diff --git a/amazonka-cloudtrail.cabal b/amazonka-cloudtrail.cabal --- a/amazonka-cloudtrail.cabal +++ b/amazonka-cloudtrail.cabal @@ -1,5 +1,5 @@ name: amazonka-cloudtrail -version: 0.3.2 +version: 0.3.3 synopsis: Amazon CloudTrail SDK. homepage: https://github.com/brendanhay/amazonka license: OtherLicense @@ -41,6 +41,7 @@ , Network.AWS.CloudTrail.DeleteTrail , Network.AWS.CloudTrail.DescribeTrails , Network.AWS.CloudTrail.GetTrailStatus + , Network.AWS.CloudTrail.LookupEvents , Network.AWS.CloudTrail.StartLogging , Network.AWS.CloudTrail.StopLogging , Network.AWS.CloudTrail.Types @@ -49,5 +50,5 @@ other-modules: build-depends: - amazonka-core == 0.3.2.* + amazonka-core == 0.3.3.* , base >= 4.7 && < 5 diff --git a/gen/Network/AWS/CloudTrail.hs b/gen/Network/AWS/CloudTrail.hs --- a/gen/Network/AWS/CloudTrail.hs +++ b/gen/Network/AWS/CloudTrail.hs @@ -20,6 +20,7 @@ , module Network.AWS.CloudTrail.DeleteTrail , module Network.AWS.CloudTrail.DescribeTrails , module Network.AWS.CloudTrail.GetTrailStatus + , module Network.AWS.CloudTrail.LookupEvents , module Network.AWS.CloudTrail.StartLogging , module Network.AWS.CloudTrail.StopLogging , module Network.AWS.CloudTrail.Types @@ -30,6 +31,7 @@ import Network.AWS.CloudTrail.DeleteTrail import Network.AWS.CloudTrail.DescribeTrails import Network.AWS.CloudTrail.GetTrailStatus +import Network.AWS.CloudTrail.LookupEvents import Network.AWS.CloudTrail.StartLogging import Network.AWS.CloudTrail.StopLogging import Network.AWS.CloudTrail.Types diff --git a/gen/Network/AWS/CloudTrail/LookupEvents.hs b/gen/Network/AWS/CloudTrail/LookupEvents.hs new file mode 100644 --- /dev/null +++ b/gen/Network/AWS/CloudTrail/LookupEvents.hs @@ -0,0 +1,191 @@ +{-# LANGUAGE DataKinds #-} +{-# LANGUAGE DeriveGeneric #-} +{-# LANGUAGE FlexibleInstances #-} +{-# LANGUAGE GeneralizedNewtypeDeriving #-} +{-# LANGUAGE LambdaCase #-} +{-# LANGUAGE NoImplicitPrelude #-} +{-# LANGUAGE OverloadedStrings #-} +{-# LANGUAGE RecordWildCards #-} +{-# LANGUAGE TypeFamilies #-} + +{-# OPTIONS_GHC -fno-warn-unused-imports #-} + +-- Module : Network.AWS.CloudTrail.LookupEvents +-- Copyright : (c) 2013-2014 Brendan Hay +-- License : This Source Code Form is subject to the terms of +-- the Mozilla Public License, v. 2.0. +-- A copy of the MPL can be found in the LICENSE file or +-- you can obtain it at http://mozilla.org/MPL/2.0/. +-- Maintainer : Brendan Hay +-- Stability : experimental +-- Portability : non-portable (GHC extensions) +-- +-- Derived from AWS service descriptions, licensed under Apache 2.0. + +-- | Looks up API activity events captured by CloudTrail that create, update, or +-- delete resources in your account. Events for a region can be looked up for +-- the times in which you had CloudTrail turned on in that region during the +-- last seven days. Lookup supports five different attributes: time range +-- (defined by a start time and end time), user name, event name, resource type, +-- and resource name. All attributes are optional. The maximum number of +-- attributes that can be specified in any one lookup request are time range and +-- one other attribute. The default number of results returned is 10, with a +-- maximum of 50 possible. The response includes a token that you can use to get +-- the next page of results. The rate of lookup requests is limited to one per +-- second per account. +-- +-- Events that occurred during the selected time range will not be available +-- for lookup if CloudTrail logging was not enabled when the events occurred. +-- +-- +module Network.AWS.CloudTrail.LookupEvents + ( + -- * Request + LookupEvents + -- ** Request constructor + , lookupEvents + -- ** Request lenses + , leEndTime + , leLookupAttributes + , leMaxResults + , leNextToken + , leStartTime + + -- * Response + , LookupEventsResponse + -- ** Response constructor + , lookupEventsResponse + -- ** Response lenses + , lerEvents + , lerNextToken + ) where + +import Network.AWS.Prelude +import Network.AWS.Request.JSON +import Network.AWS.CloudTrail.Types +import qualified GHC.Exts + +data LookupEvents = LookupEvents + { _leEndTime :: Maybe POSIX + , _leLookupAttributes :: List "LookupAttributes" LookupAttribute + , _leMaxResults :: Maybe Nat + , _leNextToken :: Maybe Text + , _leStartTime :: Maybe POSIX + } deriving (Eq, Read, Show) + +-- | 'LookupEvents' constructor. +-- +-- The fields accessible through corresponding lenses are: +-- +-- * 'leEndTime' @::@ 'Maybe' 'UTCTime' +-- +-- * 'leLookupAttributes' @::@ ['LookupAttribute'] +-- +-- * 'leMaxResults' @::@ 'Maybe' 'Natural' +-- +-- * 'leNextToken' @::@ 'Maybe' 'Text' +-- +-- * 'leStartTime' @::@ 'Maybe' 'UTCTime' +-- +lookupEvents :: LookupEvents +lookupEvents = LookupEvents + { _leLookupAttributes = mempty + , _leStartTime = Nothing + , _leEndTime = Nothing + , _leMaxResults = Nothing + , _leNextToken = Nothing + } + +-- | Specifies that only events that occur before or at the specified time are +-- returned. If the specified end time is before the specified start time, an +-- error is returned. +leEndTime :: Lens' LookupEvents (Maybe UTCTime) +leEndTime = lens _leEndTime (\s a -> s { _leEndTime = a }) . mapping _Time + +-- | Contains a list of lookup attributes. Currently the list can contain only one +-- item. +leLookupAttributes :: Lens' LookupEvents [LookupAttribute] +leLookupAttributes = + lens _leLookupAttributes (\s a -> s { _leLookupAttributes = a }) + . _List + +-- | The number of events to return. Possible values are 1 through 50. The default +-- is 10. +leMaxResults :: Lens' LookupEvents (Maybe Natural) +leMaxResults = lens _leMaxResults (\s a -> s { _leMaxResults = a }) . mapping _Nat + +-- | The token to use to get the next page of results after a previous API call. +-- This token must be passed in with the same parameters that were specified in +-- the the original call. For example, if the original call specified an +-- AttributeKey of 'Username' with a value of 'root', the call with NextToken +-- should include those same parameters. +leNextToken :: Lens' LookupEvents (Maybe Text) +leNextToken = lens _leNextToken (\s a -> s { _leNextToken = a }) + +-- | Specifies that only events that occur after or at the specified time are +-- returned. If the specified start time is after the specified end time, an +-- error is returned. +leStartTime :: Lens' LookupEvents (Maybe UTCTime) +leStartTime = lens _leStartTime (\s a -> s { _leStartTime = a }) . mapping _Time + +data LookupEventsResponse = LookupEventsResponse + { _lerEvents :: List "Events" Event + , _lerNextToken :: Maybe Text + } deriving (Eq, Read, Show) + +-- | 'LookupEventsResponse' constructor. +-- +-- The fields accessible through corresponding lenses are: +-- +-- * 'lerEvents' @::@ ['Event'] +-- +-- * 'lerNextToken' @::@ 'Maybe' 'Text' +-- +lookupEventsResponse :: LookupEventsResponse +lookupEventsResponse = LookupEventsResponse + { _lerEvents = mempty + , _lerNextToken = Nothing + } + +-- | A list of events returned based on the lookup attributes specified and the +-- CloudTrail event. The events list is sorted by time. The most recent event is +-- listed first. +lerEvents :: Lens' LookupEventsResponse [Event] +lerEvents = lens _lerEvents (\s a -> s { _lerEvents = a }) . _List + +-- | The token to use to get the next page of results after a previous API call. +-- If the token does not appear, there are no more results to return. The token +-- must be passed in with the same parameters as the previous call. For example, +-- if the original call specified an AttributeKey of 'Username' with a value of +-- 'root', the call with NextToken should include those same parameters. +lerNextToken :: Lens' LookupEventsResponse (Maybe Text) +lerNextToken = lens _lerNextToken (\s a -> s { _lerNextToken = a }) + +instance ToPath LookupEvents where + toPath = const "/" + +instance ToQuery LookupEvents where + toQuery = const mempty + +instance ToHeaders LookupEvents + +instance ToJSON LookupEvents where + toJSON LookupEvents{..} = object + [ "LookupAttributes" .= _leLookupAttributes + , "StartTime" .= _leStartTime + , "EndTime" .= _leEndTime + , "MaxResults" .= _leMaxResults + , "NextToken" .= _leNextToken + ] + +instance AWSRequest LookupEvents where + type Sv LookupEvents = CloudTrail + type Rs LookupEvents = LookupEventsResponse + + request = post "LookupEvents" + response = jsonResponse + +instance FromJSON LookupEventsResponse where + parseJSON = withObject "LookupEventsResponse" $ \o -> LookupEventsResponse + <$> o .:? "Events" .!= mempty + <*> o .:? "NextToken" diff --git a/gen/Network/AWS/CloudTrail/Types.hs b/gen/Network/AWS/CloudTrail/Types.hs --- a/gen/Network/AWS/CloudTrail/Types.hs +++ b/gen/Network/AWS/CloudTrail/Types.hs @@ -30,6 +30,16 @@ -- ** Error , JSONError + -- * Event + , Event + , event + , eCloudTrailEvent + , eEventId + , eEventName + , eEventTime + , eResources + , eUsername + -- * Trail , Trail , trail @@ -40,6 +50,21 @@ , tS3BucketName , tS3KeyPrefix , tSnsTopicName + + -- * LookupAttribute + , LookupAttribute + , lookupAttribute + , laAttributeKey + , laAttributeValue + + -- * LookupAttributeKey + , LookupAttributeKey (..) + + -- * Resource + , Resource + , resource + , rResourceName + , rResourceType ) where import Network.AWS.Prelude @@ -87,6 +112,85 @@ | s == 503 = True -- Service Unavailable | otherwise = False +data Event = Event + { _eCloudTrailEvent :: Maybe Text + , _eEventId :: Maybe Text + , _eEventName :: Maybe Text + , _eEventTime :: Maybe POSIX + , _eResources :: List "Resources" Resource + , _eUsername :: Maybe Text + } deriving (Eq, Read, Show) + +-- | 'Event' constructor. +-- +-- The fields accessible through corresponding lenses are: +-- +-- * 'eCloudTrailEvent' @::@ 'Maybe' 'Text' +-- +-- * 'eEventId' @::@ 'Maybe' 'Text' +-- +-- * 'eEventName' @::@ 'Maybe' 'Text' +-- +-- * 'eEventTime' @::@ 'Maybe' 'UTCTime' +-- +-- * 'eResources' @::@ ['Resource'] +-- +-- * 'eUsername' @::@ 'Maybe' 'Text' +-- +event :: Event +event = Event + { _eEventId = Nothing + , _eEventName = Nothing + , _eEventTime = Nothing + , _eUsername = Nothing + , _eResources = mempty + , _eCloudTrailEvent = Nothing + } + +-- | A JSON string that contains a representation of the event returned. +eCloudTrailEvent :: Lens' Event (Maybe Text) +eCloudTrailEvent = lens _eCloudTrailEvent (\s a -> s { _eCloudTrailEvent = a }) + +-- | The CloudTrail ID of the event returned. +eEventId :: Lens' Event (Maybe Text) +eEventId = lens _eEventId (\s a -> s { _eEventId = a }) + +-- | The name of the event returned. +eEventName :: Lens' Event (Maybe Text) +eEventName = lens _eEventName (\s a -> s { _eEventName = a }) + +-- | The date and time of the event returned. +eEventTime :: Lens' Event (Maybe UTCTime) +eEventTime = lens _eEventTime (\s a -> s { _eEventTime = a }) . mapping _Time + +-- | A list of resources referenced by the event returned. +eResources :: Lens' Event [Resource] +eResources = lens _eResources (\s a -> s { _eResources = a }) . _List + +-- | A user name or role name of the requester that called the API in the event +-- returned. +eUsername :: Lens' Event (Maybe Text) +eUsername = lens _eUsername (\s a -> s { _eUsername = a }) + +instance FromJSON Event where + parseJSON = withObject "Event" $ \o -> Event + <$> o .:? "CloudTrailEvent" + <*> o .:? "EventId" + <*> o .:? "EventName" + <*> o .:? "EventTime" + <*> o .:? "Resources" .!= mempty + <*> o .:? "Username" + +instance ToJSON Event where + toJSON Event{..} = object + [ "EventId" .= _eEventId + , "EventName" .= _eEventName + , "EventTime" .= _eEventTime + , "Username" .= _eUsername + , "Resources" .= _eResources + , "CloudTrailEvent" .= _eCloudTrailEvent + ] + data Trail = Trail { _tCloudWatchLogsLogGroupArn :: Maybe Text , _tCloudWatchLogsRoleArn :: Maybe Text @@ -182,4 +286,126 @@ , "IncludeGlobalServiceEvents" .= _tIncludeGlobalServiceEvents , "CloudWatchLogsLogGroupArn" .= _tCloudWatchLogsLogGroupArn , "CloudWatchLogsRoleArn" .= _tCloudWatchLogsRoleArn + ] + +data LookupAttribute = LookupAttribute + { _laAttributeKey :: LookupAttributeKey + , _laAttributeValue :: Text + } deriving (Eq, Read, Show) + +-- | 'LookupAttribute' constructor. +-- +-- The fields accessible through corresponding lenses are: +-- +-- * 'laAttributeKey' @::@ 'LookupAttributeKey' +-- +-- * 'laAttributeValue' @::@ 'Text' +-- +lookupAttribute :: LookupAttributeKey -- ^ 'laAttributeKey' + -> Text -- ^ 'laAttributeValue' + -> LookupAttribute +lookupAttribute p1 p2 = LookupAttribute + { _laAttributeKey = p1 + , _laAttributeValue = p2 + } + +-- | Specifies an attribute on which to filter the events returned. +laAttributeKey :: Lens' LookupAttribute LookupAttributeKey +laAttributeKey = lens _laAttributeKey (\s a -> s { _laAttributeKey = a }) + +-- | Specifies a value for the specified AttributeKey. +laAttributeValue :: Lens' LookupAttribute Text +laAttributeValue = lens _laAttributeValue (\s a -> s { _laAttributeValue = a }) + +instance FromJSON LookupAttribute where + parseJSON = withObject "LookupAttribute" $ \o -> LookupAttribute + <$> o .: "AttributeKey" + <*> o .: "AttributeValue" + +instance ToJSON LookupAttribute where + toJSON LookupAttribute{..} = object + [ "AttributeKey" .= _laAttributeKey + , "AttributeValue" .= _laAttributeValue + ] + +data LookupAttributeKey + = EventId -- ^ EventId + | EventName -- ^ EventName + | ResourceName -- ^ ResourceName + | ResourceType -- ^ ResourceType + | Username -- ^ Username + deriving (Eq, Ord, Read, Show, Generic, Enum) + +instance Hashable LookupAttributeKey + +instance FromText LookupAttributeKey where + parser = takeLowerText >>= \case + "eventid" -> pure EventId + "eventname" -> pure EventName + "resourcename" -> pure ResourceName + "resourcetype" -> pure ResourceType + "username" -> pure Username + e -> fail $ + "Failure parsing LookupAttributeKey from " ++ show e + +instance ToText LookupAttributeKey where + toText = \case + EventId -> "EventId" + EventName -> "EventName" + ResourceName -> "ResourceName" + ResourceType -> "ResourceType" + Username -> "Username" + +instance ToByteString LookupAttributeKey +instance ToHeader LookupAttributeKey +instance ToQuery LookupAttributeKey + +instance FromJSON LookupAttributeKey where + parseJSON = parseJSONText "LookupAttributeKey" + +instance ToJSON LookupAttributeKey where + toJSON = toJSONText + +data Resource = Resource + { _rResourceName :: Maybe Text + , _rResourceType :: Maybe Text + } deriving (Eq, Ord, Read, Show) + +-- | 'Resource' constructor. +-- +-- The fields accessible through corresponding lenses are: +-- +-- * 'rResourceName' @::@ 'Maybe' 'Text' +-- +-- * 'rResourceType' @::@ 'Maybe' 'Text' +-- +resource :: Resource +resource = Resource + { _rResourceType = Nothing + , _rResourceName = Nothing + } + +-- | The name of the resource referenced by the event returned. These are +-- user-created names whose values will depend on the environment. For example, +-- the resource name might be "auto-scaling-test-group" for an Auto Scaling +-- Group or "i-1234567" for an EC2 Instance. +rResourceName :: Lens' Resource (Maybe Text) +rResourceName = lens _rResourceName (\s a -> s { _rResourceName = a }) + +-- | The type of a resource referenced by the event returned. When the resource +-- type cannot be determined, null is returned. Some examples of resource types +-- are: Instance for EC2, Trail for CloudTrail, DBInstance for RDS, and AccessKey +-- for IAM. For a list of resource types supported for event lookup, see . +rResourceType :: Lens' Resource (Maybe Text) +rResourceType = lens _rResourceType (\s a -> s { _rResourceType = a }) + +instance FromJSON Resource where + parseJSON = withObject "Resource" $ \o -> Resource + <$> o .:? "ResourceName" + <*> o .:? "ResourceType" + +instance ToJSON Resource where + toJSON Resource{..} = object + [ "ResourceType" .= _rResourceType + , "ResourceName" .= _rResourceName ]