2026/09/22 - CloudWatch Observability Admin Service - 5 new4 updated api methods
Changes Amazon CloudWatch Omni is now generally available, an AI-powered unified observability for AI agents, applications, and infrastructure. Centralization now supports context graph for multi-account resource discovery, and dataset integrations makes logs available in CloudWatch datasets.
Deletes a dataset integration for the caller's account in the current region. This operation is idempotent; if you submit the same delete more than once, each call succeeds.
See also: AWS API Documentation
Request Syntax
client.delete_dataset_integration(
Arn='string'
)
string
[REQUIRED]
The Amazon Resource Name (ARN) of the dataset integration to delete.
None
Returns the dataset integration for the caller's account in the current region.
See also: AWS API Documentation
Request Syntax
client.get_dataset_integration(
Arn='string'
)
string
[REQUIRED]
The Amazon Resource Name (ARN) of the dataset integration to retrieve.
dict
Response Syntax
{
'Arn': 'string',
'RoleArn': 'string',
'CreatedAt': datetime(2015, 1, 1),
'UpdatedAt': datetime(2015, 1, 1)
}
Response Structure
(dict) --
Arn (string) --
The Amazon Resource Name (ARN) of the dataset integration.
RoleArn (string) --
The Amazon Resource Name (ARN) of the IAM role associated with the dataset integration.
CreatedAt (datetime) --
The timestamp when the dataset integration was created.
UpdatedAt (datetime) --
The timestamp when the dataset integration was last updated.
Updates a dataset integration for the caller's account in the current region. This operation is idempotent; if you submit the same update more than once, each call succeeds.
See also: AWS API Documentation
Request Syntax
client.update_dataset_integration(
Arn='string',
RoleArn='string'
)
string
[REQUIRED]
The Amazon Resource Name (ARN) of the dataset integration to update.
string
[REQUIRED]
The Amazon Resource Name (ARN) of the IAM role to associate with the dataset integration.
dict
Response Syntax
{
'Arn': 'string',
'RoleArn': 'string',
'CreatedAt': datetime(2015, 1, 1),
'UpdatedAt': datetime(2015, 1, 1)
}
Response Structure
(dict) --
Arn (string) --
The Amazon Resource Name (ARN) of the updated dataset integration.
RoleArn (string) --
The Amazon Resource Name (ARN) of the IAM role associated with the updated dataset integration.
CreatedAt (datetime) --
The timestamp when the dataset integration was created.
UpdatedAt (datetime) --
The timestamp when the dataset integration was last updated.
Returns the dataset integrations in your account.
See also: AWS API Documentation
Request Syntax
client.list_dataset_integrations(
MaxResults=123,
NextToken='string'
)
integer
The maximum number of results to return in a single call.
string
The token for the next set of results. A previous call generates this token.
dict
Response Syntax
{
'DatasetIntegrationSummaries': [
{
'Arn': 'string',
'RoleArn': 'string',
'CreatedAt': datetime(2015, 1, 1),
'UpdatedAt': datetime(2015, 1, 1)
},
],
'NextToken': 'string'
}
Response Structure
(dict) --
DatasetIntegrationSummaries (list) --
The dataset integrations in your account.
(dict) --
Contains summary information about a dataset integration, including its ARN, associated IAM role, and creation and update timestamps, as returned by ListDatasetIntegrations.
Arn (string) --
The Amazon Resource Name (ARN) of the dataset integration.
RoleArn (string) --
The Amazon Resource Name (ARN) of the IAM role associated with the dataset integration.
CreatedAt (datetime) --
The timestamp when the dataset integration was created.
UpdatedAt (datetime) --
The timestamp when the dataset integration was last updated.
NextToken (string) --
A token to resume pagination of results.
Creates a dataset integration for the caller's account in the current region and returns its ARN.
To use this operation, you must have permission to access the dataset integration resources through the IAM role specified in the RoleArn parameter.
If a dataset integration already exists for the account, this operation fails with a ConflictException.
See also: AWS API Documentation
Request Syntax
client.create_dataset_integration(
RoleArn='string',
Tags={
'string': 'string'
}
)
string
[REQUIRED]
The Amazon Resource Name (ARN) of the IAM role that grants Amazon CloudWatch permission to access the resources needed for the dataset integration.
dict
The key-value pairs to associate with the dataset integration resource for categorization and management purposes.
(string) --
(string) --
dict
Response Syntax
{
'Arn': 'string',
'RoleArn': 'string',
'CreatedAt': datetime(2015, 1, 1),
'UpdatedAt': datetime(2015, 1, 1)
}
Response Structure
(dict) --
Arn (string) --
The Amazon Resource Name (ARN) of the created dataset integration.
RoleArn (string) --
The Amazon Resource Name (ARN) of the IAM role associated with the dataset integration.
CreatedAt (datetime) --
The timestamp when the dataset integration was created.
UpdatedAt (datetime) --
The timestamp when the dataset integration was last updated.
{'Rule': {'Source': {'SourceContextGraphConfiguration': {}}}}
Creates a centralization rule that applies across an Amazon Web Services Organization. This operation can only be called by the organization's management account or a delegated administrator account.
See also: AWS API Documentation
Request Syntax
client.create_centralization_rule_for_organization(
RuleName='string',
Rule={
'Source': {
'Regions': [
'string',
],
'Scope': 'string',
'SourceLogsConfiguration': {
'LogGroupSelectionCriteria': 'string',
'DataSourceSelectionCriteria': 'string',
'EncryptedLogGroupStrategy': 'ALLOW'|'SKIP'
},
'SourceMetricsConfiguration': {
'MetricsSelectionCriteria': 'string'
},
'SourceContextGraphConfiguration': {}
},
'Destination': {
'Region': 'string',
'Account': 'string',
'DestinationLogsConfiguration': {
'LogsEncryptionConfiguration': {
'EncryptionStrategy': 'CUSTOMER_MANAGED'|'AWS_OWNED',
'KmsKeyArn': 'string',
'EncryptionConflictResolutionStrategy': 'ALLOW'|'SKIP',
'EncryptionScope': 'ENCRYPTED_SOURCE_ONLY'|'NEW_DESTINATION_LOG_GROUPS'
},
'BackupConfiguration': {
'Region': 'string',
'KmsKeyArn': 'string'
},
'LogGroupNameConfiguration': {
'LogGroupNamePattern': 'string'
},
'TagPropagationConfiguration': {
'DestinationRoleArn': 'string',
'TagConflictResolutionStrategy': 'IN_SYNC'|'ADD_ONLY'|'UPDATE_SYNC'
}
},
'DestinationMetricsConfiguration': {
'BackupConfiguration': {
'Region': 'string'
}
}
}
},
Tags={
'string': 'string'
}
)
string
[REQUIRED]
A unique name for the organization-wide centralization rule being created.
dict
[REQUIRED]
The configuration details for the organization-wide centralization rule, including the source configuration and the destination configuration to centralize telemetry data across the organization.
Source (dict) -- [REQUIRED]
Configuration determining the source of the telemetry data to be centralized.
Regions (list) -- [REQUIRED]
The list of source regions from which telemetry data should be centralized.
(string) --
Scope (string) --
The organizational scope from which telemetry data should be centralized, specified using organization id, accounts or organizational unit ids.
SourceLogsConfiguration (dict) --
Log specific configuration for centralization source log groups.
LogGroupSelectionCriteria (string) --
The selection criteria that specifies which source log groups to centralize. The selection criteria uses the same format as OAM link filters.
DataSourceSelectionCriteria (string) --
The selection criteria that specifies which data sources to centralize. The selection criteria uses the same filter expression format as LogGroupSelectionCriteria, but operates on DataSourceName and DataSourceType operands. When both LogGroupSelectionCriteria and DataSourceSelectionCriteria are specified, a log event must match both criteria to be centralized.
EncryptedLogGroupStrategy (string) -- [REQUIRED]
A strategy determining whether to centralize source log groups that are encrypted with customer managed KMS keys (CMK). ALLOW will consider CMK encrypted source log groups for centralization while SKIP will skip CMK encrypted source log groups from centralization.
SourceMetricsConfiguration (dict) --
Metric specific configuration for centralization source metrics.
MetricsSelectionCriteria (string) --
The filter expression that selects which source metrics to centralize. Currently, only * (all metrics) is supported. Other values return a validation error.
SourceContextGraphConfiguration (dict) --
Configuration that enables centralization of the context graph for the selected sources. Including this configuration in a rule's source opts the rule into centralizing the context graph for the selected sources.
Destination (dict) -- [REQUIRED]
Configuration determining where the telemetry data should be centralized, backed up, as well as encryption configuration for the primary and backup destinations.
Region (string) -- [REQUIRED]
The primary destination region to which telemetry data should be centralized.
Account (string) --
The destination account (within the organization) to which the telemetry data should be centralized.
DestinationLogsConfiguration (dict) --
Log specific configuration for centralization destination log groups.
LogsEncryptionConfiguration (dict) --
The encryption configuration for centralization destination log groups.
EncryptionStrategy (string) -- [REQUIRED]
Configuration that determines the encryption strategy of the destination log groups. CUSTOMER_MANAGED uses the configured KmsKeyArn to encrypt newly created destination log groups.
KmsKeyArn (string) --
KMS Key ARN belonging to the primary destination account and region, to encrypt newly created central log groups in the primary destination.
EncryptionConflictResolutionStrategy (string) --
Conflict resolution strategy for centralization if the encryption strategy is set to CUSTOMER_MANAGED and the destination log group is encrypted with an AWS_OWNED KMS Key. ALLOW lets centralization go through while SKIP prevents centralization into the destination log group.
EncryptionScope (string) --
Determines which newly created destination log groups are encrypted with the configured KmsKeyArn when EncryptionStrategy is CUSTOMER_MANAGED.
If you set this to ENCRYPTED_SOURCE_ONLY (the default), only destination log groups whose source log group is encrypted with a customer managed KMS key use the configured KmsKeyArn. Destination log groups derived from Amazon Web Services owned encrypted source log groups remain Amazon Web Services owned encrypted.
If you set this to NEW_DESTINATION_LOG_GROUPS, every new destination log group created by this rule uses the configured KmsKeyArn, regardless of the source log group's encryption posture.
This field is not valid when EncryptionStrategy is AWS_OWNED.
BackupConfiguration (dict) --
Configuration defining the backup region and an optional KMS key for the backup destination.
Region (string) -- [REQUIRED]
Logs specific backup destination region within the primary destination account to which log data should be centralized.
KmsKeyArn (string) --
KMS Key ARN belonging to the primary destination account and backup region, to encrypt newly created central log groups in the backup destination.
LogGroupNameConfiguration (dict) --
Configuration that specifies a naming pattern for destination log groups created during centralization. The pattern supports static text and dynamic variables that are replaced with source attributes when log groups are created.
LogGroupNamePattern (string) -- [REQUIRED]
The pattern used to generate destination log group names during centralization. The pattern can contain static text and dynamic variables that are replaced with source attributes. If a variable cannot be resolved, it inherits the value from its parent variable in the hierarchy. The pattern must be between 1 and 512 characters.
Supported variables:
${source.logGroup} — The original log group name from the source account.
${source.accountId} — The Amazon Web Services account ID where the log originated.
${source.region} — The Amazon Web Services Region where the log originated.
${source.org.id} — The Amazon Web Services Organization ID of the source account.
${source.org.ouId} — The organizational unit ID of the source account.
${source.org.rootId} — The organization Root ID.
${source.org.path} — The organizational path from account to root.
TagPropagationConfiguration (dict) --
Specifies the tag propagation configuration for this centralization rule. When present, LogGroupNameConfiguration must use a LogGroupNamePattern that contains ${source.logGroup}, ${source.accountId}, and ${source.region}.
DestinationRoleArn (string) -- [REQUIRED]
The ARN of a customer-managed IAM role in the destination account. The service assumes this role to propagate tags to destination log groups. You must have iam:PassRole permission on this role.
TagConflictResolutionStrategy (string) --
The strategy for resolving conflicts when a tag key exists on both the source and destination log groups. If not specified, defaults to UPDATE_SYNC.
ADD_ONLY – Only adds new tags from the source without modifying existing destination tags.
UPDATE_SYNC – Adds new tags and updates existing tags from the source. Does not remove destination tags that are absent from the source.
IN_SYNC – Keeps destination tags fully synchronized with source tags, including removing destination tags that do not exist on the source.
DestinationMetricsConfiguration (dict) --
Metric specific configuration for centralization destination metrics.
BackupConfiguration (dict) --
Configuration defining the backup region for the metrics backup destination.
Region (string) -- [REQUIRED]
Metrics specific backup destination region within the primary destination account to which metrics data should be centralized.
dict
The key-value pairs to associate with the organization telemetry rule resource for categorization and management purposes.
(string) --
(string) --
dict
Response Syntax
{
'RuleArn': 'string'
}
Response Structure
(dict) --
RuleArn (string) --
The Amazon Resource Name (ARN) of the created organization centralization rule.
{'CentralizationRule': {'Source': {'SourceContextGraphConfiguration': {}}},
'ContextGraphStatus': 'Healthy | Unhealthy | Provisioning'}
Retrieves the details of a specific organization centralization rule. This operation can only be called by the organization's management account or a delegated administrator account.
See also: AWS API Documentation
Request Syntax
client.get_centralization_rule_for_organization(
RuleIdentifier='string'
)
string
[REQUIRED]
The identifier (name or ARN) of the organization centralization rule to retrieve.
dict
Response Syntax
{
'RuleName': 'string',
'RuleArn': 'string',
'CreatorAccountId': 'string',
'CreatedTimeStamp': 123,
'CreatedRegion': 'string',
'LastUpdateTimeStamp': 123,
'RuleHealth': 'Healthy'|'Unhealthy'|'Provisioning',
'FailureReason': 'TRUSTED_ACCESS_NOT_ENABLED'|'DESTINATION_ACCOUNT_NOT_IN_ORGANIZATION'|'INTERNAL_SERVER_ERROR',
'TagPropagationStatus': 'Healthy'|'Unhealthy',
'TagPropagationFailureReason': 'RoleNotAssumable'|'RoleLacksPermissions',
'ContextGraphStatus': 'Healthy'|'Unhealthy'|'Provisioning',
'CentralizationRule': {
'Source': {
'Regions': [
'string',
],
'Scope': 'string',
'SourceLogsConfiguration': {
'LogGroupSelectionCriteria': 'string',
'DataSourceSelectionCriteria': 'string',
'EncryptedLogGroupStrategy': 'ALLOW'|'SKIP'
},
'SourceMetricsConfiguration': {
'MetricsSelectionCriteria': 'string'
},
'SourceContextGraphConfiguration': {}
},
'Destination': {
'Region': 'string',
'Account': 'string',
'DestinationLogsConfiguration': {
'LogsEncryptionConfiguration': {
'EncryptionStrategy': 'CUSTOMER_MANAGED'|'AWS_OWNED',
'KmsKeyArn': 'string',
'EncryptionConflictResolutionStrategy': 'ALLOW'|'SKIP',
'EncryptionScope': 'ENCRYPTED_SOURCE_ONLY'|'NEW_DESTINATION_LOG_GROUPS'
},
'BackupConfiguration': {
'Region': 'string',
'KmsKeyArn': 'string'
},
'LogGroupNameConfiguration': {
'LogGroupNamePattern': 'string'
},
'TagPropagationConfiguration': {
'DestinationRoleArn': 'string',
'TagConflictResolutionStrategy': 'IN_SYNC'|'ADD_ONLY'|'UPDATE_SYNC'
}
},
'DestinationMetricsConfiguration': {
'BackupConfiguration': {
'Region': 'string'
}
}
}
}
}
Response Structure
(dict) --
RuleName (string) --
The name of the organization centralization rule.
RuleArn (string) --
The Amazon Resource Name (ARN) of the organization centralization rule.
CreatorAccountId (string) --
The Amazon Web Services Account that created the organization centralization rule.
CreatedTimeStamp (integer) --
The timestamp when the organization centralization rule was created.
CreatedRegion (string) --
The Amazon Web Services region where the organization centralization rule was created.
LastUpdateTimeStamp (integer) --
The timestamp when the organization centralization rule was last updated.
RuleHealth (string) --
The health status of the organization centralization rule.
FailureReason (string) --
The reason why an organization centralization rule is marked UNHEALTHY.
TagPropagationStatus (string) --
The health status of tag propagation for this rule. This status is independent of the overall RuleHealth for log delivery. Returns Healthy when the most recent tag-propagation attempt succeeded, or Unhealthy when the most recent attempt failed.
TagPropagationFailureReason (string) --
The reason tag propagation is unhealthy for this rule. Only present when TagPropagationStatus is Unhealthy.
ContextGraphStatus (string) --
The status of context graph centralization for this rule. Returns Provisioning while the context graph is being set up, Healthy once it is active, or Unhealthy if provisioning failed. This status is independent of the overall RuleHealth for log delivery.
CentralizationRule (dict) --
The configuration details for the organization centralization rule.
Source (dict) --
Configuration determining the source of the telemetry data to be centralized.
Regions (list) --
The list of source regions from which telemetry data should be centralized.
(string) --
Scope (string) --
The organizational scope from which telemetry data should be centralized, specified using organization id, accounts or organizational unit ids.
SourceLogsConfiguration (dict) --
Log specific configuration for centralization source log groups.
LogGroupSelectionCriteria (string) --
The selection criteria that specifies which source log groups to centralize. The selection criteria uses the same format as OAM link filters.
DataSourceSelectionCriteria (string) --
The selection criteria that specifies which data sources to centralize. The selection criteria uses the same filter expression format as LogGroupSelectionCriteria, but operates on DataSourceName and DataSourceType operands. When both LogGroupSelectionCriteria and DataSourceSelectionCriteria are specified, a log event must match both criteria to be centralized.
EncryptedLogGroupStrategy (string) --
A strategy determining whether to centralize source log groups that are encrypted with customer managed KMS keys (CMK). ALLOW will consider CMK encrypted source log groups for centralization while SKIP will skip CMK encrypted source log groups from centralization.
SourceMetricsConfiguration (dict) --
Metric specific configuration for centralization source metrics.
MetricsSelectionCriteria (string) --
The filter expression that selects which source metrics to centralize. Currently, only * (all metrics) is supported. Other values return a validation error.
SourceContextGraphConfiguration (dict) --
Configuration that enables centralization of the context graph for the selected sources. Including this configuration in a rule's source opts the rule into centralizing the context graph for the selected sources.
Destination (dict) --
Configuration determining where the telemetry data should be centralized, backed up, as well as encryption configuration for the primary and backup destinations.
Region (string) --
The primary destination region to which telemetry data should be centralized.
Account (string) --
The destination account (within the organization) to which the telemetry data should be centralized.
DestinationLogsConfiguration (dict) --
Log specific configuration for centralization destination log groups.
LogsEncryptionConfiguration (dict) --
The encryption configuration for centralization destination log groups.
EncryptionStrategy (string) --
Configuration that determines the encryption strategy of the destination log groups. CUSTOMER_MANAGED uses the configured KmsKeyArn to encrypt newly created destination log groups.
KmsKeyArn (string) --
KMS Key ARN belonging to the primary destination account and region, to encrypt newly created central log groups in the primary destination.
EncryptionConflictResolutionStrategy (string) --
Conflict resolution strategy for centralization if the encryption strategy is set to CUSTOMER_MANAGED and the destination log group is encrypted with an AWS_OWNED KMS Key. ALLOW lets centralization go through while SKIP prevents centralization into the destination log group.
EncryptionScope (string) --
Determines which newly created destination log groups are encrypted with the configured KmsKeyArn when EncryptionStrategy is CUSTOMER_MANAGED.
If you set this to ENCRYPTED_SOURCE_ONLY (the default), only destination log groups whose source log group is encrypted with a customer managed KMS key use the configured KmsKeyArn. Destination log groups derived from Amazon Web Services owned encrypted source log groups remain Amazon Web Services owned encrypted.
If you set this to NEW_DESTINATION_LOG_GROUPS, every new destination log group created by this rule uses the configured KmsKeyArn, regardless of the source log group's encryption posture.
This field is not valid when EncryptionStrategy is AWS_OWNED.
BackupConfiguration (dict) --
Configuration defining the backup region and an optional KMS key for the backup destination.
Region (string) --
Logs specific backup destination region within the primary destination account to which log data should be centralized.
KmsKeyArn (string) --
KMS Key ARN belonging to the primary destination account and backup region, to encrypt newly created central log groups in the backup destination.
LogGroupNameConfiguration (dict) --
Configuration that specifies a naming pattern for destination log groups created during centralization. The pattern supports static text and dynamic variables that are replaced with source attributes when log groups are created.
LogGroupNamePattern (string) --
The pattern used to generate destination log group names during centralization. The pattern can contain static text and dynamic variables that are replaced with source attributes. If a variable cannot be resolved, it inherits the value from its parent variable in the hierarchy. The pattern must be between 1 and 512 characters.
Supported variables:
${source.logGroup} — The original log group name from the source account.
${source.accountId} — The Amazon Web Services account ID where the log originated.
${source.region} — The Amazon Web Services Region where the log originated.
${source.org.id} — The Amazon Web Services Organization ID of the source account.
${source.org.ouId} — The organizational unit ID of the source account.
${source.org.rootId} — The organization Root ID.
${source.org.path} — The organizational path from account to root.
TagPropagationConfiguration (dict) --
Specifies the tag propagation configuration for this centralization rule. When present, LogGroupNameConfiguration must use a LogGroupNamePattern that contains ${source.logGroup}, ${source.accountId}, and ${source.region}.
DestinationRoleArn (string) --
The ARN of a customer-managed IAM role in the destination account. The service assumes this role to propagate tags to destination log groups. You must have iam:PassRole permission on this role.
TagConflictResolutionStrategy (string) --
The strategy for resolving conflicts when a tag key exists on both the source and destination log groups. If not specified, defaults to UPDATE_SYNC.
ADD_ONLY – Only adds new tags from the source without modifying existing destination tags.
UPDATE_SYNC – Adds new tags and updates existing tags from the source. Does not remove destination tags that are absent from the source.
IN_SYNC – Keeps destination tags fully synchronized with source tags, including removing destination tags that do not exist on the source.
DestinationMetricsConfiguration (dict) --
Metric specific configuration for centralization destination metrics.
BackupConfiguration (dict) --
Configuration defining the backup region for the metrics backup destination.
Region (string) --
Metrics specific backup destination region within the primary destination account to which metrics data should be centralized.
{'CentralizationRuleSummaries': {'ContextGraphStatus': 'Healthy | Unhealthy | '
'Provisioning'}}
Lists all centralization rules in your organization. This operation can only be called by the organization's management account or a delegated administrator account.
See also: AWS API Documentation
Request Syntax
client.list_centralization_rules_for_organization(
RuleNamePrefix='string',
AllRegions=True|False,
MaxResults=123,
NextToken='string'
)
string
A string to filter organization centralization rules whose names begin with the specified prefix.
boolean
A flag determining whether to return organization centralization rules from all regions or only the current region.
integer
The maximum number of organization centralization rules to return in a single call.
string
The token for the next set of results. A previous call generates this token.
dict
Response Syntax
{
'CentralizationRuleSummaries': [
{
'RuleName': 'string',
'RuleArn': 'string',
'CreatorAccountId': 'string',
'CreatedTimeStamp': 123,
'CreatedRegion': 'string',
'LastUpdateTimeStamp': 123,
'RuleHealth': 'Healthy'|'Unhealthy'|'Provisioning',
'FailureReason': 'TRUSTED_ACCESS_NOT_ENABLED'|'DESTINATION_ACCOUNT_NOT_IN_ORGANIZATION'|'INTERNAL_SERVER_ERROR',
'TagPropagationStatus': 'Healthy'|'Unhealthy',
'TagPropagationFailureReason': 'RoleNotAssumable'|'RoleLacksPermissions',
'ContextGraphStatus': 'Healthy'|'Unhealthy'|'Provisioning',
'DestinationAccountId': 'string',
'DestinationRegion': 'string'
},
],
'NextToken': 'string'
}
Response Structure
(dict) --
CentralizationRuleSummaries (list) --
A list of centralization rule summaries.
(dict) --
A summary of a centralization rule's key properties and status.
RuleName (string) --
The name of the organization centralization rule.
RuleArn (string) --
The Amazon Resource Name (ARN) of the organization centralization rule.
CreatorAccountId (string) --
The Amazon Web Services Account that created the organization centralization rule.
CreatedTimeStamp (integer) --
The timestamp when the organization centralization rule was created.
CreatedRegion (string) --
The Amazon Web Services region where the organization centralization rule was created.
LastUpdateTimeStamp (integer) --
The timestamp when the organization centralization rule was last updated.
RuleHealth (string) --
The health status of the organization centralization rule.
FailureReason (string) --
The reason why an organization centralization rule is marked UNHEALTHY.
TagPropagationStatus (string) --
The health status of tag propagation for this rule. This status is independent of the overall RuleHealth for log delivery. Returns Healthy when the most recent tag-propagation attempt succeeded, or Unhealthy when the most recent attempt failed.
TagPropagationFailureReason (string) --
The reason tag propagation is unhealthy for this rule. Only present when TagPropagationStatus is Unhealthy.
ContextGraphStatus (string) --
The status of context graph centralization for this rule. Returns Provisioning while the context graph is being set up, Healthy once it is active, or Unhealthy if provisioning failed. This status is independent of the overall RuleHealth for log delivery.
DestinationAccountId (string) --
The primary destination account of the organization centralization rule.
DestinationRegion (string) --
The primary destination region of the organization centralization rule.
NextToken (string) --
A token to resume pagination of results.
{'Rule': {'Source': {'SourceContextGraphConfiguration': {}}}}
Updates an existing centralization rule that applies across an Amazon Web Services Organization. This operation can only be called by the organization's management account or a delegated administrator account.
See also: AWS API Documentation
Request Syntax
client.update_centralization_rule_for_organization(
RuleIdentifier='string',
Rule={
'Source': {
'Regions': [
'string',
],
'Scope': 'string',
'SourceLogsConfiguration': {
'LogGroupSelectionCriteria': 'string',
'DataSourceSelectionCriteria': 'string',
'EncryptedLogGroupStrategy': 'ALLOW'|'SKIP'
},
'SourceMetricsConfiguration': {
'MetricsSelectionCriteria': 'string'
},
'SourceContextGraphConfiguration': {}
},
'Destination': {
'Region': 'string',
'Account': 'string',
'DestinationLogsConfiguration': {
'LogsEncryptionConfiguration': {
'EncryptionStrategy': 'CUSTOMER_MANAGED'|'AWS_OWNED',
'KmsKeyArn': 'string',
'EncryptionConflictResolutionStrategy': 'ALLOW'|'SKIP',
'EncryptionScope': 'ENCRYPTED_SOURCE_ONLY'|'NEW_DESTINATION_LOG_GROUPS'
},
'BackupConfiguration': {
'Region': 'string',
'KmsKeyArn': 'string'
},
'LogGroupNameConfiguration': {
'LogGroupNamePattern': 'string'
},
'TagPropagationConfiguration': {
'DestinationRoleArn': 'string',
'TagConflictResolutionStrategy': 'IN_SYNC'|'ADD_ONLY'|'UPDATE_SYNC'
}
},
'DestinationMetricsConfiguration': {
'BackupConfiguration': {
'Region': 'string'
}
}
}
}
)
string
[REQUIRED]
The identifier (name or ARN) of the organization centralization rule to update.
dict
[REQUIRED]
The configuration details for the organization-wide centralization rule, including the source configuration and the destination configuration to centralize telemetry data across the organization.
Source (dict) -- [REQUIRED]
Configuration determining the source of the telemetry data to be centralized.
Regions (list) -- [REQUIRED]
The list of source regions from which telemetry data should be centralized.
(string) --
Scope (string) --
The organizational scope from which telemetry data should be centralized, specified using organization id, accounts or organizational unit ids.
SourceLogsConfiguration (dict) --
Log specific configuration for centralization source log groups.
LogGroupSelectionCriteria (string) --
The selection criteria that specifies which source log groups to centralize. The selection criteria uses the same format as OAM link filters.
DataSourceSelectionCriteria (string) --
The selection criteria that specifies which data sources to centralize. The selection criteria uses the same filter expression format as LogGroupSelectionCriteria, but operates on DataSourceName and DataSourceType operands. When both LogGroupSelectionCriteria and DataSourceSelectionCriteria are specified, a log event must match both criteria to be centralized.
EncryptedLogGroupStrategy (string) -- [REQUIRED]
A strategy determining whether to centralize source log groups that are encrypted with customer managed KMS keys (CMK). ALLOW will consider CMK encrypted source log groups for centralization while SKIP will skip CMK encrypted source log groups from centralization.
SourceMetricsConfiguration (dict) --
Metric specific configuration for centralization source metrics.
MetricsSelectionCriteria (string) --
The filter expression that selects which source metrics to centralize. Currently, only * (all metrics) is supported. Other values return a validation error.
SourceContextGraphConfiguration (dict) --
Configuration that enables centralization of the context graph for the selected sources. Including this configuration in a rule's source opts the rule into centralizing the context graph for the selected sources.
Destination (dict) -- [REQUIRED]
Configuration determining where the telemetry data should be centralized, backed up, as well as encryption configuration for the primary and backup destinations.
Region (string) -- [REQUIRED]
The primary destination region to which telemetry data should be centralized.
Account (string) --
The destination account (within the organization) to which the telemetry data should be centralized.
DestinationLogsConfiguration (dict) --
Log specific configuration for centralization destination log groups.
LogsEncryptionConfiguration (dict) --
The encryption configuration for centralization destination log groups.
EncryptionStrategy (string) -- [REQUIRED]
Configuration that determines the encryption strategy of the destination log groups. CUSTOMER_MANAGED uses the configured KmsKeyArn to encrypt newly created destination log groups.
KmsKeyArn (string) --
KMS Key ARN belonging to the primary destination account and region, to encrypt newly created central log groups in the primary destination.
EncryptionConflictResolutionStrategy (string) --
Conflict resolution strategy for centralization if the encryption strategy is set to CUSTOMER_MANAGED and the destination log group is encrypted with an AWS_OWNED KMS Key. ALLOW lets centralization go through while SKIP prevents centralization into the destination log group.
EncryptionScope (string) --
Determines which newly created destination log groups are encrypted with the configured KmsKeyArn when EncryptionStrategy is CUSTOMER_MANAGED.
If you set this to ENCRYPTED_SOURCE_ONLY (the default), only destination log groups whose source log group is encrypted with a customer managed KMS key use the configured KmsKeyArn. Destination log groups derived from Amazon Web Services owned encrypted source log groups remain Amazon Web Services owned encrypted.
If you set this to NEW_DESTINATION_LOG_GROUPS, every new destination log group created by this rule uses the configured KmsKeyArn, regardless of the source log group's encryption posture.
This field is not valid when EncryptionStrategy is AWS_OWNED.
BackupConfiguration (dict) --
Configuration defining the backup region and an optional KMS key for the backup destination.
Region (string) -- [REQUIRED]
Logs specific backup destination region within the primary destination account to which log data should be centralized.
KmsKeyArn (string) --
KMS Key ARN belonging to the primary destination account and backup region, to encrypt newly created central log groups in the backup destination.
LogGroupNameConfiguration (dict) --
Configuration that specifies a naming pattern for destination log groups created during centralization. The pattern supports static text and dynamic variables that are replaced with source attributes when log groups are created.
LogGroupNamePattern (string) -- [REQUIRED]
The pattern used to generate destination log group names during centralization. The pattern can contain static text and dynamic variables that are replaced with source attributes. If a variable cannot be resolved, it inherits the value from its parent variable in the hierarchy. The pattern must be between 1 and 512 characters.
Supported variables:
${source.logGroup} — The original log group name from the source account.
${source.accountId} — The Amazon Web Services account ID where the log originated.
${source.region} — The Amazon Web Services Region where the log originated.
${source.org.id} — The Amazon Web Services Organization ID of the source account.
${source.org.ouId} — The organizational unit ID of the source account.
${source.org.rootId} — The organization Root ID.
${source.org.path} — The organizational path from account to root.
TagPropagationConfiguration (dict) --
Specifies the tag propagation configuration for this centralization rule. When present, LogGroupNameConfiguration must use a LogGroupNamePattern that contains ${source.logGroup}, ${source.accountId}, and ${source.region}.
DestinationRoleArn (string) -- [REQUIRED]
The ARN of a customer-managed IAM role in the destination account. The service assumes this role to propagate tags to destination log groups. You must have iam:PassRole permission on this role.
TagConflictResolutionStrategy (string) --
The strategy for resolving conflicts when a tag key exists on both the source and destination log groups. If not specified, defaults to UPDATE_SYNC.
ADD_ONLY – Only adds new tags from the source without modifying existing destination tags.
UPDATE_SYNC – Adds new tags and updates existing tags from the source. Does not remove destination tags that are absent from the source.
IN_SYNC – Keeps destination tags fully synchronized with source tags, including removing destination tags that do not exist on the source.
DestinationMetricsConfiguration (dict) --
Metric specific configuration for centralization destination metrics.
BackupConfiguration (dict) --
Configuration defining the backup region for the metrics backup destination.
Region (string) -- [REQUIRED]
Metrics specific backup destination region within the primary destination account to which metrics data should be centralized.
dict
Response Syntax
{
'RuleArn': 'string'
}
Response Structure
(dict) --
RuleArn (string) --
The Amazon Resource Name (ARN) of the updated organization centralization rule.