import * as aws from "@pulumi/aws" ; import * as pulumi from "@pulumi/pulumi" ; import * as utils from "../utils" ; export class Trail extends pulumi . ComponentResource { /**
     * The managed CloudWatch Log Group.
     */ public readonly logGroup : aws . cloudwatch . LogGroup | undefined ; /**
     * The managed S3 Bucket where the Trail will place its logs.
     */ public readonly bucket : aws . s3 . Bucket | undefined ; /**
     * The CloudTrail Trail.
     */ public readonly trail : aws . cloudtrail . Trail ; param name param args param opts constructor ( name , args , opts ? ) { super ( "aws:cloudtrail:x:Trail" , name , { } , opts ) ; let bucketName ; if ( args . s3BucketName !== undefined ) { bucketName = pulumi . output ( args . s3BucketName ) ; } else { this . bucket = bucketWithCloudTrailPolicy ( name , this ) ; bucketName = this . bucket . id ; } let cloudWatchLogGroupArn = undefined ; if ( args . sendToCloudWatchLogs ) { this . logGroup = new aws . cloudwatch . LogGroup ( name , args . cloudWatchLogGroupArgs , { parent : this } ) ; cloudWatchLogGroupArn = pulumi . interpolate `${ this . logGroup . arn }:*` ; } const trailArgs = { s3BucketName : bucketName , cloudWatchLogGroupArn : cloudWatchLogGroupArn , ... args , } ; this . trail = new aws . cloudtrail . Trail ( name , trailArgs , { parent : this } ) ; } } type TrailArgs = utils . Overwrite < aws . cloudtrail . TrailArgs , { default sendToCloudWatchLogs ? : boolean ; /**
     * If sendToCloudWatchLogs is enabled, provide the log group configuration.
     */ cloudWatchLogGroupArgs ? : aws . cloudwatch . LogGroupArgs ; /**
     * Specifies the name of the S3 bucket designated for publishing log files.
     */ s3BucketName ? : pulumi . Input < string > ; } > ; function bucketWithCloudTrailPolicy ( name , parent ) { const bucket = new aws . s3 . Bucket ( name , { } , { parent : parent } ) ; const policy = new aws . s3 . BucketPolicy ( name , { bucket : bucket . id , policy : { Version : "2012-10-17" , Statement : [ { Sid : "AWSCloudTrailAclCheck" , Effect : "Allow" , Principal : aws . iam . Principals . CloudtrailPrincipal , Action : [ "s3:GetBucketAcl" ] , Resource : [ bucket . arn ] , } , { Sid : "AWSCloudTrailWrite" , Effect : "Allow" , Principal : { Service : "cloudtrail.amazonaws.com" } , Action : [ "s3:PutObject" ] , Resource : [ pulumi . interpolate `${ bucket . arn }/*` ] , Condition : { StringEquals : { "s3:x-amz-acl" : "bucket-owner-full-control" } } , } ] , } , } , { parent : parent } ) ; return bucket ; }