cloudwatch_logs.aws.txt

                                  ┏━━━━━━━━━━━━━━━━━━━━━┓
                                  ┃   CLOUDWATCH_LOGS   ┃
                                  ┗━━━━━━━━━━━━━━━━━━━━━┛

VERSION ==>                       #2024-11-22

SUMMARY ==>                       #Log group: prefix, stream, retention, tags
                                  #Events: timestamp, message, encryption, EventBridge
                                  #Live tail: CLI, UI, Pulumi
                                  #Filter pattern: variables, string|JSON|TSV, test
                                  #Transformer
                                  #Metric filter: pattern, default value
                                  #Query: saved, aliases, aggregation, expressions, CloudWatch dashboard
                                  #Query fields: message VARR, LLEVENT.*, service-specific
                                  #Query command: alias, fields|display|parse, filter|sort|limit, dedup, index
                                  #Pattern: command, difference, anomalies detector
                                  #Vended logs: LOG_STREAM|S3|Kinesis, policy, v1|v2
                                  #Subscription: pattern, Lambda|Kinesis, distribution, cross-account
                                  #Export: S3
                                  #Mask: unmask, policy, LOG_GROUP|S3|Kinesis destination, identifier types
                                  #Account policy

                                  ┌─────────┐
                                  │   API   │
                                  └─────────┘

SERVICE_DOMAIN                    #logs.amazonaws.com
                                  #Can use HTTP[S]

FORMAT ==>                        #JSON
                                  #Uses REQ.Action|Version

REQ_ID                            #x-amzn-RequestId [S]

PAGINATION ==>                    #REQ.limit NUM (def|max: 50) + REQ|RES.nextToken except:
                                  #  - def 1e4, max 1e5: StartQuery()
                                  #  - def|max 1e4 or 1MB: FilterLogEvents()
                                  #  - def|max 1e4 and use RES.nextBackwardToken|nextForwardToken: GetLogEvents()
                                  #  - def|max 1e3 and use REQ.maxResults: DescribeQueryDefinitions()
                                  #  - def 50, max 500 and use REQ.maxResults: ListLogGroupsForQuery()
                                  #  - no pagination: DescribeAccountPolicies(), GetLogGroupFields(), TestMetricFilter(),
                                  #    DescribeIndexPolicies(), DescribeFieldIndexes(), ListIntegrations()
                                  #  - pagination but never used due to limit: DescribeExportTasks(), DescribeQueries(),
                                  #    DescribeResourcePolicies()

THROTTLING ==>                    #5000/s (REGION-specific, soft): PutLogEvents()
                                  #50/s (soft): CreateLogStream()
                                  #25/s (REGION-specific): GetLogEvents|FilterLogEvents()
                                  #25/s (soft): DescribeLogStreams()
                                  #15/s (soft): DeleteLogStream()
                                  #10/s (soft): *LogGroup()
                                  #5/s (not soft): all others

PRICING ==>                       #New LLEVENTs: 1$/2GB
                                  #  - free: 5GB
                                  #  - 25% more expensive if DATA_POLICY
                                  #  - 2x cheaper if INFREQUENT_ACCESS
                                  #  - vended logs:
                                  #     - to LOG_STREAM: same price
                                  #        - 2x cheaper after 10TB, 5x after 30TB, 10x after 50TB
                                  #        - INFREQUENT_ACCESS: 3x cheaper after 10TB, 6x cheaper after 30TB, 10x after 50TB
                                  #     - to S3|Kinesis: x2 cheaper
                                  #        - 3x cheaper after 10TB, 6.5x after 30TB, 10x after 50TB
                                  #All LLEVENTs (LOG_GROUP.storedBytes): 1$/33GB
                                  #  - free: 5GB
                                  #  - including vended logs stored in LOG_STREAM (but not in S3|Kinesis)
                                  #Traffic out: same as EC2
                                  #QUERY: 1$/200GB read (QUERY_STATS.bytesScanned)
                                  #  - free: 5GB
                                  #Live tail: 1$/100 minutes
                                  #  - free: 30h/month

                                  ┌──────────┐
                                  │   AUTH   │
                                  └──────────┘

CloudWatchLogsFullAccess          #AWS managed POLICY allowing logs:*
CloudWatchLogsReadOnlyAccess      #Same but readonly

                                  ┌─────────────────┐
                                  │   API METRICS   │
                                  └─────────────────┘

AWS/Logs|Usage/CallCount          #NUM of API calls
AWS/Logs/ErrorCount               #NUM of failed API calls
AWS/Logs/ThrottleCount            #NUM of throttled API calls

DVAR Service                      #Always 'Logs'
                                  #With AWS/Logs|Usage/*Count
DVAR Type                         #Always 'API'
                                  #With AWS/Logs|Usage/*Count
DVAR Resource                     #'ACTION'
                                  #With AWS/Logs|Usage/*Count
DVAR Account metrics              #BOOL. Make METRIC not ACTION-specific, i.e. opposite to DVAR Resource
                                  #With AWS/Logs|Usage/*Count
DVAR Class                        #Always 'None'
                                  #With AWS/Logs|Usage/*Count

DVAR LogGroupName                 #'LOG_GROUP'
                                  #With all except AWS/Logs/*Count|LogEventsWithFindings
                                  #LOG_GROUP is also sent as a metric TELEMETRY_ENTITY

                                  ┌─────────────────────┐
                                  │   API METRICS IAC   │
                                  └─────────────────────┘

CLOG_GROUP.metric
 ('METRIC'[, CMETRIC_OPTS])
 ->CMETRIC                        #Uses statistic 'Sum'

CFACADE.monitorLog
 (CXMONITORING_OPTS)              #See cdk-monitoring-constructs doc
CXMONITORING_OPTS.logGroupName    #'LOG_GROUP'

                                  ┌───────────┐
                                  │   GROUP   │
                                  └───────────┘

LOG_GROUP                         #Group of LOG_STREAMs
                                  #Max 1e6 per REGION
LOG_GROUP.logGroupArn             #LOG_GROUP_ARN. arn:aws:logs:REGION:ACCOUNT_ID:log-group:LOG_GROUP
LOG_GROUP.arn                     #Same but ends with :*, so it can be used as LOG_STREAM_ARN pattern too
LOG_GROUP.logGroupName            #'LOG_GROUP'. Max 512 chars, [[:alnum:]_-/.#]
                                  #Can include a NAMEPATH, often starting|using slashes
                                  #Cannot start with aws/
LOG_GROUP_REQ.logGroupNamePrefix  #STR. Filter logGroupName that start with STR
LOG_GROUP_REQ.logGroupNamePattern #STR. Filter logGroupName that include STR, case-insensitively
LOG_GROUP.creationTime            #DATE_NUM

LOG_GROUP.storedBytes             #Total NUM of bytes stored

LOG_GROUP[_REQ].logGroupClass     #Can be 'STANDARD' (def) or 'INFREQUENT_ACCESS', cheaper but lacks most features:
                                  #  - LLEVENTS_REQ (must use QUERY instead)
                                  #  - pattern|diff COMMANDs, ANOMALYs
                                  #  - METRIC_FILTER
                                  #  - SUBSCRIPTION
                                  #  - EXPORT
                                  #  - TRANSFORMER
                                  #  - INDEX_POLICY
                                  #  - MASK_POLICY
                                  #  - cloudwatch:GenerateQuery
                                  #  - embedded METRICs
                                  #  - Lambda Insights, Containers Insights

                                  ┌───────────────┐
                                  │   GROUP API   │
                                  └───────────────┘

CreateLogGroup()                  #Req:
                                  #  - only logGroupName, kmsKeyId, logGroupClass
                                  #Res: empty
DescribeLogGroups()               #Req LOG_GROUP_REQ
                                  #Res: logGroups LOG_GROUP_ARR
                                  #  - no tags
                                  #  - only arn|logGroupName|creationTime if logGroupNamePattern used
DeleteLogGroup()                  #Req:
                                  #  - only logGroupName
                                  #Res: empty

                                  ┌───────────────┐
                                  │   GROUP CLI   │
                                  └───────────────┘

cw ls groups                      #Like `aws logs describe-log-groups` but only print LOG_GROUP.logGroupName

                                  ┌───────────────┐
                                  │   GROUP IAC   │
                                  └───────────────┘

AWS::Logs::LogGroup               #RESPROPs: LogGroupName, LogGroupClass
                                  #RESATTRs: Arn

new LogGroup(...CARGS[, OPTS])    #CLOG_GROUP. CKRESOURCE wrapping LOG_GROUP
LogGroup.fromLogGroupArn
 (...CARGS, 'LOG_GROUP_ARN')
 ->ICLOG_GROUP                    #
LogGroup.fromLogGroupName
 (...CARGS, 'LOG_GROUP')
 ->ICLOG_GROUP                    #
ICLOG_GROUP.logGroupArn           #LOG_GROUP.arn (not logGroupArn)
OPTS|ICLOG_GROUP.logGroupName
OPTS.logGroupClass                #LOG_GROUP.*
OPTS.removalPolicy                #REMOVAL_POLICY (def: retain)

                                  ┌──────────────────┐
                                  │   GROUP PULUMI   │
                                  └──────────────────┘

LOG_GROUP_RPROPS.namePrefix       #Randomized suffix for LOG_GROUP.logGroupName

                                  ┌───────────────┐
                                  │   RETENTION   │
                                  └───────────────┘

LOG_GROUP.retentionInDays         #NUM (def: none) of days before deleting LLEVENTs, among:
                                  #  - 1|3|5 days
                                  #  - 1-2 weeks
                                  #  - 1-6 months
                                  #  - 1|1.5|2-10 years

                                  ┌───────────────────┐
                                  │   RETENTION API   │
                                  └───────────────────┘

PutRetentionPolicy()              #Req:
                                  #  - only logGroupName, retentionInDays
                                  #Res: empty
DeleteRetentionPolicy()           #Req:
                                  #  - only logGroupName
                                  #Res: empty

                                  ┌───────────────────┐
                                  │   RETENTION IAC   │
                                  └───────────────────┘

AWS::Logs::LogGroup               #Includes RESPROPs: RetentionInDays

CLOG_GROUP_OPTS.retention         #LOG_GROUP.RetentionInDays
                                  #Def: 2y. Must use Infinity for none

new LogRetention(...ARGS, OPTS)   #CLOG_RETENTION. Sets LOG_GROUP.retentionInDays for an already existing LOG_GROUP
                                  #  - as opposed to using new LogGroup() and CLOG_GROUP_OPTS.retentionInDays
                                  #Although meant for already existing LOG_GROUP:
                                  #  - if not, create it
                                  #  - if removalPolicy 'destroy', deletes it on CLOG_RETENTION deletion
                                  #Is a CONSTRUCT wrapping a CUSTOM_RESOURCE with a Lambda FUNC that performs Put|DeleteRetentionPolicy()

CLOG_RETENTION.logGroupArn
OPTS.logGroupName                 #LOG_GROUP.*
OPTS.retention                    #LOG_GROUP.retentionInDays (def: none)
OPTS.logGroupRegion               #'REGION' of LOG_GROUP (def: same as STACK)
OPTS.removalPolicy                #Like CLOG_GROUP_OPTS.*

OPTS.role                         #CROLE used by CUSTOM_RESOURCE's Lambda FUNC
                                  #Def: new one with AWSLambdaBasicExecutionRole
                                  #Automatically allows PACTIONs:
                                  #  - logs:Put|DeleteRetentionPolicy
                                  #  - if OPTS.removalPolicy 'destroy': logs:DeleteLogGroup
OPTS.logRetentionRetryOptions
 .maxRetries                      #NUM (def: 5) of times to retry API requests, with exponential backoff starting at 100ms

                                  ┌────────────────────┐
                                  │   RETENTION LINT   │
                                  └────────────────────┘

cfn-lint-serverless aws_cloudwatch
 _log_group_lambda_retention      #Validate LOG_GROUP.retentionInDays is set
 (WS1004)                         #Only if 'LOG_GROUP' includes a Lambda FUNC name

cdk-nag
 CloudWatchLogGroupEncrypted      #Validate LOG_GROUP.retentionInDays is set

                                  ┌────────────┐
                                  │   STREAM   │
                                  └────────────┘

LOG_STREAM                        #Series of LLEVENTs
                                  #Deleted if empty for 2 months
LOG_STREAM.arn                    #LOG_STREAM_ARN. arn:aws:logs:REGION:ACCOUNT_ID:log-group:LOG_GROUP:log-stream:LOG_STREAM
LOG_STREAM.logStreamName          #'LOG_STREAM'. Max 512 chars, no : or *
LOG_STREAM_REQ.logStreamNamePrefix#STR
LOG_STREAM.creationTime           #DATE_NUM
LOG_STREAM.firstEventTimestamp    #DATE_NUM of earliest LLEVENT
LOG_STREAM.lastIngestionTime      #DATE_NUM of latest LLEVENT starting processing
LOG_STREAM.lastEventTimestamp     #DATE_NUM of latest LLEVENT finishing processing

LOG_STREAM[_REQ].logGroupName     #'LOG_GROUP'
LOG_STREAM_REQ.logGroupIdentifier #'LOG_GROUP'|LOG_GROUP_ARN

LOG_STREAM_REQ.orderBy            #'LogStreamName' (def) or 'LastEventTime'
LOG_STREAM_REQ.descending         #BOOL (def: false). Sorting order

                                  ┌────────────────┐
                                  │   STREAM API   │
                                  └────────────────┘

CreateLogStream()                 #Req: LOG_STREAM
                                  #  - only logStreamName, logGroupName
                                  #Res: empty
DescribeLogStreams()              #Req: LOG_STREAM_REQ
                                  #Res: LogStreams LOG_STREAM_ARR
                                  #  - no logGroupName
DeleteLogStream()                 #Req: LOG_STREAM
                                  #  - only logStreamName, logGroupName
                                  #Res: empty

                                  ┌────────────────┐
                                  │   STREAM CLI   │
                                  └────────────────┘

cw ls streams LOG_GROUP           #Like `aws logs describe-log-streams` but only print LOG_GROUP.logStreamName

                                  ┌────────────────┐
                                  │   STREAM IAC   │
                                  └────────────────┘

AWS::Logs::LogStream              #RESPROPs: LogStreamName, LogGroupName
                                  #With Cloud Control, cannot update (replace only)

new LogStream(...CARGS, OPTS)     #CLOG_STREAM. CKRESOURCE wrapping LOG_STREAM
ICLOG_GROUP.addStream
 ('CLOG_STREAM'[, OPTS])
 ->CLOG_STREAM                    #Same but fills OPTS.logGroup
LogStream.fromLogStreamName
 (...CARGS, 'LOG_STREAM')
 ->ICLOG_STREAM                   #
OPTS|ICLOG_STREAM.logStreamName   #LOG_STREAM.*
OPTS.logGroup                     #ICLOG_GROUP
OPTS.removalPolicy                #REMOVAL_POLICY (def: retain)

                                  ┌────────────┐
                                  │   EVENTS   │
                                  └────────────┘

LLEVENTS.logEvents                #LLEVENT_ARR
                                  #Not logged by CloudTrail
                                  #Max 1e4. Max 1MB
LLEVENT                           #Log message
                                  #CloudWatch Logs storing LLEVENTs internally is called "archiving" by AWS documentation
                                  #Max 256KB
LLEVENT.eventId                   #MID

LLEVENT.message                   #'LMESSAGE'

LLEVENT.ingestionTime             #DATE_NUM of LLEVENT itelf
LLEVENT.timestamp                 #DATE_NUM of event being logged
                                  #Max 14d before ingestionTime, and 2h after it
                                  #LLEVENTS.logEvents is sorted by LLEVENT.timestamp
                                  #  - in request, must be sorted, with a max 24h span
LLEVENTS_REQ.startTime|endTime    #DATE_NUM. Filter by LLEVENT.timestamp
LLEVENTS_REQ.startFromHead        #BOOL (def: true). asc|desc sorting order.
                                  #Always sorted by LLEVENT.timestamp

LLEVENTS_NEW.rejectedLogEventsInfo#LLEVENTS_REJECT. LLEVENTs that failed
LLEVENTS_REJECT
 .tooOldLogEventEndIndex          #NUM of LLEVENTs with a timestamp >14d older than ingestionTime
LLEVENTS_REJECT
 .tooNewLogEventStartIndex        #NUM of LLEVENTs with a timestamp >2h newer than ingestionTime
LLEVENTS_REJECT
 .expiredLogEventEndIndex         #NUM of LLEVENTs beyond LOG_GROUP.retentionInDays

LLEVENTS[_REQ|RES].logStreamName  #'LOG_STREAM'
LLEVENTS_RES.searchedCompletely   #BOOL. Whether all LLEVENTs in LOG_STREAM were searched

LLEVENTS[_REQ].logGroupName       #'LOG_GROUP'
LLEVENTS_REQ.logGroupIdentifier   #'LOG_GROUP'|LOG_GROUP_ARN

LLEVENTS_REQ.filterPattern        #'FILTER_PATTERN'

                                  ┌────────────────┐
                                  │   EVENTS API   │
                                  └────────────────┘

PutLogEvents()                    #Req: LLEVENTS
                                  #  - no LLEVENT.eventId|ingestionTime
                                  #Res: LLEVENTS_NEW
GetLogEvents()                    #Req: LLEVENTS_REQ
                                  #  - no filterPattern, logStreamNamePrefix
                                  #Res: events LLEVENT_ARR
                                  #  - no LLEVENT.eventId
FilterLogEvents()                 #Req: LLEVENTS_REQ
                                  #  - logStreamName STR -> logStreamNames STR_ARR + logStreamNamePrefix STR
                                  #  - no startFromHead
                                  #Res: events LLEVENT_ARR, searchedLogStreams LLEVENTS_RES_ARR

                                  ┌────────────────┐
                                  │   EVENTS CLI   │
                                  └────────────────┘

cdk watch --logs                  #BOOL (def: true). Print CloudWatch Logs LLEVENTs from all RESOURCEs (using FilterLogEvents())
                                  #Trails by polling
                                  #Uses LOG_GROUPs defined in TEMPLATE.Resources.*, either from AWS::Logs::LogGroup or AWS::Lambda::Function
                                  #Requires --watch

                                  ┌────────────────────┐
                                  │   EVENTS SAM CLI   │
                                  └────────────────────┘

sam logs                          #Prints CloudWatch logs in current STACK
                                  #Only for Lambda FUNCTIONs, API Gateway APIs, Step Functions MACHINEs
                                  #Uses FilterLogEvents(), DescribeLogStreams(), ListStackResources()

--cw-log-group                    #'LOG_GROUP' (def: all)
--name|-n                         #'FUNCTION|API|MACHINE' (def: all)
                                  #Also shows logs from other FUNCTION|API|MACHINEs sharing the same LOG_GROUP
                                  #Noop if --cw-log-group

--filter                          #'FILTER_PATTERN' (def: any). LLEVENTS_REQ.filterPattern
                                  #Also highlighted (unless --output 'json')
--start-time|-s                   #'DATE' or words like 'yesterday' or '5mins ago'. LLEVENTS_REQ.startTime
                                  #Def: '10m ago'
--end-time|-e                     #Same for LLEVENTS_REQ.endTime
                                  #Def: now
--tail|-r                         #See below

--output                          #Either 'text' (def) or 'json'

--include-traces|-i               #See SAM CLI doc

                                  ┌───────────────────────┐
                                  │   EVENTS SAM POLICY   │
                                  └───────────────────────┘

FilterLogEventsPolicy             #SAM POLICY_TEMPLATE (see its doc) that allows:
                                  #  - PACTION logs:FilterLogEvents
                                  #  - on 'LOG_GROUP'
                                  #     - using POLICY_TEMPLATE_PARAMS.LogGroupName

                                  ┌────────────────────┐
                                  │   EVENTS TOOLKIT   │
                                  └────────────────────┘

LIST EVENTS ==>                   #Can be done in "Explorer" or as a command, for a given LOG_GROUP or LOG_STREAM
                                  #Paginates with manual "next" button
                                  #  - can configure pagination size (def: 1e4)
                                  #Can filter by date or FILTER_PATTERN (top right icon)
                                  #Can save to file (top right icon)

                                  ┌────────────────────┐
                                  │   EVENTS METRICS   │
                                  └────────────────────┘

AWS/Logs/IncomingLogEvents        #NUM of new LLEVENTs
                                  #cdk-monitoring-constructs:
                                  #  - sum: METRIC, summary WIDGET
AWS/Logs/IncomingBytes            #NUM. Size of new LLEVENTs

                                  ┌───────────────────────┐
                                  │   EVENT METRICS IAC   │
                                  └───────────────────────┘

CLOG_GROUP.metricIncomingLogEvents
 ([METRIC_OPTS])->CMETRIC         #
CLOG_GROUP.metricIncomingBytes
 ([METRIC_OPTS])->CMETRIC         #

                                  ┌──────────────────────────────┐
                                  │   EVENT EVENTBRIDGE TARGET   │
                                  └──────────────────────────────┘

TARGET.Arn                        #'LOG_GROUP_ARN'. Calls PutLogEvents()
                                  #Input is:
                                  #  - STR (LLEVENT.message)
                                  #  - if using INPUT_TRANSFORM: OBJ (LLEVENT.message|timestamp)
                                  #Cannot use TARGET.Input[Path]

PIPE.Target                       #Same except input is always LLEVENT.message
                                  #Max batch size: 1e4 (PutLogEvents()'s limit)
PIPE_DEST.CloudWatchLogsParameters#'LOG_STREAM'. LLEVENTS.logStreamName
 .LogStreamName                   #Cannot be 'JSONPATH'
PIPE_DEST.CloudWatchLogsParameters
 .Timestamp                       #LLEVENT.timestamp (def: now)

                                  ┌───────────────────────────────────┐
                                  │   EVENT EVENTBRIDGE TARGET AUTH   │
                                  └───────────────────────────────────┘

PACTION logs:PutLogEvents         #Must be allowed on LOG_GROUP for:
 |CreateLogStream                 #  - TARGET: using LOG_POLICY (not TARGET.RoleArn)
                                  #     - Principal.Service 'events.amazonaws.com'
                                  #     - COND_KEY aws:SourceArn RULE_ARN
                                  #  - PIPE.RoleArn

                                  ┌──────────────────────────────────┐
                                  │   EVENT EVENTBRIDGE TARGET IAC   │
                                  └──────────────────────────────────┘

AWS::Pipes::Pipe                  #Includes RESPROPs: TargetParameters: CloudWatchLogsParameters

new CloudWatchLogGroup(ICLOG_GROUP#CTARGET
 [, CLOG_GROUP_TARGET_OPTS])      #Adds permissions as described above
                                  #  - instead of using AWS::Logs::ResourcePolicy (which was added too recently),
                                  #    use a CustomResource which calls PutResourcePolicy()
CLOG_GROUP_TARGET_OPTS.*          #CTARGET_OPTS.*
CLOG_GROUP_TARGET_OPTS.logEvent   #CTARGET_INPUT except must use LogGroupTargetInput.fromObjectV2(LLEVENT_OBJ)
                                  #instead of RuleTargetInput.fromObject(OBJ), which:
                                  #  - forces LLEVENT_OBJ.message|timestamp
                                  #  - adds default values '$.detailType' and '$.time' for them

new CloudWatchLogsTarget          #CPIPE_TARGET
 (ICLOG_GROUP[, OPTS])            #Adds permissions as described above
OPTS.inputTransformation          #CPIPE_INPUT
OPTS.logStreamName|timestamp      #PIPE_DEST.CloudWatchLogsParameters.*

                                  ┌────────────┐
                                  │   ENTITY   │
                                  └────────────┘

LLEVENTS.entity
 .keyAttributes|attributes        #OBJ. Same as TELEMETRY_ENTITY.[Key]Attributes.ATTR in CloudWatch metrics (see its doc)

LLEVENTS_NEW.rejectedEntityInfo
 .errorType                       #'ERROR_TYPE' if LLEVENTS.entity.* input is invalid

                                  ┌───────────────┐
                                  │   ENTITY UI   │
                                  └───────────────┘

EXPLORE RELATED ==>               #See CloudWatch metrics doc

                                  ┌─────────────────┐
                                  │   ENTITY AUTH   │
                                  └─────────────────┘

PACTION logs:
 ListEntitiesForLogGroup
 |ListLogGroupsForEntity          #Allows "Explore related" in UI

                                  ┌──────────┐
                                  │   TAIL   │
                                  └──────────┘

TAIL_REQ                          #Stream any incoming LLEVENTs
                                  #Meant for debugging
                                  #Max 15 ongoing sessions (soft limit)
TAIL_REQ.logGroupIdentifiers      #LOG_GROUP_ARN_ARR
                                  #Max 10 items
TAIL_REQ.logStreamNames           #'LOG_STREAM'_ARR
                                  #Max 100 items
TAIL_REQ.logStreamNamePrefixes    #STR_ARR. 'LOG_STREAM' start with any of STR
                                  #Max 100 items
TAIL_REQ.logEventFilterPattern    #'FILTER_PATTERN'

TAIL_RES                          #HTTP stream of TAIL_CHUNKs
                                  #TAIL_CHUNKs are { TYPE: OBJ }
                                  #End:
                                  #  - closed by the client when wants
                                  #  - but server also closes after 3h

TAIL_SESSION_START                #First TAIL_CHUNK with TYPE 'sessionStart'
TAIL_SESSION_START.requestId      #'REQ_ID' of StartLiveTail()
TAIL_SESSION_START.sessionId      #STR. ID of TAIL_RES stream
TAIL_SESSION_START
 .logGroupIdentifiers
 |logStreamNames
 |logStreamNamePrefixes
 |logEventFilterPattern           #Like TAIL_REQ.*

TAIL_SESSION_UPDATE               #TAIL_CHUNK sent every second, with TYPE 'sessionUpdate'
TAIL_SESSION_UPDATE.sessionResults#TAIL_SESSION_RES_ARR
                                  #LLEVENTs since last TAIL_SESSION_UPDATE
                                  #Can be empty. Max 500 items
TAIL_SESSION_RES
 .message|ingestionTime|timestamp #Like LLEVENT.*
TAIL_SESSION_RES
 .logGroupIdentifier|logStreamName#Like LLEVENTS_REQ.*
TAIL_SESSION_UPDATE               #BOOL. True if >500 LLEVENTs were available, i.e. only first ones were picked
 .sessionMetadata.sampled         #Last 10 TAIL_SESSION_UPDATEs are buffered, but are dropped after that

TAIL_TIMEOUT_ERROR                #Last TAIL_CHUNK on timeout
                                  #Empty OBJ with TYPE 'SessionTimeoutException'
TAIL_STREAMING_ERROR              #Last TAIL_CHUNK on other errors
                                  #Empty OBJ with TYPE 'SessionStreamingException'

                                  ┌───────────────┐
                                  │   TAIL AUTH   │
                                  └───────────────┘

PACTION StopLiveTail              #Required for stopping trail in UI

                                  ┌──────────────┐
                                  │   TAIL API   │
                                  └──────────────┘

StartLiveTail()                   #Req: TAIL_REQ
                                  #Res: responseStream TAIL_RES

                                  ┌──────────────┐
                                  │   TAIL SDK   │
                                  └──────────────┘

TAIL_RES                          #ASYNC_ITERABLE of TAIL_CHUNKs
                                  #Must call CLIENT.destroy() to stop

                                  ┌───────────────────┐
                                  │   TAIL CLI MAIN   │
                                  └───────────────────┘

start-live-trail                  #Pros:
                                  #  - multiple LOG_GROUPs
                                  #  - interactive mode

--log-group-identifiers
--log-stream-names
--log-stream-name-prefixes
--log-event-filter-pattern        #Like StartLiveTrail()

--mode                            #Either:
                                  #  - 'print-only' (def)
                                  #  - 'interactive':
                                  #     - can scroll
                                  #     - can search up to 5 words
                                  #     - can switch between JSON and plain text
                                  #     - colors (required)

                                  ┌──────────────────────────┐
                                  │   TAIL CLI ALTERNATIVE   │
                                  └──────────────────────────┘

tail LOG_GROUP                    #Alternative to start-live-trail
                                  #Pros:
                                  #  - can filter by start|end
                                  #  - more format options
                                  #  - can turn off tailing

--follow                          #Whether to tail or not (def)

--log-stream-names
--log-stream-name-prefix
--filter-pattern                  #Like StartLiveTail()

--since DATE|DURATION             #Like FilterLogEvents() startTime
                                  #DURATION is NUM + s|m|h|d|w
                                  #Def: 10m

--format                          #STR among:
                                  #  - detailed (def): long LLEVENT.timestamp|logStreamName|message
                                  #  - short: short LLEVENT.timestamp|message
                                  #  - json: only LLEVENT.message, as JSON

                                  ┌─────────────────┐
                                  │   TAIL CLI CW   │
                                  └─────────────────┘

cw ...                            #Version 4.1.3
--endpoint=URL
--profile=PROFILE
--region=REGION
--no-color                        #Like aws cli
--no-version-check                #Unless set, check for updates

cw tail                           #Similar to `aws logs tail`
 [LOG_GROUP[:LOG_STREAM]...]      #By default, only prints 'LMESSAGE'
                                  #Def LOG_GROUP: stdin (newline-separated)
                                  #LOG_STREAM can be just the prefix
                                  #Pros:
                                  #  - polls with FilterLogEvents(), i.e. cheaper, every 250ms
                                  #  - can filter by FilterLogEvents() endTime
                                  #  - can print LLEVENT.id
                                  #Cons:
                                  #  - third-party
                                  #  - installed as OS package
                                  #  - print JSON as single line
                                  #  - does not have the general features that `aws cli` offers (authentication, history, etc.)

--follow|-f                       #Whether to tail or not (def)
--start|-b "DATE|DURATION"        #Like FilterLogEvents() startTime
                                  #"DATE" is "[YYYY-MM-DD][T][HH[:MM[:SS]]]"
                                  #"DURATION" is NUM + m|h|d, which can concatenated, e.g. "4h30m"
--end|-e "DATE"                   #Same but for FilterLogEvents() endTime
--local|-l                        #Use local timezone instead of UTC

--event-id|-i                     #Print LLEVENT.id
--timestamp|-t                    #Print LLEVENT.timestamp
--stream-name|-s                  #Print LLEVENTS.logStreamName
--group-name|-n                   #Print LLEVENTS.logGroupName

--retry|-r                        #Retry on network errors

--grep|-g STR                     #Like FilterLogEvents() filterPattern
--grepv|-v REGEXP                 #Inverted match against 'LMESSAGE'
--query|-q STR                    #Like `aws --query`, i.e. applies JMESPath (see its doc)
                                  #If cannot apply for a given LLEVENT, ignored

                                  ┌──────────────────┐
                                  │   TAIL SAM CLI   │
                                  └──────────────────┘

sam logs --tail|-r                #Live tail
                                  #Polls every second (does not use StartLiveTail())

                                  ┌─────────────────┐
                                  │   TAIL PULUMI   │
                                  └─────────────────┘

pulumi logs                       #Shows LLEVENTs

                                  ┌──────────────────┐
                                  │   TAIL TOOLKIT   │
                                  └──────────────────┘

TAIL ==>                          #Can be done from Explorer, or as a VSCode Command

                                  ┌────────────────────┐
                                  │   FILTER PATTERN   │
                                  └────────────────────┘

FILTER_PATTERN                    #Filter LLEVENTs by their message
                                  #One of the following syntaxes
                                  #Max 1KB

ANY MATCH ==>                     #
''                                #Matches anything

STRING MATCH ==>                  #Does not create $FVARs
VAL                               #Can use GLOB_REGEXP
                                  #Case-sensitive
                                  #Must "-quote non-[:alnum:]
VAL ...                           #Includes all of VALs
?VAL ...                          #Includes any of VALs
?VAL ... ?VAL2 ...                #Includes any of VALs and any of VAL2s
-VAL ...                          #Does not include VAL

JSON MATCH ==>                    #Set each JSON field as $FVAR
{ $.VARR OP VAL }                 #VARR: 1|many of .VAR, ['VAR'] or [NUM]
                                  #VAL: STR, "STR" or NUM
                                  #  - can include GLOB_REGEXP
{ $.VARR = != VAL }               #
{ $.VARR > >= < <= NUM }          #
{ $.VARR is null|true|false }     #Same as = "null|true|false"
{ $.VARR not exists }             #Is undefined
{ ... || ... }
{ ... && ... }
{ (...) }                         #

WHITESPACE-DELIMITED MATCH ==>    #For example, *.tsv
                                  #Fields can []-quote or "-quote whitespaces
[FVAR, ...]                       #Set each field as $FVAR
[FVAR OP VAL, ...]                #VAL can use GLOB_REGEXP
                                  #OP: = != > >= < <=
                                  #Default OP VAL: = * (always match)
[FVAR [OP VAL] || ..., ...]
[FVAR [OP VAL] && ..., ...]       #
[..., ...]                        #FVAR can be named ... in any position
                                  #This sets each field as $NUM FVAR (1-based)
[wNUM [OP VAL], ...]              #FVAR can be named wNUM to match field at position NUM
                                  #Last wNUM cannot use OP VAL
                                  #  - can workaround this by adding a dummy wNUM at end
[]                                #Same as [...]

GLOB_REGEXP                       #Either:
                                  #  - globbing: only *
                                  #  - %REGEXP%
                                  #     - only visible ASCII, and no ! " ' ` % & ( ) : < > ~
                                  #     - can use \ ? * + {,} [] | ^ $ . \d \D \s \S \w \W \xXX
                                  #     - max 5 FILTER_PATTERNs with REGEXP per LOG_GROUP
                                  #     - max 2 REGEXPs per FILTER_PATTERN

                                  ┌────────────────────────┐
                                  │   FILTER PATTERN IAC   │
                                  └────────────────────────┘

CFILTER_PATTERN                   #Is not a CONSTRUCT
CFILTER_PATTERN.logPatternString  #'FILTER_PATTERN'
FilterPattern.literal
 ('FILTER_PATTERN')
 ->CFILTER_PATTERN                #

FilterPattern.allEvents()
 ->CFILTER_PATTERN                #Any match

FilterPattern.anyTermGroup        #String match
 (STR_ARR_ARR)->CFILTER_PATTERN   #First-level is or, second-level is and
                                  #If first-level has a single item: "a" "b"
                                  #Else: ?VAL ... ?VAL2 ...
FilterPattern.allTerms
 (STR_ARR)->CFILTER_PATTERN       #String match, with and, i.e. "a" "b"
FilterPattern.anyTerms
 (STR_ARR)->CFILTER_PATTERN       #String match, with or, i.e. ?"a" "b"

FilterPattern.stringValue
 ('$.VARR', 'OP', STR)
 ->CFILTER_PATTERN                #{ $.VARR OP "STR" }
FilterPattern.numberValue
 ('$.VARR', 'OP', NUM)
 ->CFILTER_PATTERN                #{ $.VARR OP NUM }
FilterPattern.regexValue
 ('$.VARR', 'OP', 'REGEXP')
 ->CFILTER_PATTERN                #{ $.VARR OP "%REGEXP%" }
FilterPattern.booleanValue
 ('$.VARR', 'OP', NUM)
 ->CFILTER_PATTERN                #{ $.VARR is true|false }
FilterPattern.isNull
 ('$.VARR')->CFILTER_PATTERN      #{ $.VARR is null }
FilterPattern.notExists
 ('$.VARR')->CFILTER_PATTERN      #{ $.VARR not exists }
FilterPattern.exists
 ('$.VARR')->CFILTER_PATTERN      #{ $.VARR = * }
FilterPattern.any
 (CFILTER_PATTERN,...)
 ->CFILTER_PATTERN2               #{ ... || ... }
FilterPattern.all
 (CFILTER_PATTERN,...)
 ->CFILTER_PATTERN2               #{ ... && ... }

FilterPattern.spaceDelimited      #Whitespace-delimited match
 ('FVAR'_ARR)->CTSV_FILTER_PATTERN#FVAR can be wNUM too (including below), or '...'
CTSV_FILTER_PATTERN.whereString
 ('FVAR', 'OP', STR)
 ->CTSV_FILTER_PATTERN            #FVAR OP "STR" [&& ...]
CTSV_FILTER_PATTERN.whereNumber
 ('FVAR', 'OP', NUM)
 ->CTSV_FILTER_PATTERN            #FVAR OP NUM [&& ...]

                                  ┌─────────────────┐
                                  │   TRANSFORMER   │
                                  └─────────────────┘

TRANSFORMER                       #Transforms 'LMESSAGE' used by:
                                  #  - always: QUERY, INDEX_POLICY
                                  #  - opt-in: METRIC_FILTER, SUBSCRIPTION
                                  #Not applied elsewhere, i.e. not by LLEVENTS_REQ
                                  #  - i.e. stored both transformed and original 'LMESSAGE'
                                  #Done on LLEVENT creation
                                  #Not applied on past LLEVENTs

TRANSFORMER.creationTime          #DATE_NUM
TRANSFORMER.lastModifiedTime      #DATE_NUM

TRANSFORMER.logGroupIdentifier    #LOG_GROUP_ARN
                                  #In input, can also be 'LOG_GROUP'
                                  #To apply on all LOG_GROUPs, see APOLICY

                                  ┌─────────────────────┐
                                  │   TRANSFORMER API   │
                                  └─────────────────────┘

PutTransformer()                  #Req: TRANSFORMER
                                  #  - no *Time
                                  #Res: none
GetTransformer()                  #Req: TRANSFORMER
                                  #  - only logGroupIdentifier
                                  #Res: TRANSFORMER
DeleteTransformer()               #Req: TRANSFORMER
                                  #  - only logGroupIdentifier
                                  #Res: none

                                  ┌──────────────────────┐
                                  │   TRANSFORMER TEST   │
                                  └──────────────────────┘

TRANSFORMER_TEST_REQ              #Dry run a TRANSFORMER
TRANSFORMER_TEST_REQ              #'LMESSAGE'_ARR
 .logEventMessages                #Max 50 items
TRANSFORMER_TEST_REQ
 .transformerConfig               #TRANSFORMER_CONFIG_ARR

TRANSFORMER_TEST_RES.eventNumber  #NUM index
TRANSFORMER_TEST_RES.eventMessage #STR, before TRANSFORMER
TRANSFORMER_TEST_RES
 .transformedEventMessage         #STR, after TRANSFORMER

                                  ┌──────────────────────────┐
                                  │   TRANSFORMER TEST API   │
                                  └──────────────────────────┘

TestTransformer()                 #Req: TRANSFORMER_TEST_REQ
                                  #Res: transformedLogs TRANSFORMER_TEST_RES_ARR

                                  ┌────────────────────────┐
                                  │   TRANSFORMER CONFIG   │
                                  └────────────────────────┘

TRANSFORMER.transformerConfig     #TRANSFORMER_CONFIG_ARR
                                  #Max 20 items
TRANSFORMER_CONFIG                #Sets of transformations to apply
                                  #Only one key (i.e. transformation) must be specified in each TRANSFORMER_CONFIG.*
                                  #Max 128 chars for most STR ('VARR', 'COL', etc.)

VARR                              #Applied on FIELDs
                                  #Max 3 depth level
                                  #Def in *.source|destination: '@message'

                                  ┌──────────────────────────────┐
                                  │   TRANSFORMER CONFIG PARSE   │
                                  └──────────────────────────────┘

TRANSFORMER_CONFIG.*              #The following must be first
                                  #Max 200 FIELDs transformed

TRANSFORMER_CONFIG.parseJSON      #TRANSFORMER_JSON
TRANSFORMER_JSON.source           #Input 'VARR' with JSON STR
TRANSFORMER_JSON.destination      #Output 'VARR'

TRANSFORMER_CONFIG.csv            #TRANSFORMER_CSV
TRANSFORMER_CSV.source            #Input 'VARR' with CSV STR
TRANSFORMER_CSV.columns           #'COL'_ARR (def: ['column_NUM', ...], 1-based)
                                  #Max 100 items
TRANSFORMER_CSV.delimiter         #STR (def: ,)
TRANSFORMER_CSV.quoteCharacter    #STR (def: ")

TRANSFORMER_CONFIG.parseKeyValue  #TRANSFORMER_PARSE
TRANSFORMER_PARSE.source          #Input 'VARR' with URL query-like STR
TRANSFORMER_PARSE.destination     #Output 'VARR'
TRANSFORMER_PARSE.fieldDelimiter  #STR (def: &)
TRANSFORMER_PARSE
 .keyValueDelimiter               #STR (def: =)
TRANSFORMER_PARSE.keyPrefix       #STR (def: none). Prefixes all keys
TRANSFORMER_PARSE.nonMatchValue   #STR (def: none). Default value
TRANSFORMER_PARSE
 .overwriteIfExists               #BOOL (def: false)

TRANSFORMER_CONFIG.grok           #TRANSFORMER_GROK
TRANSFORMER_GROK.source           #Input 'VARR'
TRANSFORMER_GROK.match            #STR. Logstash's Grok pattern
                                  #Max 5 patterns

TRANSFORMER_CONFIG                #Always '@message'
 .parseCloudfront.source          #Transform Cloudfront log line to CLOUDFRONT_LOG_ARR
CLOUDFRONT_LOG.*                  #Not documented yet

TRANSFORMER_CONFIG                #Always '@message'
 .parseRoute53.source             #Transform Route53 log line to ROUTE53_LOG_ARR
ROUTE53_LOG.*                     #Not documented yet

TRANSFORMER_CONFIG.parseVPC.source#Always '@message'
                                  #Transform VPC log line to VPC_LOG_ARR
VPC_LOG.*                         #Not documented yet

TRANSFORMER_CONFIG                #Always '@message'
 .parsePostgres.source            #Transform Postgres log line to POSTGRES_LOG_ARR
POSTGRES_LOG.logTime              #'DATE'
POSTGRES_LOG.srcIp                #'IP'
POSTGRES_LOG.userName             #'USER'
POSTGRES_LOG.dbName               #'DATABASE'
POSTGRES_LOG.processId            #'PID'
POSTGRES_LOG.logLevel             #'ERROR|WARN|...'

TRANSFORMER_CONFIG.parseWAF.source#Always '@message'
                                  #Transform LOG_EVENT.httpRequest.headers and LOG_EVENT.labels from OBJ_ARR to OBJ

                                  ┌───────────────────────────────┐
                                  │   TRANSFORMER CONFIG OBJECT   │
                                  └───────────────────────────────┘

TRANSFORMER_CONFIG.*Keys|entries  #Max 5 items
                                  #Only once per TRANSFORMER_CONFIG_ARR

TRANSFORMER_CONFIG.addKeys.entries#TRANSFORMER_ADD_ARR. Sets values
TRANSFORMER_ADD.key               #'VARR'
TRANSFORMER_ADD.value             #'VAL'
TRANSFORMER_ADD.overwriteIfExists #BOOL (def: false)

TRANSFORMER_CONFIG
 .copyValue.entries               #TRANSFORMER_COPY_ARR. Copy values
TRANSFORMER_COPY.source           #'VARR', '@logGroupName', '@logGroupStream', '@accountId' or '@regionName'
TRANSFORMER_COPY.target           #'VARR'
TRANSFORMER_COPY.overwriteIfExists#BOOL (def: false)

TRANSFORMER_CONFIG
 .moveKeys.entries                #TRANSFORMER_MOVE_ARR. Move values
TRANSFORMER_MOVE.source           #'VARR'
TRANSFORMER_MOVE.target           #'VARR'
TRANSFORMER_MOVE.overwriteIfExists#BOOL (def: false)

TRANSFORMER_CONFIG
 .renameKeys.entries              #TRANSFORMER_RENAME_ARR. Rename keys
TRANSFORMER_RENAME.key            #'VARR'
TRANSFORMER_RENAME.renameTo       #'VARR'
TRANSFORMER_RENAME
 .overwriteIfExists               #BOOL (def: false)

TRANSFORMER_CONFIG
 .deleteKeys.withKeys             #'VARR'_ARR to delete

TRANSFORMER_CONFIG.listToMap      #TRANSFORMER_MAP. Transform OBJ_ARR to OBJ
TRANSFORMER_MAP.source            #'VARR' of input OBJ_ARR
TRANSFORMER_MAP.key               #'VARR' of OBJ key
TRANSFORMER_MAP.valueKey          #'VARR' of OBJ value
TRANSFORMER_MAP.target            #'VARR' of output
TRANSFORMER_MAP.flatten           #BOOL. If false (def), output OBJ has ARR values
                                  #If true, it has a single value instead
TRANSFORMER_MAP.flattenedElement  #'first|last', when TRANSFORMER_MAP.flatten true

                                  ┌───────────────────────────────┐
                                  │   TRANSFORMER CONFIG STRING   │
                                  └───────────────────────────────┘

TRANSFORMER_CONFIG.*Keys|entries  #Max 10 items

TRANSFORMER_CONFIG
 .lowerCaseString.withKeys        #'VARR'_ARR. Lowercase

TRANSFORMER_CONFIG
 .upperCaseString.withKeys        #'VARR'_ARR. Uppercase

TRANSFORMER_CONFIG
 .trimString.withKeys             #'VARR'_ARR. Trim whitespaces

TRANSFORMER_CONFIG                #TRANSFORMER_SPLIT_ARR. Split STR into ARR
 .splitString.entries             #Max 100 items
TRANSFORMER_SPLIT.source          #'VARR'
TRANSFORMER_SPLIT.delimiter       #STR

TRANSFORMER_CONFIG
 .substituteString.entries        #TRANSFORMER_SUBSTITUTE_ARR. STR.replace()
TRANSFORMER_SUBSTITUTE.source     #'VARR'
TRANSFORMER_SUBSTITUTE.from       #'REGEXP'
TRANSFORMER_SUBSTITUTE.to         #STR

                                  ┌────────────────────────────────┐
                                  │   TRANSFORMER CONFIG CONVERT   │
                                  └────────────────────────────────┘

TRANSFORMER_CONFIG.*Keys|entries  #Max 10 items

TRANSFORMER_CONFIG
 .typeConverter.entries           #TRANSFORMER_CONVERT_ARR. Transtype
TRANSFORMER_CONVERT.key           #'VARR'
TRANSFORMER_CONVERT.type          #'integer', 'double', 'string', 'boolean'

TRANSFORMER_CONFIG
 .dateTimeConverter               #TRANSFORMER_DATE. Normalizes date
TRANSFORMER_DATE.source           #Input 'VARR'
TRANSFORMER_DATE.matchPatterns    #Input 'DATE_PATTERN'_ARR. Required
                                  #Max 5 items
TRANSFORMER_DATE.sourceTimezone   #Input 'TZ' (def: 'UTC')
TRANSFORMER_DATE.target           #Output 'VARR'
TRANSFORMER_DATE.targetFormat     #Output 'DATE_PATTERN' (def: "yyyy-MM-dd'T'HH:mm:ss.SSS'Z")
TRANSFORMER_DATE.targetTimezone   #Output 'TZ' (def: 'UTC')
TRANSFORMER_DATE.locale           #'VARR' of LOCALE (def: 'locale.ROOT')

                                  ┌─────────────────┐
                                  │   METRIC MAIN   │
                                  └─────────────────┘

METRIC_FILTER                     #Create CloudWatch METRIC_DATA from LLEVENTs
                                  #Difference with embedded METRICs: unstructured, i.e. parsed from LLEVENTs
                                  #Max 100 per LOG_GROUP
METRIC_FILTER.filterName          #'METRIC_FILTER'
METRIC_FILTER.creationTime        #DATE_NUM

METRIC_FILTER.logGroupName        #'LOG_GROUP'

METRIC_FILTER.filterPattern       #'FILTER_PATTERN'
METRIC_FILTER
 .applyOnTransformedLogs          #BOOL (def: false). Use TRANSFORMER (if any)

METRIC_FILTER
 .metricTransformations           #METRIC_TRANSFORM_ARR. METRIC_DATA being created
METRIC_TRANSFORM.metricName       #'METRIC'. METRIC.MetricName
METRIC_TRANSFORM.metricNamespace  #'NAMESPACE'. METRIC.Namespace
METRIC_TRANSFORM.dimensions       #DOBJ. METRIC.Dimensions
                                  #Max 3 DVARs
                                  #If >1e3 different DVALs in an hour, METRIC_FILTER automatically disabled
                                  #DVAL can include $.VARR or $FVAR
METRIC_TRANSFORM.metricValue      #STR. METRIC_DATUM.Value
                                  #Can include $.VARR or $FVAR
METRIC_TRANSFORM.defaultValue     #STR. METRIC_DATUM.Value
                                  #Emitted when METRIC_FILTER.filterPattern does not match
                                  #Goals:
                                  #  - knowing frequency when filterPattern matches or not
                                  #  - prevent undefined PERIODs, i.e. with no METRIC_DATA
METRIC_TRANSFORM.unit             #STR. METRIC_DATUM.Unit

LOG_GROUP.metricFilterCount       #NUM of METRIC_FILTERs

                                  ┌─────────────────────┐
                                  │   METRIC MAIN API   │
                                  └─────────────────────┘

PutMetricFilter()                 #Req: METRIC_FILTER
                                  #  - no creationTime
                                  #Res: empty
DescribeMetricFilters()           #Req: METRIC_FILTER|METRIC_TRANSFORM
                                  #  - only logGroupName, metricName, metricNamespace
                                  #  - only filterName -> filterNamePrefix STR
                                  #Res: metricFilters METRIC_FILTER_ARR
DeleteMetricFilter()              #Req: METRIC_FILTER
                                  #  - only filterName, logGroupName
                                  #Res: empty

                                  ┌─────────────────────┐
                                  │   METRIC MAIN IAC   │
                                  └─────────────────────┘

AWS::Logs::MetricFilter           #RESPROPs: FilterName, FilterPattern, LogGroupName, MetricTransformations

new MetricFilter(...CARGS, OPTS)  #CMETRIC_FILTER. CKRESOURCE wrapping METRIC_FILTER
ICLOG_GROUP.addMetricFilter
 ('CMETRIC_FILTER'[, OPTS])
 ->CMETRIC_FILTER                 #Same but fills OPTS.logGroup

OPTS.filterName                   #METRIC_FILTER.*
OPTS.filterPattern                #CFILTER_PATTERN. METRIC_FILTER.filterPattern
OPTS.logGroup                     #ICLOG_GROUP. METRIC_FILTER.logGroupName
OPTS.metricName|metricNamespace
 |dimensions|defaultValue|unit    #METRIC_TRANSFORM.*. Always a single one
OPTS.metricValue                  #METRIC_TRANSFORM.metricValue (def: '1')

CMETRIC_FILTER.metric             #Sets CMETRIC_OPTS.metricName|namespace
 (CMETRIC_OPTS)->CMETRIC          #Sets default CMETRIC_OPTS.statistic 'avg'

ICLOG_GROUP.extractMetric         #Creates a METRIC_FILTER with metricValue '$.VARR'
 ('$.VARR', 'NAMESPACE', 'METRIC')#Uses FILTER_PATTERN '$.VARR exists'
 ->CMETRIC                        #CMETRIC.metricName|namespace|account|region is set
                                  #But CMETRIC.dimensions|statistic|unit|period|label|color use default value

                                  ┌─────────────────┐
                                  │   METRIC TEST   │
                                  └─────────────────┘

TEST_FILTER_REQ                   #Try a METRIC_FILTER against test LLEVENTs
TEST_FILTER_REQ.logEventMessages  #Test 'LMESSAGE'_ARR
                                  #Max 50
TEST_FILTER_REQ.filterPattern     #'FILTER_PATTERN'

TEST_FILTER_RES.eventMessage      #STR. Value in logEventMessages
TEST_FILTER_RES.eventNumber       #NUM. Index in logEventMessages
TEST_FILTER_RES.extractedValues   #{ $FVAR: STR, ... } matched by FILTER_PATTERN

                                  ┌─────────────────────┐
                                  │   METRIC TEST API   │
                                  └─────────────────────┘

TestMetricFilter()                #Req: TEST_FILTER_REQ
                                  #Res: matches TEST_FILTER_RES_ARR

                                  ┌────────────────┐
                                  │   QUERY MAIN   │
                                  └────────────────┘

QUERY                             #Advanced search|query for LLEVENTs
                                  #Called "Logs Insights"
                                  #60m timeout. Once complete, deleted after 7d
                                  #Max 30 running at once (5 if INFREQUENT_ACCESS)
                                  #Max 1e4 matching LOG_GROUPs
QUERY.queryId                     #QUERY_MID
QUERY.createTime                  #DATE_NUM

QUERY.queryString                 #'QUERY_STRING'

QUERY.logGroupIdentifiers         #LOG_GROUP_ARN_ARR
                                  #In input, can also be 'LOG_GROUP'
                                  #Max 50

QUERY.startTime|endTime           #DATE_NUM, filtering by LLEVENT.timestamp

QUERY_RESULTS.results             #QUERY_RESULT_ARR_ARR
                                  #Each QUERY_RESULT_ARR is a LLEVENT
                                  #Each QUERY_RESULT is a FIELD
QUERY_RESULT.field                #'FIELD'
QUERY_RESULT.value                #STR

QUERY[_RESULTS].status            #STR among:
                                  #  - Scheduled
                                  #  - Running
                                  #  - Complete
                                  #  - Failed, Cancelled, Timeout
                                  #  - Unknown

QUERY_RESULTS.statistics          #QUERY_STATS
QUERY_STATS.recordsMatched        #NUM of LLEVENTs matched
QUERY_STATS.recordsScanned        #NUM of LLEVENTs read
QUERY_STATS.bytesScanned          #Like QUERY_STATS.recordsScanned but in bytes

CLOUDWATCH DASHBOARD ==>          #Can run|display QUERY in CloudWatch DASHBOARD's DLOG (see its doc)

                                  ┌─────────────────────┐
                                  │   QUERY MAIN AUTH   │
                                  └─────────────────────┘

PACTION cloudwatch:GenerateQuery  #Allows generating QUERY_STRINGs from AI prompts in the UI
                                  #Max 5 at once

                                  ┌────────────────────┐
                                  │   QUERY MAIN API   │
                                  └────────────────────┘

StartQuery()                      #Req: QUERY
                                  #  - logGroupIdentifiers -> logGroupIdentifiers + logGroupName[s] STR[_ARR]
                                  #  - no queryId, createTime, status
                                  #Res: QUERY
                                  #  - only queryId
                                  #Paginates QUERY_RESULTS.results for GetQueryResults()
DescribeQueries()                 #Req: QUERY
                                  #  - only logGroupIdentifiers -> logGroupName STR
                                  #  - only status, queryLanguage
                                  #Res: queries QUERY_ARR
                                  #  - logGroupIdentifiers -> logGroupName STR
                                  #  - no startTime|endTime
StopQuery()                       #Req: QUERY
                                  #  - only queryId
                                  #Res: QUERY
                                  #  - only status -> success BOOL
GetQueryResults()                 #Req: QUERY
                                  #  - only queryId
                                  #Res: QUERY_RESULTS

                                  ┌──────────────────────┐
                                  │   QUERY DEFINITION   │
                                  └──────────────────────┘

QUERYDEF                          #Saved 'QUERY_STRING'. Also called "saved query"
                                  #Must be either:
                                  #  - manually retrieved, then run separately with StartQuery()
                                  #  - used through UI console
                                  #Deleted after 30d
                                  #Not logged by CloudTrail
                                  #Max 1e3 per REGION
QUERYDEF.queryDefinitionId        #QUERYDEF_MID
QUERYDEF.name                     #'QUERYDEF'
                                  #Can include a NAMEPATH, shown as folders in UI console
QUERYDEF.lastModified             #DATE_NUM
QUERYDEF.clientToken              #STR. Idempotence

QUERYDEF.queryString              #'QUERY_STRING'

QUERYDEF.logGroupNames            #'LOG_GROUP'_ARR

                                  ┌──────────────────────────┐
                                  │   QUERY DEFINITION API   │
                                  └──────────────────────────┘

PutQueryDefinition()              #Req: QUERYDEF
                                  #  - no lastModified
                                  #  - only one with clientToken
                                  #Res: QUERYDEF
                                  #  - only queryDefinitionId
DescribeQueryDefinitions()        #Req: QUERYDEF
                                  #  - only name -> queryDefinitionNamePrefix STR
                                  #  - only queryLanguage
                                  #Res: queryDefinitions QUERYDEF_ARR
DeleteQueryDefinition()           #Req: QUERYDEF
                                  #  - only queryDefinitionId
                                  #Res: success BOOL

                                  ┌──────────────────────────┐
                                  │   QUERY DEFINITION IAC   │
                                  └──────────────────────────┘

AWS::Logs::QueryDefinition        #RESPROPs: Name, QueryString, LogGroupNames
                                  #RESATTRs: QueryDefinitionId

new QueryDefinition(...CARGS,OPTS)#CQUERYDEF. CKRESOURCE wrapping QUERYDEF
CQUERYDEF.queryDefinitionId
OPTS.queryDefinitionName          #QUERYDEF.*
OPTS.queryString                  #CQUERY_STRING. QUERYDEF.queryString
OPTS.logGroups                    #ICLOG_GROUP_ARR. QUERYDEF.logGroupNames

                                  ┌──────────────────┐
                                  │   QUERY FIELDS   │
                                  └──────────────────┘

QUERY_FIELDS_REQ                  #Retrieves|parses names of all FIELDs of specific LLEVENTs
QUERY_FIELDS_REQ
 .logGroupIdentifier              #'LOG_GROUP'|LOG_GROUP_ARN
QUERY_FIELDS_REQ.logGroupName     #'LOG_GROUP'
QUERY_FIELDS_REQ.time             #DATE_NUM. Filter for LLEVENTs 8m before|after DATE_NUM.
                                  #If not specified, filter for LLEVENTs in last 15m

QUERY_FIELD.name                  #'FIELD'
QUERY_FIELD.percent               #NUM of LLEVENTs with that FIELD not undefined

QUERY_RECORD_REQ                  #Retrieves|parses names + values of all FIELDs of a single LLEVENT
QUERY_RECORD_REQ.logRecordPointer #STR. LLEVENT's @ptr

QUERY_RECORD_RES.logRecord        #{ FIELD: STR, ... }

                                  ┌──────────────────────┐
                                  │   QUERY FIELDS API   │
                                  └──────────────────────┘

GetLogGroupFields()               #Req: QUERY_FIELDS_REQ
                                  #Res: logGroupFields QUERY_FIELD_ARR
GetLogRecord()                    #Req: QUERY_RECORD_REQ
                                  #Res: QUERY_RECORD_RES

                                  ┌──────────────────┐
                                  │   QUERY SYNTAX   │
                                  └──────────────────┘

QUERY_STRING                      #The syntax is the next chapters
                                  #Format is "Logs Insights QL"
                                  #Keywords are case-insensitive
                                  #Max 10KB

#COMMENT                          #

                                  ┌─────────────────┐
                                  │   QUERY FIELD   │
                                  └─────────────────┘

FIELD                             #One of the following
`FIELD`                           #Quoting needed unless only [[:alnum:].@]

VARR                              #If 'LMESSAGE' is 'OBJ|ARR_JSON', OBJ|ARR.VARR
                                  #VARR: 1|many of .VAR, .NUM
                                  #Max 200 per LLEVENT, 1000 per LOG_GROUP

@message                          #LLEVENT.message
@ingestionTime                    #LLEVENT.ingestionTime
@timestamp                        #LLEVENT.timestamp
@log                              #'ACCOUNT_ID:LOG_GROUP'
@logStream                        #'LOG_STREAM'

@ptr                              #LLEVENT_MID. Always output in QUERY_RESULTs

SERVICE-SPECIFIC ==>              #A few SERVICEs define their own

                                  ┌───────────────────┐
                                  │   QUERY COMMAND   │
                                  └───────────────────┘

COMMAND | ...                     #Pipe COMMANDs
fields|parse|sort|stats ...
 as FIELD,...                     #Alias, i.e. rename COMMAND's outputs

COMMAND                           #One of the following

fields FIELD_EXPR,...             #Output those FIELDs, in each LLEVENT
display FIELD,...                 #Only keep those FIELDs, in each LLEVENT

parse FIELD "..."                 #String matching, extracting each * as a FIELD2
parse FIELD /.../                 #REGEXP matching, extracting each (?<FIELD2>...)

filter BOOL_EXPR                  #Only keep LLEVENTs where BOOL_EXPR is true
sort FIELD asc|desc               #Sort by FIELD
limit NUM                         #Only keep first NUM LLEVENTs
                                  #Def: 1e3, max: 1e4

dedup FIELD,...                   #Ignore LLEVENTs with same FIELDs values as previous LLEVENTs
                                  #"previous" is based on sort order
                                  #Undefined values are not considered duplicates
                                  #Must be either last COMMAND, or before `limit` as a last COMMAND

unnest FIELD into VARR            #Output one LLEVENT for each FIELD ARR item
                                  #Each ARR item in the output is named VARR
                                  #FIELD must have been output as an ARR by jsonParse() first

                                  ┌───────────────────────┐
                                  │   QUERY AGGREGATION   │
                                  └───────────────────────┘

stats AFUNC(...),...              #COMMAND that groups by STR_EXPR and outputs FIELDs from aggregate AFUNCs
 by STR_EXPR,...                  #UI shows results as charts:
                                  #  - bar chart: always
                                  #  - if group by bin(): line chart, stacked area chart, pie chart
                                  #Max 2 per QUERY
                                  #AFUNCs are the following

count([*])->NUM                   #NUM of LLEVENTs
count(FIELD)->NUM                 #NUM of LLEVENTs where FIELD is not undefined
count_distinct(FIELD)->NUM        #Approximate NUM of LLEVENTs with unique FIELDs

avg(NUM_FIELD)->NUM               #
sum(NUM_FIELD)->NUM               #
stddev(NUM_FIELD)->NUM            #

min|max(FIELD)->VAL               #
pct(FIELD, NUM)->VAL              #Percentile value

sortsFirst|Last(FIELD)->VAL       #First|last value, in current sorting order
earliest|latest(FIELD)->VAL       #First|last value, in @timestamp sorting order

                                  ┌──────────────────────┐
                                  │   QUERY EXPRESSION   │
                                  └──────────────────────┘

EXPR                              #Can use the following

VAL = != VAL2                     #

ispresent(FIELD)->BOOL            #true unless undefined
coalesce(FIELD,...)->FIELD        #First FIELD not undefined

(...)                             #
BOOL and or BOOL2
not BOOL                          #
VAL [not] in ARR                  #

NUM < <= > >= NUM2                #
greatest|least(NUM,...)->NUM      #

NUM + - * / ^ % NUM2              #
abs(NUM)->NUM                     #
ceil|floor(NUM)->NUM              #
log(NUM)->NUM                     #
sqrt(NUM)->NUM                    #

STR like /REGEXP/                 #BOOL. REGEXP match
STR =~ /REGEXP/                   #Must use (?FLAGS), not /REGEXP/FLAGS
STR like STR2                     #BOOL. Has substring
strcontains(STR, STR2)->0|1       #Same as 0|1

strlen(STR)->NUM                  #Length in Unicode codepoints
isempty(FIELD)->0|1               #1 if undefined or empty STR
isblank(FIELD)->0|1               #1 if undefined, empty STR or only whitespaces
concat(STR,...)->STR2             #
toupper|tolower(STR)->STR2        #
[l|r]trim(STR[, 'CHARS'])->STR    #
substr(STR, NUM[, NUM2])->STR2    #Substring at index NUM, for NUM2 chars (def: all)
replace(FIELD, STR, STR2)->STR3   #

toMillis('DATE'_FIELD)->DATE_NUM  #
fromMillis(DATE_NUM)->'DATE'_FIELD#
datefloor|dateceil                #Rounding down|up.
 ('DATE', 'PERIOD')->'DATE'       #PERIOD is NUM followed by y|q|mo|w|d|h|m|s|ms, yr|qtr|mon|hr|min|sec|msec
                                  #or year|quarter|month|week|day|hour|minute|second|millisecond
bin('PERIOD')->'DATE'             #Same as datefloor(@timestamp, 'PERIOD')

jsonParse(FIELD)->VAL             #undefined if invalid JSON
jsonStringify(FIELD)->STR         #

isValidIp[V4|6](FIELD)->BOOL      #
isIp[V4|6]InSubnet
 (FIELD, "CIDR")->BOOL            #

                                  ┌───────────────┐
                                  │   QUERY IAC   │
                                  └───────────────┘

new QueryString([OPTS])           #CQUERY_STRING. Not a CONSTRUCT
CQUERY_STRING.toString()
 ->'QUERY_STRING'                 #

OPTS.COMMAND                      #STR_ARR. COMMAND's arguments, as is
OPTS.parse|limitStatements        #If multiple items, repeat COMMAND with each item
                                  #Missing COMMANDs: dedup, pattern, diff, unmask
OPTS.parse|limit                  #Same but as STR
OPTS.fields                       #'FIELD_EXPR'_ARR
OPTS.limit                        #NUM

                                  ┌──────────────┐
                                  │   INDEXING   │
                                  └──────────────┘

INDEX_POLICY                      #Creates indexes (like databases) on specific FIELDs
                                  #Goal: speedup COMMAND `filter[Index]`
                                  #Only for future LLEVENTs, not past ones
                                  #Only if 'LMESSAGE' is 'OBJ|ARR_JSON'
                                  #Max 20 per LOG_GROUP (or ACCOUNT if source 'ACCOUNT')
INDEX_POLICY.lastUpdateTime       #DATE_NUM of last refresh

INDEX_POLICY.logGroupIdentifier   #LOG_GROUP_ARN
                                  #In input, can also be 'LOG_GROUP'
                                  #To apply on all LOG_GROUPs, see APOLICY

INDEX_POLICY.policyDocument       #'OBJ_JSON': Fields: 'FIELD'_ARR
                                  #'FIELD':
                                  #  - can be a VARR, using same dot notation as FIELDs
                                  #  - case-sensitive
                                  #  - cannot be @message, @timestamp, @log, @ptr
                                  #  - must be escaped with @ if starts with @
                                  #     - except @ingestionTime, @logStream
                                  #  - max 100 chars
                                  #Max 20 FIELDs
                                  #Max 5KB

COMMAND filter BOOL_EXPR          #Skips LLEVENTs without a FIELD if both:
                                  #  - indexed
                                  #  - using = or IN

QUERY_STATS
 .estimatedRecordsSkipped         #NUM of LLEVENTs skipped by indexing
QUERY_STATS.estimatedBytesSkipped #Like QUERY_STATS.estimatedRecordsSkipped but in bytes

                                  ┌──────────────────┐
                                  │   INDEXING API   │
                                  └──────────────────┘

PutIndexPolicy()                  #Req: INDEX_POLICY
                                  #  - no policyName, lastUpdateTime, source
                                  #Res: indexPolicy INDEX_POLICY
DescribeIndexPolicies()           #Req: INDEX_POLICY
                                  #  - only logGroupIdentifier STR -> logGroupIdentifiers ARR
                                  #Res: indexPolicies INDEX_POLICY_ARR
DeleteIndexPolicy()               #Req: INDEX_POLICY
                                  #  - only logGroupIdentifier
                                  #Res: none

                                  ┌──────────────────┐
                                  │   INDEXING IAC   │
                                  └──────────────────┘

AWS::Logs::LogGroup               #Includes:
                                  #  - FieldIndexPolicies OBJ_ARR (single item): INDEX_POLICY.policyDocument

CLOG_GROUP_OPTS.fieldIndexPolicies#ARR of new FieldIndexPolicy({props 'FIELD'_ARR})
                                  #INDEX_POLICY.policyDocument

                                  ┌─────────────────────┐
                                  │   INDEXING FIELDS   │
                                  └─────────────────────┘

INDEXED_FIELD                     #FIELD targetted by an INDEX_POLICY
INDEXED_FIELD.fieldIndexName      #'FIELD'
INDEXED_FIELD.logGroupIdentifier  #'LOG_GROUP'

INDEXED_FIELD.lastScanTime        #DATE_NUM. Most recent index refresh
INDEXED_FIELD.firstEventTime      #DATE_NUM. Earliest LLEVENT.timestamp
INDEXED_FIELD.lastEventTime       #DATE_NUM. Latest LLEVENT.timestamp

                                  ┌─────────────────────────┐
                                  │   INDEXING FIELDS API   │
                                  └─────────────────────────┘

DescribeFieldIndexes()            #Req: INDEX_POLICY
                                  #  - only logGroupIdentifier STR -> logGroupIdentifiers ARR
                                  #Res: fieldIndexes INDEXED_FIELD_ARR

                                  ┌────────────────────────┐
                                  │   INDEXING LOG GROUP   │
                                  └────────────────────────┘

COMMAND filterIndex BOOL_EXPR     #Like COMMAND `filter` but also skip LOG_GROUPs without indexed FIELD

QUERY_STATS.logGroupsScanned      #NUM of LOG_GROUPs matched, excluding the ones skipped by indexing

                                  ┌────────────────────────────┐
                                  │   INDEXING LOG GROUP API   │
                                  └────────────────────────────┘

ListLogGroupsForQuery()           #Req: QUERY
                                  #  - only queryId
                                  #Res: QUERY
                                  #  - only logGroupIdentifiers

                                  ┌─────────────┐
                                  │   PATTERN   │
                                  └─────────────┘

pattern STR_EXPR                  #QUERY COMMAND. Automatically detect shared patterns. Produces FIELDs:
                                  #  - @pattern STR: common substring, with variable parts as <TYPE-NUM>
                                  #     - TYPE: guessed (def: 'Token')
                                  #     - NUM: 1-based index within the line
                                  #     - can be used with parse COMMAND
                                  #  - @sampleCount NUM: total of matching LLEVENTs
                                  #  - @ratio NUM: percentage of matching LLEVENTs
                                  #  - @severityLabel 'Error|Warning|Info|Debug': detected message severity
                                  #Better for LLEVENTs with fairly structured, repeating message

diff [STR]                        #QUERY COMMAND. Compare @sampleCount of `pattern @message` between LLEVENTs in periods:
                                  #  - currently queried
                                  #  - previous one of same length, either:
                                  #     - immediately before
                                  #     - STR: previousDay|previousWeek|previousMonth
                                  #Produces same FIELDs as `pattern`, and also:
                                  #  - difference in @sampleCount

                                  ┌────────────────┐
                                  │   PATTERN UI   │
                                  └────────────────┘

PATTERNS ==>                      #Has a tab which automatically shows `pattern @message` on last 1000 LLEVENTs
                                  #Also shows corrolated patterns (e.g. lines that often appear together)

                                  ┌──────────────────────┐
                                  │   ANOMALY DETECTOR   │
                                  └──────────────────────┘

DETECTOR                          #Find ANOMALYs
DETECTOR.anomalyDetectorArn       #DETECTOR_ARN
DETECTOR.detectorName             #'DETECTOR'
DETECTOR.creationTimeStamp        #DATE_NUM
DETECTOR.lastModifiedTimeStamp    #DATE_NUM

DETECTOR.anomalyDetectorStatus    #Among:
                                  #  - INITIALIZING
                                  #  - TRAINING: analyze last 2 weeks. Last up to 24h
                                  #  - ANALYZING
                                  #  - PAUSED
                                  #  - FAILED
                                  #  - DELETED

DETECTOR.logGroupArnList          #LOG_GROUP_ARN_ARR
DETECTOR.filterPattern            #'FILTER_PATTERN'

DETECTOR.evaluationFrequency      #How often to run among 'ONE|FIVE|TEN|FIFTEEN|THIRTY_MIN', 'ONE_HOUR' (def: 'FIVE_MIN')
DETECTOR.anomalyVisibilityTime    #NUM of days (def 21, min 7, max 90). Max duration of ANOMALYs, before considered normal

DETECTOR.kmsKeyId                 #KMS_KEY_ID (def automatically created). Encrypt ANOMALYs at rest

DETECTOR.tags                     #TAGS

                                  ┌──────────────────────────┐
                                  │   ANOMALY DETECTOR API   │
                                  └──────────────────────────┘

CreateLogAnomalyDetector()        #Req: DETECTOR
                                  #  - no *TimeStamp, anomalyDetectorStatus
                                  #  - no anomalyDetectorArn
                                  #Res: DETECTOR
                                  #  - only anomalyDetectorArn
UpdateLogAnomalyDetector()        #Req: DETECTOR
                                  #  - anomalyDetectorStatus PAUSED -> enabled BOOL
                                  #  - no *TimeStamp, anomalyDetectorStatus
                                  #  - no detectorName, kmsKeyId, logGroupArnList
                                  #  - no tags
                                  #Res: empty
GetLogAnomalyDetector()           #Req: DETECTOR
                                  #  - only anomalyDetectorArn
                                  #Res: DETECTOR
                                  #  - no tags, anomalyDetectorArn
ListLogAnomalyDetectors()         #Req: DETECTOR
                                  #  - only logGroupArnList ARR -> filterLogGroupArn LOG_GROUP_ARN
                                  #Res: anomalyDetectors DETECTOR_ARR
                                  #  - no tags
DeleteLogAnomalyDetector()        #Req: DETECTOR
                                  #  - only anomalyDetectorArn
                                  #Res: empty

                                  ┌──────────────────────────┐
                                  │   ANOMALY DETECTOR IAC   │
                                  └──────────────────────────┘

AWS::Logs::LogAnomalyDetector     #RESPROPs:
                                  #  - DetectorName, LogGroupArnList, FilterPattern, EvaluationFrequency, AnomalyVisibilityTime, KmsKeyId
                                  #  - AccountId 'ACCOUNT_ID'
                                  #RESATTRs: AnomalyDetectorArn, CreationTimeStamp, LastModifiedTimeStamp, AnomalyDetectorStatus

                                  ┌──────────────────┐
                                  │   ANOMALY ITEM   │
                                  └──────────────────┘

ANOMALY                           #Abnormal set of LLEVENTs
                                  #Guessed by using `pattern` COMMAND + machine learning
                                  #Only first 1500 chars of each @message
                                  #Includes:
                                  #  - new @pattern
                                  #  - big changes in @ratio
                                  #  - dynamic <*>: new value, or big changes in NUM of occurences
ANOMALY.anomalyId                 #ANOMALY_MID
ANOMALY.anomalyDetectorArn        #DETECTOR_ARN
ANOMALY.logGroupArnList           #LOG_GROUP_ARN_ARR

ANOMALY.firstSeen                 #DATE_NUM
ANOMALY.lastSeen                  #DATE_NUM
ANOMALY.histogram.DATE_NUM        #NUM of occurrences. Histogram

ANOMALY.priority                  #'HIGH|MEDIUM|LOW'
                                  #Based on NUM of occurences and on keywords like 'FATAL' or 'ERROR'
ANOMALY.description               #STR. Automatically generated
ANOMALY.logSamples                #ANOMALY_SAMPLE_ARR. Randomly sample @message and @timestamp
ANOMALY_SAMPLE.message            #STR
ANOMALY_SAMPLE.timestamp          #DATE_NUM

ANOMALY.patternId                 #MID of `pattern`
ANOMALY.patternString             #`pattern` as STR
ANOMALY.patternRegex              #`pattern`, as 'REGEXP'

ANOMALY.patternTokens             #ANOMALY_PART_ARR. `pattern` result
ANOMALY_PART.tokenString          #STR value, either raw value or '<TYPE-NUM>' (dynamic)
ANOMALY_PART.isDynamic            #BOOL
ANOMALY_PART.inferredTokenName    #'TYPE-NUM' from <TYPE-NUM>
ANOMALY_PART.dynamicTokenPosition #NUM from <TYPE-NUM>
ANOMALY_PART.enumerations         #OBJ. If dynamic, matches values.
                                  #Key is matched STR (max 500), value is approximate NUM of occurences

ANOMALY.active                    #BOOL. Whether ongoing
ANOMALY.state                     #One of:
                                  #  - 'Active': ongoing
                                  #  - 'Baseline': ANOMALY.baseline
                                  #  - 'Suppressed': ANOMALY.suppressed
ANOMALY.baseline                  #BOOL (def: false). Manually ignored, and adjust @ratio

ANOMALY.suppressed                #BOOL (def: false). Manually ignored, and do not adjust @ratio
ANOMALY.suppressedDate            #DATE_NUM
ANOMALY.suppressedUntil           #DATE_NUM
ANOMALY.suppressionType           #Among:
                                  #  - 'INFINITE': no suppressedUntil
                                  #  - 'LIMITED': suppressedUntil, defined by suppressionPeriod
                                  #  - undefined: not suppressed anymore
ANOMALY.suppressionPeriod         #ANOMALY_SUP_PERIOD
ANOMALY_SUP_PERIOD.value          #NUM
ANOMALY_SUP_PERIOD.suppressionUnit#'SECONDS|MINUTES|HOURS'
ANOMALY.isPatternLevelSuppression #BOOL

                                  ┌──────────────────────┐
                                  │   ANOMALY ITEM API   │
                                  └──────────────────────┘

UpdateAnomaly()                   #Req: ANOMALY
                                  #  - only anomalyDetectorArn, anomalyId, patternId
                                  #  - only one with baseline, suppressionType, suppressionPeriod
                                  #Res: empty
ListAnomalies()                   #Req: ANOMALY
                                  #  - only anomalyDetectorArn
                                  #  - only suppressed BOOL -> suppressionState '[UN]SUPPRESSED'
                                  #Res: anomalies ANOMALY_ARR

                                  ┌──────────────────────────┐
                                  │   ANOMALY ITEM METRICS   │
                                  └──────────────────────────┘

AWS/Logs/AnomalyCount             #NUM of ANOMALYs

DVAR LogAnomalyDetector           #'DETECTOR'
DVAR LogAnomalyPriority           #STR. ANOMALY.priority

                                  ┌─────────────────────┐
                                  │   RESOURCE POLICY   │
                                  └─────────────────────┘

LOG_POLICY                        #Resource-based POLICY on LOG_GROUP|LOG_STREAM
                                  #LOG_GROUP|LOG_STREAM's owner has full permissions by default
                                  #Not logged by CloudTrail
                                  #Max 10 per REGION
LOG_POLICY.policyName             #'LOG_POLICY'
LOG_POLICY.lastUpdatedTime        #DATE_NUM

LOG_POLICY.policyDocument         #IAM 'POLICY'
                                  #STATEMENT.Principal can only be SERVICE_DOMAIN, ACCOUNT_ID or '*'
                                  #Max 5KB unless vended logs

                                  ┌─────────────────────────┐
                                  │   RESOURCE POLICY API   │
                                  └─────────────────────────┘

PutResourcePolicy()               #Req: LOG_POLICY
                                  #  - no lastUpdatedTime
                                  #Res: resourcePolicy LOG_POLICY
DescribeResourcePolicies()        #Req: empty
                                  #Res: resourcePolicies LOG_POLICY_ARR
DeleteResourcePolicy()            #Req: LOG_POLICY
                                  #  - only policyName
                                  #Res: empty

                                  ┌─────────────────────────┐
                                  │   RESOURCE POLICY IAC   │
                                  └─────────────────────────┘

AWS::Logs::ResourcePolicy         #RESPROPs: PolicyName, PolicyDocument STR

new ResourcePolicy
 (...CARGS[, OPTS])               #CLOG_POLICY. CKRESOURCE wrapping LOG_POLICY

OPTS.resourcePolicyName           #LOG_POLICY.policyName (def: new CID)
OPTS.policyStatements             #CSTATEMENT_ARR. LOG_POLICY.policyDocument
                                  #If PRINCIPAL is { AWS: ARN } or has CPRINCIPAL.principalAccount, automatically converts to { AWS: ACCOUNT_ID }

ICLOG_GROUP                       #Is RGRANTABLE, using CLOG_POLICY under-the-hood

ICLOG_GROUP.grant
 (YGRANTABLE,'ACTION',...)->CGRANT#
ICLOG_GROUP.grantRead
 (YGRANTABLE)->CGRANT             #Allows logs:FilterLogEvents|GetLogEvents|GetLogGroupFields|DescribeLogGroups|DescribeLogStreams
ICLOG_GROUP.grantWrite
 (YGRANTABLE)->CGRANT             #Allows logs:CreateLogStream|PutLogEvents

                                  ┌─────────────────┐
                                  │   VENDED LOGS   │
                                  └─────────────────┘

VENDED LOGS ==>                   #When another SERVICE calls PutLogEvents()

VENDED LOGS TO LOG_STREAM ==>     #Some vended logs are done directly to a LOG_STREAM called /aws/vendedlogs/SERVICE

VENDED LOGS TO S3 ==>             #Some vended logs are sent to a S3 BUCKET, at BUCKET/AWSLogs/account-ID/ACCOUNT_ID/*, every 5m
                                  #Uses a LOG_GROUP internally

VENDED LOGS TO KINESIS ==>        #Some vended logs are sent to a Kinesis FIREHOSE
                                  #Uses a LOG_GROUP internally

VENDED LOGS V1 ==>                #Enabling|disabling is done inside the specific SERVICE

VENDED LOGS V2 ==>                #Enabling|disabling is done with DELIVERY
                                  #This allows using multiple source|destinations
                                  #Used only by very few SERVICEs at the moment

                                  ┌──────────────────────┐
                                  │   VENDED LOGS AUTH   │
                                  └──────────────────────┘

VENDED LOGS TO LOG_STREAM         #Must use a LOG_POLICY.policyDocument with:
 PERMISSIONS ==>                  #  - Principal.Service 'delivery.logs.amazonaws.com'
                                  #  - PACTION logs:PutLogEvents|CreateLogStream
                                  #  - COND_KEY aws:SourceArn LOG_GROUP_ARN
                                  #  - COND_KEY aws:SourceAccount|SourceOrg*
                                  #Some SERVICEs (e.g. CloudTrail) require specifying a ROLE_ARN instead of LOG_POLICY.policyDocument

VENDED LOGS TO S3 PERMISSIONS ==> #Must use a BUCKET POLICY with:
                                  #  - Principal.Service 'delivery.logs.amazonaws.com'
                                  #  - PACTION s3:GetBucketAcl on BUCKET, s3:PutObject on BUCKET/AWSLogs/account-ID/*
                                  #     - also some kms:* if using S3-KMS (see its doc)
                                  #  - COND_KEY aws:SourceArn LOG_GROUP_ARN
                                  #  - COND_KEY aws:SourceAccount|SourceOrg*
                                  #  - COND_KEY s3:x-amz-acl 'bucket-owner-full-control' (only for s3:PutObject)

VENDED LOGS TO KINESIS
 PERMISSIONS ==>                  #
AWSServiceRoleForLogDelivery      #SERVICE_LINKED_ROLE used for Kinesis FIREHOSE
                                  #Automatically created, if PACTION iam:CreateServiceLinkedRole
                                  #Trust policy allows 'delivery.logs.amazonaws.com' to sts:AssumeRole
AWSServiceRoleForLogDeliveryPolicy#AWS managed POLICY used by AWSServiceRoleForLogDelivery
                                  #Allows PACTIONs firehose:PutRecord[Batch]|ListTagsForDeliveryStream
                                  #  - providing Firehose delivery stream has TAG LogDeliveryEnabled 'true'
                                  #     - automatically setup by AWS, providing PACTION firehose:TagDeliveryStream

PACTION logs:Create|Update|Get
 |List|DeleteLogDelivery          #Required for vended logs v1 (not v2). Resource is '*'

                                  ┌───────────────────┐
                                  │   DELIVERY MAIN   │
                                  └───────────────────┘

DELIVERY                          #Association between a DELIVERY_SRC and 1|n DELIVERY_DESTs
DELIVERY.arn                      #DELIVERY_ARN. arn:aws:logs:REGION:ACCOUNT_ID:delivery:DELIVERY_MID
DELIVERY.id                       #DELIVERY_MID

DELIVERY.deliverySourceName       #'DELIVERY_SRC'
DELIVERY.deliveryDestinationArn   #DELIVERY_DEST_ARN

DELIVERY.tags                     #TAGS

                                  ┌───────────────────────┐
                                  │   DELIVERY MAIN API   │
                                  └───────────────────────┘

CreateDelivery()                  #Req: DELIVERY
                                  #  - no arn, id, deliveryDestinationType
                                  #Res: delivery DELIVERY
GetDelivery()                     #Req: DELIVERY
                                  #  - only id
                                  #Res: delivery DELIVERY
DeleteDelivery()                  #Req: DELIVERY
                                  #  - only id
                                  #Res: empty

                                  ┌───────────────────────┐
                                  │   DELIVERY MAIN IAC   │
                                  └───────────────────────┘

AWS::Logs::Delivery               #RESPROPs: DeliverySourceName, DeliveryDestinationArn, Tags
                                  #RESATTRs: Arn, DeliveryId, DeliveryDestinationType

                                  ┌─────────────────────┐
                                  │   DELIVERY SOURCE   │
                                  └─────────────────────┘

DELIVERY_SRC                      #RESOURCE on a given SERVICE producing vended logs
DELIVERY_SRC.arn                  #DELIVERY_SRC_ARN. arn:aws:logs:REGION:ACCOUNT_ID:delivery-source:DELIVERY_SRC
DELIVERY_SRC.name                 #'DELIVERY_SRC'

DELIVERY_SRC|DELIVERY_TEMPLATE
 .service                         #'SERVICE'
DELIVERY_SRC.resourceArns         #ARN_ARR. Only one item
DELIVERY_SRC|DELIVERY_TEMPLATE
 .logType                         #STR. SERVICE-specific

DELIVERY_SRC.tags                 #TAGS

                                  ┌──────────────────────────┐
                                  │   DELIVERY SOURCE AUTH   │
                                  └──────────────────────────┘

COND_KEY logs:
 LogGeneratingResourceArns        #DELIVERY_SRC_ARN_ARR. Only for PutDeliverySource()

                                  ┌─────────────────────────┐
                                  │   DELIVERY SOURCE API   │
                                  └─────────────────────────┘

PutDeliverySource()               #Req: DELIVERY_SRC
                                  #  - no arn, service
                                  #  - resourceArns ARN_ARR -> resourceArn ARN
                                  #Res: deliverySource DELIVERY_SRC
GetDeliverySource()               #Req: DELIVERY_SRC
                                  #  - only name
                                  #Res: deliverySource DELIVERY_SRC
DescribeDeliverySources()         #Req: empty
                                  #Res: deliverySources DELIVERY_SRC_ARR
DeleteDeliverySource()            #Req: DELIVERY_SRC
                                  #  - only name
                                  #Res: empty

                                  ┌─────────────────────────┐
                                  │   DELIVERY SOURCE IAC   │
                                  └─────────────────────────┘

AWS::Logs::DeliverySource         #RESPROPs: Name, ResourceArn, LogType, Tags
                                  #RESATTRs: Arn, Service, ResourceArns

                                  ┌──────────────────────────┐
                                  │   DELIVERY DESTINATION   │
                                  └──────────────────────────┘

DELIVERY_DEST                     #Where logs from DELIVERY_SRC are sent
DELIVERY_DEST.arn                 #DELIVERY_DEST_ARN. arn:aws:logs:REGION:ACCOUNT_ID:delivery-destination:DELIVERY_DEST
DELIVERY_DEST.name                #'DELIVERY_DEST'

DELIVERY[_DEST|_TEMPLATE]
 .deliveryDestinationType         #'CWL' (CloudWatch Logs), 'S3' or 'FH' (Firehose)
DELIVERY_DEST
 .deliveryDestinationConfiguration
 .destinationResourceArn          #LOG_GROUP_ARN|BUCKET_ARN|FIREHOSE_ARN

DELIVERY_DEST.outputFormat        #'json', 'plain', 'w3c', 'raw', or 'parquet'
DELIVERY_TEMPLATE
 .allowedOutputFormats            #STR_ARR. Possible values for DELIVERY_DEST.outputFormat

DELIVERY_DEST.tags                #TAGS

                                  ┌───────────────────────────────┐
                                  │   DELIVERY DESTINATION AUTH   │
                                  └───────────────────────────────┘

COND_KEY logs:
 DeliveryDestinationResourceArn   #DELIVERY_DEST_ARN. Only for PutDeliveryDestination()

                                  ┌──────────────────────────────┐
                                  │   DELIVERY DESTINATION API   │
                                  └──────────────────────────────┘

PutDeliveryDestination()          #Req: DELIVERY_DEST
                                  #  - no arn, deliveryDestinationType
                                  #Res: deliveryDestination DELIVERY_DEST
GetDeliveryDestination()          #Req: DELIVERY_DEST
                                  #Res: deliveryDestination DELIVERY_DEST
DescribeDeliveryDestinations()    #Req: empty
                                  #Res: deliveryDestinations DELIVERY_DEST_ARR
DeleteDeliveryDestination()       #Req: DELIVERY_DEST
                                  #  - only name
                                  #Res: empty

                                  ┌──────────────────────────────┐
                                  │   DELIVERY DESTINATION IAC   │
                                  └──────────────────────────────┘

AWS::Logs::DeliveryDestination    #RESPROPs: Name, DestinationResourceArn, Tags
                                  #RESATTRs: Arn, DeliveryDestinationType

                                  ┌───────────────────────┐
                                  │   DELIVERY TEMPLATE   │
                                  └───────────────────────┘

DELIVERY_TEMPLATE.resourceType    #'RESTYPE'

DELIVERY_TEMPLATE
 .defaultDeliveryConfigValues     #DELIVERY_FIELDS
DELIVERY[_FIELDS].recordFields    #Only include specific 'COL'_ARR (def: all)
                                  #Max 128 items, max 'COL' 64 chars
DELIVERY_TEMPLATE.allowedFields   #ALLOWED_FIELD_ARR. Possible values for DELIVERY[_FIELDS].recordFields
ALLOWED_FIELD.name                #'COL'
ALLOWED_FIELD.mandatory           #BOOL. Whether required

DELIVERY[_FIELDS].fieldDelimiter  #Delimiter STR when outputFormat 'plain|w3c|raw'
                                  #Max 5 chars
DELIVERY_TEMPLATE
 .allowedFieldDelimiters          #STR_ARR. Possible values for DELIVERY[_FIELDS].fieldDelimiter

DELIVERY[_FIELDS]                 #DELIVERY_S3
 .S3DeliveryConfiguration         #Only when deliveryDestinationType 'S3'
DELIVERY_S3.suffixPath            #STR prefixed to S3 OBJECT path
                                  #Some SERVICEs allow for $VARs in PATH
                                  #Max 256 chars
DELIVERY_TEMPLATE
 .allowedSuffixPathFields         #STR_ARR. Possible value for DELIVERY_S3.suffixPath
DELIVERY_S3
 .enableHiveCompatiblePath        #BOOL (def: false). Use a STR prefix to S3 OBJECT path to make it work with Apache Hive

                                  ┌────────────────────────────┐
                                  │   DELIVERY TEMPLATE AUTH   │
                                  └────────────────────────────┘

DELIVERY_TEMPLATE
 .allowedActionForAllowVendedLogs
 DeliveryForResource              #'PACTION' needed to create a DELIVERY_SRC with this RESTYPE

                                  ┌───────────────────────────┐
                                  │   DELIVERY TEMPLATE API   │
                                  └───────────────────────────┘

UpdateDeliveryConfiguration()     #Req: DELIVERY_FIELDS
                                  #  - also DELIVERY.id
                                  #Res: empty
DescribeConfigurationTemplates()  #Req: DELIVERY_TEMPLATE
                                  #  - no allowed*, defaultDeliveryConfigValues
                                  #  - *Type STR -> *Types STR_ARR
                                  #Res: configurationTemplates DELIVERY_TEMPLATE_ARR

                                  ┌─────────────────────┐
                                  │   DELIVERY POLICY   │
                                  └─────────────────────┘

DELIVERY_POLICY                   #Resource-based POLICY for DELIVERY_DEST
                                  #Required if cross-ACCOUNT
DELIVERY_POLICY
 .deliveryDestinationName         #'DELIVERY_REST'
DELIVERY_POLICY
 .deliveryDestinationPolicy       #'POLICY_DOC'

                                  ┌─────────────────────────┐
                                  │   DELIVERY POLICY API   │
                                  └─────────────────────────┘

PutDeliveryDestinationPolicy()    #Req: DELIVERY_POLICY
                                  #Res: policy DELIVERY_POLICY
                                  #  - no deliveryDestinationName
GetDeliveryDestinationPolicy()    #Req: DELIVERY_POLICY
                                  #  - only deliveryDestinationName
                                  #Res: policy DELIVERY_POLICY
                                  #  - no deliveryDestinationName
DeleteDeliveryDestinationPolicy() #Req: DELIVERY_POLICY
                                  #  - only deliveryDestinationName
                                  #Res: empty

                                  ┌─────────────────────────┐
                                  │   DELIVERY POLICY IAC   │
                                  └─────────────────────────┘

AWS::Logs::DeliveryDestination    #Includes RESPROPs: DeliveryDestinationPolicy POLICY_DOC_OBJ

                                  ┌───────────────────────┐
                                  │   SUBSCRIPTION MAIN   │
                                  └───────────────────────┘

SUBSCRIPTION                      #Send a LOG_GROUP's LLEVENTs to a Lambda FUNCTION or Kinesis STREAM|FIREHOSE
                                  #On delivery failure due to 5** or throttling, retry for up to 24h
                                  #Max 2 per LOG_GROUP
SUBSCRIPTION.filterName           #'SUBSCRIPTION'
SUBSCRIPTION.creationTime         #DATE_NUM

SUBSCRIPTION.logGroupName         #'LOG_GROUP'
                                  #To apply on all LOG_GROUPs, see APOLICY

SUBSCRIPTION.filterPattern        #'FILTER_PATTERN'
SUBSCRIPTION
 .applyOnTransformedLogs          #BOOL (def: false). Use TRANSFORMER (if any)

SUBSCRIPTION.destinationArn       #ARN of either Lambda FUNCTION, Kinesis STREAM|FIREHOSE or DESTINATION

                                  ┌────────────────────────────┐
                                  │   SUBSCRIPTION MAIN AUTH   │
                                  └────────────────────────────┘

SUBSCRIPTION.roleArn              #ROLE_ARN used to write LLEVENTs onto SUBSCRIPTION.destinationArn
                                  #Requires PACTION iam:PassRole
                                  #If using a DESTINATION, should use DESTINATION.roleArn instead
                                  #  - unless logs come from another SERVICE, in which case:
                                  #     - both SUBSCRIPTION|DESTINATION.roleArn must be used
                                  #     - SUBSCRIPTION.roleArn must grant PACTION logs:PutLogEvents instead

                                  ┌───────────────────────────┐
                                  │   SUBSCRIPTION MAIN API   │
                                  └───────────────────────────┘

PutSubscriptionFilter()           #Req: SUBSCRIPTION
                                  #  - no creationTime
                                  #Res: empty
DescribeSubscriptionFilters()     #Req: SUBSCRIPTION
                                  #  - only filterName -> filterNamePrefix STR
                                  #  - only logGroupName
                                  #Res: subscriptionFilters SUBSCRIPTION_ARR
DeleteSubscriptionFilter()        #Req: SUBSCRIPTION
                                  #  - only filterName, logGroupName
                                  #Res: empty

                                  ┌───────────────────────────┐
                                  │   SUBSCRIPTION MAIN IAC   │
                                  └───────────────────────────┘

AWS::Logs::SubscriptionFilter     #RESPROPs: FilterName, LogGroupName, FilterPattern, DestinationArn, RoleArn

new SubscriptionFilter
 (...CARGS, OPTS)                 #CSUBSCRIPTION. CKRESOURCE wrapping SUBSCRIPTION
ICLOG_GROUP.addSubscriptionFilter
 ('CSUBSCRIPTION'[, OPTS])
 ->CSUBSCRIPTION                  #Same but fills OPTS.logGroup
OPTS.filterName                   #SUBSCRIPTION.*
OPTS.logGroup                     #ICLOG_GROUP. SUBSCRIPTION.logGroupName
OPTS.filterPattern                #CFILTER_PATTERN. SUBSCRIPTION.filterPattern
OPTS.destination                  #SUBSCRIPTION.destinationArn. Either:
                                  #  - CDESTINATION: SUBSCRIPTION.roleArn not needed
                                  #  - CLAMBDA_DESTINATION: uses Lambda PERMISSIONs instead of SUBSCRIPTION.roleArn
                                  #  - CKINESIS_DESTINATION: SUBSCRIPTION.roleArn passed

                                  ┌───────────────────────────┐
                                  │   SUBSCRIPTION MAIN SAM   │
                                  └───────────────────────────┘

AWS::Serverless::Function         #Includes RESPROPs: Events.EVENT:
                                  #  - Type 'CloudWatchLogs': create a SUBSCRIPTION 'FUNCTION{EVENT}' + Lambda PERMISSION 'FUNCTION{EVENT}Permission'
                                  #  - Properties: FilterPattern, LogGroupName

                                  ┌───────────────────────────────┐
                                  │   SUBSCRIPTION MAIN METRICS   │
                                  └───────────────────────────────┘

AWS/Logs/ForwardedLogEvents       #NUM of LLEVENTs sent by SUBSCRIPTION
AWS/Logs/ForwardedBytes           #NUM. Size of LLEVENTs sent by SUBSCRIPTION
AWS/Logs/DeliveryErrors           #NUM of LLEVENTs which failed to be delivered by SUBSCRIPTION
AWS/Logs/DeliveryThrottling       #NUM of LLEVENTs which were throttled when being delivered by SUBSCRIPTION

DVAR FilterName                   #'SUBSCRIPTION'
DVAR DestinationType              #'lambda|kinesis|firehose'

                                  ┌────────────────────────────┐
                                  │   SUBSCRIPTION MAIN LINT   │
                                  └────────────────────────────┘

cfn-lint E2529                    #Validate SUBSCRIPTION

                                  ┌──────────────────────────┐
                                  │   SUBSCRIPTION PAYLOAD   │
                                  └──────────────────────────┘

SPAYLOAD                          #Sent to the SUBSCRIPTION destination
                                  #Is OBJ_JSON that is base64'd and gzip'd
SPAYLOAD.owner                    #ACCOUNT_ID
SPAYLOAD.logGroup                 #'LOG_GROUP'
SPAYLOAD.logStream                #'LOG_STREAM'
SPAYLOAD.subscriptionFilters      #'SUBSCRIPTION'_ARR
SPAYLOAD.messageType              #Either:
                                  #  - 'DATA_MESSAGE': usual one
                                  #  - 'CONTROL_MESSAGE': ping
SPAYLOAD.logEvents                #LLEVENT_ARR
                                  #Only message, timestamp, and id LLEVENT_MID
SPAYLOAD.policyLevel              #'ACCOUNT_LEVEL_POLICY' (if using APOLICY)

                                  ┌─────────────────────────┐
                                  │   SUBSCRIPTION LAMBDA   │
                                  └─────────────────────────┘

INVOCATION ==>                    #InvocationType 'Event'

REQ.awslogs.data                  #'SPAYLOAD_JSON_GZIP_BASE64'
                                  #@middy/event-normalizer (see its doc) does base64 decoding + JSON parsing

QUERY CLOUDWATCH_LOGS             #JMESPath 'QUERY' (see its doc) for SPAYLOAD.logEvents LLEVENT_ARR, through REQ.awslogs.data
                                  #Decompressed, base64 decoded, JSON parsed

RES                               #None

                                  ┌──────────────────────────────┐
                                  │   SUBSCRIPTION LAMBDA AUTH   │
                                  └──────────────────────────────┘

PERMISSION ==>                    #Must use LAMBDA FUNC_VERSION.Role, not SUBSCRIPTION.roleArn
                                  #Use a LAMBDA PERMISSION policy with:
                                  #  - Principal.Service 'logs.amazonaws.com'
                                  #  - PACTION lambda:InvokeFunction
                                  #  - COND_KEY aws:SourceArn LOG_GROUP_ARN
                                  #     - ending with :* if using an APOLICY
                                  #  - COND_KEY aws:SourceAccount|SourceOrg*

                                  ┌─────────────────────────────┐
                                  │   SUBSCRIPTION LAMBDA IAC   │
                                  └─────────────────────────────┘

new LambdaDestination
 (ICANYFUNC[, OPTS])              #CLAMBDA_DESTINATION
OPTS.addPermissions               #If true (def), adds Lambda PERMISSION allowing logs.amazonaws.com

                                  ┌────────────────────────────────┐
                                  │   SUBSCRIPTION LAMBDA PULUMI   │
                                  └────────────────────────────────┘

LOG_GROUP.on[Decoded]Event
 ('FUNC', EFUNC, RPROPS, KROPTS)
 ->LOG_GROUP_EVENT_SUBSCRIPTION
new LogGroupEventSubscription     #Lambda SUBSCRIPTION
 ('FUNC', LOG_GROUP,EFUNC,KROPTS) #Child of CW.lambda.EventSubscription (see its doc)
                                  #If `Decoded`, decode base64 + gzip + JSON from PAYLOAD
RPROPS.filterPattern              #Forwarded to SUBSCRIPTION

                                  ┌──────────────────────────┐
                                  │   SUBSCRIPTION KINESIS   │
                                  └──────────────────────────┘

SUBSCRIPTION.distribution         #Whether to group:
                                  #  - 'ByLogStream': by LOG_STREAM
                                  #  - 'Random': randomly, i.e. uniform distribution of LLEVENTs

                                  ┌───────────────────────────────┐
                                  │   SUBSCRIPTION KINESIS AUTH   │
                                  └───────────────────────────────┘

PERMISSIONS ==>                   #Must use SUBSCRIPTION.roleArn
                                  #Use a trust policy for Principal.Service 'logs.amazonaws.com'
                                  #  - COND_KEY aws:SourceArn arn:aws:logs:REGION:ACCOUNT_ID:*
                                  #Use a ROLE policy to allow PACTION kinesis:PutRecord

                                  ┌──────────────────────────────┐
                                  │   SUBSCRIPTION KINESIS IAC   │
                                  └──────────────────────────────┘

AWS::Logs::SubscriptionFilter     #Includes RESPROPs: Distribution

CSUBSCRIPTION_OPTS.distribution   #SUBSCRIPTION.*

new KinesisDestination
 (IKINESIS_STREAM[, OPTS])        #CKINESIS_DESTINATION
OPTS.role                         #ICROLE used as SUBSCRIPTION.roleArn
                                  #Def: automatically created, assumable by logs.amazonaws.com
                                  #Automatically allows logs:CreateLogStream|PutLogEvents and iam:PassRole

                                  ┌────────────────────────────────┐
                                  │   SUBSCRIPTION CROSS-ACCOUNT   │
                                  └────────────────────────────────┘

DESTINATION                       #SUBSCRIPTION.destinationArn that can be used in a different ACCOUNT
                                  #Can only be Kinesis STREAM|FIREHOSE, not Lambda FUNCTION
                                  #Must be in same REGION as LOG_GROUP
                                  #A test SPAYLOAD is sent on DESTINATION creation
DESTINATION.arn                   #DESTINATION_ARN. arn:aws:logs:REGION:ACCOUNT_ID:destination:DESTINATION
DESTINATION.destinationName       #'DESTINATION'
DESTINATION.creationTime          #DATE_NUM

DESTINATION.targetArn             #Kinesis STREAM|FIREHOSE_ARN

DESTINATION.forceUpdate           #BOOL (def: false). Allow upserting.

                                  ┌─────────────────────────────────────┐
                                  │   SUBSCRIPTION CROSS-ACCOUNT AUTH   │
                                  └─────────────────────────────────────┘

DESTINATION.roleArn               #Like SUBSCRIPTION.roleArn, but for DESTINATION.targetArn

DESTINATION.accessPolicy          #Resource-based 'POLICY' to allow DESTINATION to be used as SUBSCRIPTION.roleArn
                                  #E.g. can restrict which ACCOUNTs can send to DESTINATION
                                  #Must have:
                                  #  - Principal.Service logs.REGION.amazonaws.com
                                  #  - PACTION logs:PutSubscriptionFilter
                                  #  - Resource DESTINATION_ARN
                                  #Max 5KB

                                  ┌────────────────────────────────────┐
                                  │   SUBSCRIPTION CROSS-ACCOUNT API   │
                                  └────────────────────────────────────┘

PutDestination()                  #Req: DESTINATION
                                  #  - no arn, creationTime, accessPolicy, forceUpdate
                                  #Res: destination DESTINATION
                                  #  - no tags, forceUpdate
PutDestinationPolicy()            #Req: DESTINATION
                                  #  - only destinationName, accessPolicy, forceUpdate
                                  #Res: empty
DescribeDestinations()            #Req: DESTINATION
                                  #  - only destinationName -> destinationNamePrefix STR
                                  #Res: destinations DESTINATION_ARR
                                  #  - no tags, forceUpdate
DeleteDestination()               #Req: DESTINATION
                                  #  - only destinationName
                                  #Res: empty

                                  ┌────────────────────────────────────┐
                                  │   SUBSCRIPTION CROSS-ACCOUNT IAC   │
                                  └────────────────────────────────────┘

AWS::Logs::Destination            #RESPROPs:
                                  #  - DestinationName, TargetArn, RoleArn
                                  #  - DestinationPolicy STR: DESTINATION.accessPolicy
                                  #RESATTRs: Arn

new CrossAccountDestination
 (...CARGS, OPTS)                 #CDESTINATION. CKRESOURCE wrapping DESTINATION
CDESTINATION.destinationArn
OPTS.targetArn                    #DESTINATION.*
OPTS|CDESTINATION.destinationName #DESTINATION.destinationName (def: 'STACK-CDESTINATION')
OPTS.role                         #ICROLE. DESTINATION.roleArn
CDESTINATION.policyDocument       #CPOLICY_DOC. DESTINATION.accessPolicy
CDESTINATION
 .addToPolicy(CSTATEMENT)         #

                                  ┌─────────────────┐
                                  │   INTEGRATION   │
                                  └─────────────────┘

INTEGRATION                       #Redirect LLEVENTs to Amazon OpenSearch
                                  #QUERYs can query OpenSearch using SQL|PPL too
                                  #Only one per integrationType per ACCOUNT
                                  #Not fully documented yet
INTEGRATION.integrationName       #'INTEGRATION'
                                  #Only [:alnum:].-_/# and max 256 chars
INTEGRATION.integrationStatus     #Can be 'PROVISIONING', 'ACTIVE', 'FAILED'

INTEGRATION.force                 #BOOL. If false (def), cannot delete if any OpenSearch DASHBOARD
                                  #If true, deletes them too

INTEGRATION.integrationType       #Always 'OPENSEARCH'

INTEGRATION.integrationDetails
 .openSearchIntegrationDetails    #Not documented yet

INTEGRATION.resourceConfig
 .openSearchResourceConfig        #Not documented yet

QUERY[_RESULTS]|QUERYDEF          #One of:
 .queryLanguage                   #  - "CWLI" (def): Logs Insights QL (see above)
                                  #  - "SQL": OpenSearch SQL
                                  #  - "PPL": OpenSearch PPL

                                  ┌─────────────────────┐
                                  │   INTEGRATION API   │
                                  └─────────────────────┘

PutIntegration()                  #Req: INTEGRATION
                                  #  - only one with resourceConfig
                                  #Res: INTEGRATION
                                  #  - no integrationType
ListIntegrations()                #Req: INTEGRATION
                                  #  - integrationName -> integrationNamePrefix
                                  #Res: integrationSummaries INTEGRATION_ARR
GetIntegration()                  #Req: INTEGRATION
                                  #  - only integrationName
                                  #Res: INTEGRATION
                                  #  - only one with integrationDetails
DeleteIntegration()               #Req: INTEGRATION
                                  #  - only one with force
                                  #  - only integrationName
                                  #Res: empty

                                  ┌─────────────────────┐
                                  │   INTEGRATION IAC   │
                                  └─────────────────────┘

AWS::Logs::Integration            #RESPROPs: IntegrationName, IntegrationType, ResourceConfig
                                  #RESATTRs: IntegrationStatus

                                  ┌────────────┐
                                  │   EXPORT   │
                                  └────────────┘

EXPORT                            #Export LOG_GROUP to S3 OBJECTs
                                  #Meant for one-time export
                                  #  - prefer DELIVERY for continuous one
                                  #24h timeout
                                  #Max 1 at a time per ACCOUNT
EXPORT.taskId                     #EXPORT_MID
EXPORT.taskName                   #'EXPORT'
EXPORT.executionInfo.creationTime #DATE_NUM

EXPORT.logGroupName               #'LOG_GROUP'
EXPORT.logStreamNamePrefix        #STR. Only if 'LOG_STREAM' start with STR
EXPORT.from|to                    #DATE_NUM. Filter by LLEVENT.timestamp

EXPORT.destination                #S3 'BUCKET'
                                  #Must be in same REGION as LOG_GROUP
EXPORT.destinationPrefix          #STR. Prefix to all S3 OBJECTs

EXPORT.status.code                #STR among:
                                  #  - PENDING
                                  #  - RUNNING
                                  #  - PENDING_CANCEL, CANCELLED
                                  #  - COMPLETED, FAILED
EXPORT.status.message             #STR
EXPRT.executionInfo.completionTime#DATE_NUM

                                  ┌─────────────────┐
                                  │   EXPORT AUTH   │
                                  └─────────────────┘

PERMISSIONS ==>                   #Must allow:
                                  #  - Principal.Service 'logs.amazonaws.com'
                                  #  - PACTION s3:GetBucketAcl on BUCKET, s3:PutObject on OBJECTs
                                  #     - also some kms:* if using S3-KMS (see its doc)
                                  #  - COND_KEY aws:SourceArn LOG_GROUP_ARN
                                  #  - COND_KEY aws:SourceAccount|SourceOrg*
                                  #  - COND_KEY s3:x-amz-acl 'bucket-owner-full-control' (only for s3:PutObject)

                                  ┌────────────────┐
                                  │   EXPORT API   │
                                  └────────────────┘

CreateExportTask()                #Req: EXPORT
                                  #  - no taskId, executionInfo, status
                                  #Res: EXPORT
                                  #  - only taskId
DescribeExportTasks()             #Req: EXPORT
                                  #  - only taskId, statusCode
                                  #Res: exportTasks EXPORT_ARR
                                  #  - no logStreamNamePrefix
CancelExportTask()                #Req: EXPORT
                                  #  - only taskId
                                  #Res: empty

                                  ┌─────────┐
                                  │   KMS   │
                                  └─────────┘

KMS_ASSOC                         #Sets default KMS_KEY_ID for LOG_GROUP|QUERY_RES
                                  #Not logged by CloudTrail
KMS_ASSOC.kmsKeyId                #KMS_KEY_ID
KMS_ASSOC.logGroupName            #'LOG_GROUP'
KMS_ASSOC.resourceIdentifier      #Either:
                                  #  - LOG_GROUP_ARN
                                  #  - 'arn:aws:logs:REGION:ACCOUNT_ID:query-result:*'

LOG_GROUP.kmsKeyId                #KMS_KEY_ID used to encrypt LLEVENTs at rest
                                  #Default: automatically managed
QUERY_RES.encryptionKey           #KMS_KEY_ID used to encrypt QUERY_RESULTs at rest
                                  #Default: automatically managed

                                  ┌──────────────┐
                                  │   KMS AUTH   │
                                  └──────────────┘

PERMISSIONS ==>                   #Must allow:
                                  #  - Principal.Service 'logs.amazonaws.com'
                                  #  - PACTIONs kms:[Re]Encrypt*|Decrypt*|GenerateDataKey*|Describe*
                                  #  - COND_KEY aws:SourceArn KMS_ACCOC.resourceIdentifier
                                  #  - COND_KEY aws:SourceAccount|SourceOrg*
                                  #  - COND_KEY kms:EncryptionContext:aws:logs:arn LOG_GROUP_ARN

                                  ┌─────────────┐
                                  │   KMS API   │
                                  └─────────────┘

AssociateKmsKey()                 #Req: KMS_ASSOC
                                  #Res: empty
DisassociateKmsKey()              #Req: KMS_ASSOC
                                  #  - no kmsKeyId
                                  #Res: empty

                                  ┌─────────────┐
                                  │   KMS IAC   │
                                  └─────────────┘

AWS::Logs::LogGroup               #Includes RESPROPs: KmsKeyId

CLOG_GROUP_OPTS.encryptionKey     #KMS ICKEY

                                  ┌──────────────┐
                                  │   KMS LINT   │
                                  └──────────────┘

cdk-nag
 CloudWatchLogGroupEncrypted      #Validate LOG_GROUP.kmsKeyId is set

                                  ┌───────────────┐
                                  │   MASK MAIN   │
                                  └───────────────┘

DATA_POLICY                       #Handle sensitive data in LLEVENTs of a LOG_GROUP
                                  #Not logged by CloudTrail
DATA_POLICY.lastUpdatedTime       #DATE_NUM

DATA_POLICY.logGroupIdentifier    #LOG_GROUP_ARN
                                  #In input, can also be 'LOG_GROUP'
                                  #To apply on all LOG_GROUPs, see APOLICY

DATA_POLICY.policyDocument        #'MASK_POLICY'
                                  #Max 30KB

LOG_GROUP.dataProtectionStatus    #STR. Whether LOG_GROUP has a DATA_POLICY, among:
                                  #  - DISABLED
                                  #  - ACTIVATED
                                  #  - DELETED, ARCHIVED

LLEVENTS_REQ|QUERY_RECORD_REQ
 .unmask                          #BOOL (def: false). If true, do not mask.

unmask                            #QUERY COMMAND to not mask
unmask(FIELD)->STR                #Same for a single FIELD

                                  ┌────────────────────┐
                                  │   MASK MAIN AUTH   │
                                  └────────────────────┘

PACTION logs:Unmask               #Required for LLEVENTS_REQ|QUERY_RECORD_REQ.unmask
                                  #This also allows not masking in UI console

                                  ┌───────────────────┐
                                  │   MASK MAIN API   │
                                  └───────────────────┘

PutDataProtectionPolicy()         #Req: DATA_POLICY
                                  #  - no lastUpdatedTime
                                  #Res: DATA_POLICY
GetDataProtectionPolicy()         #Req: DATA_POLICY
                                  #  - only logGroupIdentifier
                                  #Res: DATA_POLICY
DeleteDataProtectionPolicy()      #Req: DATA_POLICY
                                  #  - only logGroupIdentifier
                                  #Res: empty

                                  ┌─────────────────┐
                                  │   MASK POLICY   │
                                  └─────────────────┘

MASK_POLICY                       #Max 30KB
MASK_POLICY.Version               #Always '2021-06-01'
MASK_POLICY.Name                  #'MASK_POLICY'
MASK_POLICY.Description           #STR

MASK_POLICY.Statement             #MASK_STATEMENT_ARR
                                  #Must have 2 items: with MASK_OP.Audit, then with MASK_OP.Deidentify
MASK_STATEMENT.Sid                #'MASK_STATEMENT'
MASK_STATEMENT.Operation          #MASK_OP

MASK_OP.Deidentify.MaskConfig     #Always empty OBJ
                                  #Applies the masking

                                  ┌──────────────────────┐
                                  │   MASK DESTINATION   │
                                  └──────────────────────┘

MASK_OP.Audit.FindingsDestination #MASK_DESTINATION
                                  #Send masked values to a destination
MASK_DESTINATION
 .CloudWatchLogs.LogGroup         #Send to a 'LOG_GROUP'
MASK_DESTINATION.S3.Bucket        #Send to a 'BUCKET'
MASK_DESTINATION
 .Firehose.DeliveryStream         #Send to a Kinesis STREAM_ARN

MPAYLOAD                          #Payload sent to MASK_DESTINATION
MPAYLOAD.auditTimestamp           #'DATE'
MPAYLOAD.resourceArn              #LOG_GROUP_ARN
MPAYLOAD.dataIdentifiers          #DDATAID_ARR
DDATAID.name                      #'DATAID'
DDATAID.count                     #NUM of masked values
DDATAID.detections                #DDATAID_VAL_ARR
DDATAID_VAL.start|end             #NUM. Byte position in 'LMESSAGE'

                                  ┌───────────────────────────┐
                                  │   MASK DESTINATION AUTH   │
                                  └───────────────────────────┘

PACTION logs:CreateLogDelivery    #Required for MASK_DESTINATION
PACTION logs:PutResourcePolicy
 |DescribeResourcePolicies
 |DescribeLogGroups               #Required for MASK_DESTINATION.CloudWatchLogs.LogGroup
PACTION s3:PutBucketPolicy
 |GetBucketPolicy                 #Required for MASK_DESTINATION.S3.Bucket
PACTION firehose:TagDeliveryStream#Required for MASK_DESTINATION.Firehose.DeliveryStream

                                  ┌──────────────────────────────┐
                                  │   MASK DESTINATION METRICS   │
                                  └──────────────────────────────┘

AWS/Logs/LogEventsWithFindings    #NUM of LLEVENTs with masked values
                                  #Requires MASK_OP.Audit

                                  ┌──────────────────────┐
                                  │   MASK IDENTIFIERS   │
                                  └──────────────────────┘

MASK_STATEMENT.DataIdentifier     #'DATAID'_ARR. Defines what to mask
                                  #Must be the same for each MASK_STATEMENT

MASK_POLICY.Configuration         #CUSTOM_DATAID_ARR
 .CustomDataIdentifier            #Max 10 items (soft limit)
CUSTOM_DATAID.Name                #'DATAID'
                                  #Max 128 chars, only [:alnum:]_-
CUSTOM_DATAID.Regex               #'REGEXP'
                                  #Max 200 chars, only ASCII

MANAGED DATAIDS ==>               #One of the following
                                  #Always prepended by arn:aws:dataprotection::aws:data-identifier/...
                                  #Some are COUNTRY-specific
                                  #Some require a keyword nearby, with|without space, _ or -
                                  #  - see online for the list of keywords

AwsSecretKey                      #SECRET_ACCESS_KEY
OpenSshPrivateKey                 #
PgpPrivateKey                     #
PkcsPrivateKey                    #
PuttyPrivateKey                   #

Name                              #Full name. Only latin alphabet
DateOfBirth                       #

EmailAddress                      #
PhoneNumber-COUNTRY               #COUNTRY: BR, DE, ES, FR, GB, IT, US
IpAddress                         #

Address                           #Address
ZipCode-US                        #Zip code
PostalCode-CA                     #Zip code
CepCode-BR                        #Zip code
LatLong                           #GPS coordinates

BankAccountNumber-COUNTRY         #COUNTRY: DE, ES, FR, GB, IT
                                  #Does not mask account numbers known to be used for testing
CreditCardNumber                  #
CreditCardExpiration              #
CreditCardSecurityCode            #

PassportNumber                    #COUNTRY: CA, DE, ES, FR, GB, IT, US
NationalIdentificationNumber      #National ID
 -COUNTRY                         #COUNTRY: DE, ES, IT
InseeCode-FR                      #National ID
NieNumber-ES                      #National ID for foreigners
PermanentResidenceNumber-CA       #National ID for foreigners
IndividualTaxIdenticationNumber   #Tax ID
 -COUNTRY                         #COUNTRY: BR, DE, ES, FR, GB
TaxId                             #Tax ID
                                  #COUNTRY: DE, ES, FR, GB
NifNumber-ES                      #Tax ID
CpfCode-BR                        #Tax ID
RgNumber-BR                       #Tax ID
DriversLicense-COUNTRY            #COUNTRY: AT, AU, BE, BG, CA, CY, CZ, DE, DK, EE, ES, FI, FR, GB, GR, HR, HU, IE, IT, LT, LU, LV, MT, NL, PL, PT, RO, SE, SI, SK, US
ElectoralRollNumber-GB            #Voter ID
Ssn-ES|US                         #Social security ID
NationalInsuranceNumber-GB        #Insurance ID
SocialInsuranceNumber-CA          #Insurance ID
Cnpj-BR                           #Company ID

HealthInsuranceCardNumber-EU      #EU health number
HealthInsuranceNumber-FR          #FR health number
NhsNumber-GB                      #GB health number
PersonalHealthNumber-CA           #CA health number
HealthInsuranceClaimNumber-US     #HICN number
HealthcareProcedureCode-US        #HCPCS code
MedicareBeneficiaryNumber-US      #MBN number
NationalProviderId-US             #NPI number
DrugEnforcementAgencyNumber-US    #DEA number
NationalDrugCode-US               #NDC number

VehicleIdentificationNumber       #ISO 3779|3780

                                  ┌──────────────┐
                                  │   MASK IAC   │
                                  └──────────────┘

AWS::Logs::LogGroup               #Includes RESPROPs: DataProtectionPolicy MASK_POLICY_OBJ

new DataProtectionPolicy(OPTS)    #CDATA_POLICY
CLOG_GROUP_OPTS
 .dataProtectionPolicy            #CDATA_POLICY

OPTS.name                         #MASK_POLICY.Name (def: 'data-protection-policy-cdk')
OPTS.description                  #MASK_POLICY.Description (def: 'cdk generated data protection policy')

OPTS.logGroupAuditDestination     #ICLOG_GROUP. MASK_DESTINATION.CloudWatchLogs.LogGroup
OPTS.s3BucketAuditDestination     #ICBUCKET. MASK_DESTINATION.S3.Bucket
OPTS.deliveryStreamName
 AuditDestination                 #STR. MASK_DESTINATION.Firehose.DeliveryStream

OPTS.identifiers                  #MASK_STATEMENT.DataIdentifier
                                  #ARR of DataIdentifier.*, e.g. DataIdentifier.EMAILADDRESS
new CustomDataIdentifier
 ('DATAID', 'REGEXP')             #CCUSTOM_DATAID. MASK_POLICY.Configuration.CustomDataIdentifier

                                  ┌────────────────────┐
                                  │   ACCOUNT POLICY   │
                                  └────────────────────┘

APOLICY                           #Like DATA_POLICY|SUBSCRIPTION|INDEX_POLICY|TRANSFORMER but for all LOG_GROUPs in an ACCOUNT
                                  #Max 1 per ACCOUNT
                                  #Not logged by CloudTrail
APOLICY.policyName                #'APOLICY'
APOLICY.lastUpdatedTime           #DATE_NUM

APOLICY.accountId                 #ACCOUNT_ID
APOLICY.scope                     #Always 'ALL'

APOLICY.policyType                #Either:
                                  #  - 'DATA_PROTECTION_POLICY': DATA_POLICY
                                  #  - 'SUBSCRIPTION_FILTER_POLICY': SUBSCRIPTION
                                  #  - 'FIELD_INDEX_POLICY': INDEX_POLICY
                                  #  - 'TRANSFORMER_POLICY': TRANSFORMER
APOLICY.policyDocument            #Either:
                                  #  - MASK_POLICY: if policyType 'DATA_PROTECTION_POLICY'
                                  #  - SUBSCRIPTION: if policyType 'SUBSCRIPTION_FILTER_POLICY'
                                  #     - only DestinationArn, RoleArn, FilterPattern, Distribution
                                  #  - INDEX_POLICY.policyDocument: if policyType 'FIELD_INDEX_POLICY'
                                  #  - TRANSFORMER_CONFIG_ARR: if policyType 'TRANSFORMER_POLICY'
APOLICY.selectionCriteria         #With:
                                  #  - DATA_POLICY: none
                                  #  - SUBSCRIPION: 'LogGroupName NOT IN ["LOG_GROUP",...]'
                                  #     - prevents cycles if destination produces logs itself
                                  #  - INDEX_POLICY|TRANSFORMER: 'LogGroupNamePrefix="STR" ...'
                                  #     - max 5 LogGroupNamePrefix
                                  #Exclude specific LOG_GROUPs
                                  #Multiple APOLICYs cannot include some of the same LOG_GROUPs
                                  #Max 25KB

LOG_GROUP.inheritedProperties     #'ACCOUNT_DATA_PROTECTION' if LOG_GROUP has a APOLICY

INDEX_POLICY.source               #Whether 'LOG_GROUP' or 'ACCOUNT'-wide
INDEX_POLICY.policyName           #'APOLICY'

                                  ┌─────────────────────────┐
                                  │   ACCOUNT POLICY AUTH   │
                                  └─────────────────────────┘

PERMISSIONS ==>                   #APOLICY requires DATA_POLICY|SUBSCRIPTION|INDEX_POLICY-related PACTIONs too

                                  ┌────────────────────────┐
                                  │   ACCOUNT POLICY API   │
                                  └────────────────────────┘

PutAccountPolicy()                #Req: APOLICY
                                  #  - no lastUpdatedTime, accountId
                                  #Res: accountPolicy APOLICY
DescribeAccountPolicies()         #Req: APOLICY
                                  #  - only policyName, policyType
                                  #  - only accountId -> accountIdentifiers ACCOUNT_ID_ARR
                                  #     - only when using a monitoring ACCOUNT with CloudWatch cross-account observability
                                  #Res: accountPolicies APOLICY_ARR
DeleteAccountPolicy()             #Req: APOLICY
                                  #  - only policyName, policyType
                                  #Res: empty

                                  ┌────────────────────────┐
                                  │   ACCOUNT POLICY IAC   │
                                  └────────────────────────┘

AWS::Logs::AccountPolicy          #RESPROPs: PolicyName, PolicyType, Scope, PolicyDocument STR, SelectionCriteria
                                  #RESATTRs: AccountId

                                  ┌──────────┐
                                  │   TAGS   │
                                  └──────────┘

RESOURCE_TAGS                     #Not logged by CloudTrail
RESOURCE_TAGS.resourceArn         #LOG_GROUP|DESTINATION_ARN
RESOURCE_TAGS.tags                #TAGS

LOG_GROUP|DESTINATION.tags        #TAGS

                                  ┌──────────────┐
                                  │   TAGS API   │
                                  └──────────────┘

ListTagsForResource()             #Req: RESOURCE_TAGS
                                  #  - only resourceArn
                                  #Res: RESOURCE_TAGS
                                  #  - no resourceArn
TagResource()                     #Req: RESOURCE_TAGS
                                  #Res: empty
UntagResource()                   #Req: RESOURCE_TAGS
                                  #  - tags -> tagKeys STR_ARR
                                  #Res: empty

                                  ┌──────────────┐
                                  │   TAGS IAC   │
                                  └──────────────┘

AWS::Logs::LogGroup               #Includes RESPROPs: Tags