Skip to content

start_import

start_import(
    *,
    config_overrides: Optional[CloudTrailClientConfig] = None,
    destinations: Optional[ImportDestinations] = None,
    import_source: Optional[ImportSource] = None,
    start_event_time: Optional[Date] = None,
    end_event_time: Optional[Date] = None,
    import_id: Optional[UUID] = None,
) -> StartImportResponse

CloudTrail Lake will no longer be open to new customers starting May 31, 2026. If you would like to use CloudTrail Lake, sign up prior to that date. Existing customers can continue to use the service as normal. For more information, see CloudTrail Lake availability change.

Starts an import of logged trail events from a source S3 bucket to a destination event data store. By default, CloudTrail only imports events contained in the S3 bucket's CloudTrail prefix and the prefixes inside the CloudTrail prefix, and does not check prefixes for other Amazon Web Services services. If you want to import CloudTrail events contained in another prefix, you must include the prefix in the S3LocationUri. For more considerations about importing trail events, see Considerations for copying trail events in the CloudTrail User Guide.

When you start a new import, the Destinations and ImportSource parameters are required. Before starting a new import, disable any access control lists (ACLs) attached to the source S3 bucket. For more information about disabling ACLs, see Controlling ownership of objects and disabling ACLs for your bucket.

When you retry an import, the ImportID parameter is required.

If the destination event data store is for an organization, you must use the management account to import trail events. You cannot use the delegated administrator account for the organization.

Parameters:

  • destinations (Optional[ImportDestinations], default: None ) –

    The ARN of the destination event data store. Use this parameter for a new import.

  • import_source (Optional[ImportSource], default: None ) –

    The source S3 bucket for the import. Use this parameter for a new import.

  • start_event_time (Optional[Date], default: None ) –

    Use with EndEventTime to bound a StartImport request, and limit imported trail events to only those events logged within a specified time period. When you specify a time range, CloudTrail checks the prefix and log file names to verify the names contain a date between the specified StartEventTime and EndEventTime before attempting to import events.

  • end_event_time (Optional[Date], default: None ) –

    Use with StartEventTime to bound a StartImport request, and limit imported trail events to only those events logged within a specified time period. When you specify a time range, CloudTrail checks the prefix and log file names to verify the names contain a date between the specified StartEventTime and EndEventTime before attempting to import events.

  • import_id (Optional[UUID], default: None ) –

    The ID of the import. Use this parameter when you are retrying an import.

Raises:

Source code in docs_src/capo_cloudtrail/_services/cloud_trail.py
def start_import(
    self,
    *,
    config_overrides: Optional[CloudTrailClientConfig] = None,
    destinations: Optional[
        "capo_cloudtrail.types.import_destinations.ImportDestinations"
    ] = None,
    import_source: Optional[
        "capo_cloudtrail.types.import_source.ImportSource"
    ] = None,
    start_event_time: Optional["capo_cloudtrail.types.date.Date"] = None,
    end_event_time: Optional["capo_cloudtrail.types.date.Date"] = None,
    import_id: Optional["capo_cloudtrail.types.uuid.UUID"] = None,
) -> "capo_cloudtrail.types.start_import_response.StartImportResponse":
    """<important> <p>CloudTrail Lake will no longer be open to new customers starting May 31, 2026. If you would like to use CloudTrail Lake, sign up prior to that date. Existing customers can continue to use the service as normal. For more information, see <a href="https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-lake-service-availability-change.html">CloudTrail Lake availability change</a>.</p> </important> <p> Starts an import of logged trail events from a source S3 bucket to a destination event data store. By default, CloudTrail only imports events contained in the S3 bucket's <code>CloudTrail</code> prefix and the prefixes inside the <code>CloudTrail</code> prefix, and does not check prefixes for other Amazon Web Services services. If you want to import CloudTrail events contained in another prefix, you must include the prefix in the <code>S3LocationUri</code>. For more considerations about importing trail events, see <a href="https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-copy-trail-to-lake.html#cloudtrail-trail-copy-considerations">Considerations for copying trail events</a> in the <i>CloudTrail User Guide</i>. </p> <p> When you start a new import, the <code>Destinations</code> and <code>ImportSource</code> parameters are required. Before starting a new import, disable any access control lists (ACLs) attached to the source S3 bucket. For more information about disabling ACLs, see <a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/about-object-ownership.html">Controlling ownership of objects and disabling ACLs for your bucket</a>. </p> <p> When you retry an import, the <code>ImportID</code> parameter is required. </p> <note> <p> If the destination event data store is for an organization, you must use the management account to import trail events. You cannot use the delegated administrator account for the organization. </p> </note>

    Args:
        destinations: <p> The ARN of the destination event data store. Use this parameter for a new import. </p>
        import_source: <p> The source S3 bucket for the import. Use this parameter for a new import. </p>
        start_event_time: <p> Use with <code>EndEventTime</code> to bound a <code>StartImport</code> request, and limit imported trail events to only those events logged within a specified time period. When you specify a time range, CloudTrail checks the prefix and log file names to verify the names contain a date between the specified <code>StartEventTime</code> and <code>EndEventTime</code> before attempting to import events. </p>
        end_event_time: <p> Use with <code>StartEventTime</code> to bound a <code>StartImport</code> request, and limit imported trail events to only those events logged within a specified time period. When you specify a time range, CloudTrail checks the prefix and log file names to verify the names contain a date between the specified <code>StartEventTime</code> and <code>EndEventTime</code> before attempting to import events. </p>
        import_id: <p> The ID of the import. Use this parameter when you are retrying an import. </p>

    Raises:
        capo_cloudtrail.errors.account_has_ongoing_import_exception.AccountHasOngoingImportException: <p> This exception is thrown when you start a new import and a previous import is still in progress. </p>
        capo_cloudtrail.errors.event_data_store_arn_invalid_exception.EventDataStoreARNInvalidException: <p>The specified event data store ARN is not valid or does not map to an event data store in your account.</p>
        capo_cloudtrail.errors.event_data_store_not_found_exception.EventDataStoreNotFoundException: <p>The specified event data store was not found.</p>
        capo_cloudtrail.errors.import_not_found_exception.ImportNotFoundException: <p> The specified import was not found. </p>
        capo_cloudtrail.errors.inactive_event_data_store_exception.InactiveEventDataStoreException: <p>The event data store is inactive.</p>
        capo_cloudtrail.errors.insufficient_encryption_policy_exception.InsufficientEncryptionPolicyException: <p>For the <code>CreateTrail</code> <code>PutInsightSelectors</code>, <code>UpdateTrail</code>, <code>StartQuery</code>, and <code>StartImport</code> operations, this exception is thrown when the policy on the S3 bucket or KMS key does not have sufficient permissions for the operation.</p> <p>For all other operations, this exception is thrown when the policy for the KMS key does not have sufficient permissions for the operation.</p>
        capo_cloudtrail.errors.invalid_event_data_store_category_exception.InvalidEventDataStoreCategoryException: <p>This exception is thrown when event categories of specified event data stores are not valid.</p>
        capo_cloudtrail.errors.invalid_event_data_store_status_exception.InvalidEventDataStoreStatusException: <p>The event data store is not in a status that supports the operation.</p>
        capo_cloudtrail.errors.invalid_import_source_exception.InvalidImportSourceException: <p> This exception is thrown when the provided source S3 bucket is not valid for import. </p>
        capo_cloudtrail.errors.invalid_parameter_exception.InvalidParameterException: <p>The request includes a parameter that is not valid.</p>
        capo_cloudtrail.errors.operation_not_permitted_exception.OperationNotPermittedException: <p>This exception is thrown when the requested operation is not permitted.</p>
        capo_cloudtrail.errors.unsupported_operation_exception.UnsupportedOperationException: <p>This exception is thrown when the requested operation is not supported.</p>
        capo_cloudtrail.errors.UnknownServiceError: The service returned an error code this client does not model.
    """

    def _handler(
        req: "OperationRequest[capo_cloudtrail.types.start_import_request.StartImportRequest]",
    ) -> OperationResponse[
        "capo_cloudtrail.types.start_import_response.StartImportResponse"
    ]:
        import capo_cloudtrail._operations.cloud_trail_20131101.start_import

        output, http_response = (
            capo_cloudtrail._operations.cloud_trail_20131101.start_import.start_import(
                req.options, req.input
            )
        )
        return OperationResponse(output=output, response=http_response)

    interceptors_, options_ = self.operation_options(
        config_overrides, OperationLogging("StartImport")
    )
    input_: capo_cloudtrail.types.start_import_request.StartImportRequest = {}
    if destinations is not None:
        input_["destinations"] = destinations
    if import_source is not None:
        input_["import_source"] = import_source
    if start_event_time is not None:
        input_["start_event_time"] = start_event_time
    if end_event_time is not None:
        input_["end_event_time"] = end_event_time
    if import_id is not None:
        input_["import_id"] = import_id

    response = execute_pipeline(
        OperationRequest(input=input_, options=options_),
        handler=_handler,
        interceptors=list(interceptors_),
    )
    response.response.close()
    return response.output