "type": "string",
      "enum": [
        "DATA_PROTECTION_POLICY",
        "SUBSCRIPTION_FILTER_POLICY",
        "FIELD_INDEX_POLICY",
        "TRANSFORMER_POLICY",
        "METRIC_EXTRACTION_POLICY",
        "RETENTION_POLICY"
      ],
      "description": "The type of policy that you're creating or updating."
    },
    "scope": {
      "type": "string",
      "enum": [
        "ALL"
      ],
      "description": "Currently the only valid value for this parameter is ALL, which specifies that the data protection policy applies to all log groups in the account. If you omit this parameter, the default of ALL is used."
    },
    "selectionCriteria": {
      "type": "string",
      "description": "Use this parameter to apply the new policy to a subset of log groups in the account or a data source name and type combination. Specifying selectionCriteria is valid only when you specify SUBSCRIPTION_FILTER_POLICY, FIELD_INDEX_POLICY, TRANSFORMER_POLICY, or RETENTION_POLICY for policyType. If policyType is SUBSCRIPTION_FILTER_POLICY, the only supported selectionCriteria filter is LogGroupName NOT IN [] If policyType is TRANSFORMER_POLICY, the only supported selectionCriteria filter is LogGroupNamePrefix If policyType is FIELD_INDEX_POLICY, the supported selectionCriteria filters are: LogGroup"
    },
    "dryRun": {
      "type": "boolean",
      "description": "Specifies whether to preview the impact of the policy without creating or updating it. If you specify true, CloudWatch Logs validates the request, does not save the policy, and returns the estimated impact in dryRunResult instead of accountPolicy. The default is false. Specifying dryRun is valid only when you specify RETENTION_POLICY for policyType. Only one dry run can be in progress for an account at a time."
    }
  },
  "required": [
    "policyName",
    "policyDocument",
    "policyType"
  ]
}