Skip to content

AdvancedFieldSelector

Source code in docs_src/capo_cloudtrail/types/advanced_field_selector.py 
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
class AdvancedFieldSelector(TypedDict, closed=True):
    field: "capo_cloudtrail.types.selector_field.SelectorField"
    """<p> A field in a CloudTrail event record on which to filter events to be logged. For event data stores for CloudTrail Insights events, Config configuration items, Audit Manager evidence, or events outside of Amazon Web Services, the field is used only for selecting events as filtering is not supported.</p> <p>For more information, see <a href="https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_AdvancedFieldSelector.html">AdvancedFieldSelector</a> in the <i>CloudTrail API Reference</i>.</p> <note> <p>Selectors don't support the use of wildcards like <code>*</code> . To match multiple values with a single condition, you may use <code>StartsWith</code>, <code>EndsWith</code>, <code>NotStartsWith</code>, or <code>NotEndsWith</code> to explicitly match the beginning or end of the event field.</p> </note>"""
    equals: NotRequired["capo_cloudtrail.types.operator.Operator"]
    """<p> An operator that includes events that match the exact value of the event record field specified as the value of <code>Field</code>. This is the only valid operator that you can use with the <code>readOnly</code>, <code>eventCategory</code>, and <code>resources.type</code> fields.</p>"""
    starts_with: NotRequired["capo_cloudtrail.types.operator.Operator"]
    """<p>An operator that includes events that match the first few characters of the event record field specified as the value of <code>Field</code>.</p>"""
    ends_with: NotRequired["capo_cloudtrail.types.operator.Operator"]
    """<p>An operator that includes events that match the last few characters of the event record field specified as the value of <code>Field</code>.</p>"""
    not_equals: NotRequired["capo_cloudtrail.types.operator.Operator"]
    """<p> An operator that excludes events that match the exact value of the event record field specified as the value of <code>Field</code>. </p>"""
    not_starts_with: NotRequired["capo_cloudtrail.types.operator.Operator"]
    """<p> An operator that excludes events that match the first few characters of the event record field specified as the value of <code>Field</code>. </p>"""
    not_ends_with: NotRequired["capo_cloudtrail.types.operator.Operator"]
    """<p> An operator that excludes events that match the last few characters of the event record field specified as the value of <code>Field</code>. </p>"""

ends_with instance-attribute 

ends_with: NotRequired[Operator]

An operator that includes events that match the last few characters of the event record field specified as the value of Field.

equals instance-attribute 

equals: NotRequired[Operator]

An operator that includes events that match the exact value of the event record field specified as the value of Field. This is the only valid operator that you can use with the readOnly, eventCategory, and resources.type fields.

field instance-attribute 

field: SelectorField

A field in a CloudTrail event record on which to filter events to be logged. For event data stores for CloudTrail Insights events, Config configuration items, Audit Manager evidence, or events outside of Amazon Web Services, the field is used only for selecting events as filtering is not supported.

For more information, see AdvancedFieldSelector in the CloudTrail API Reference.

Selectors don't support the use of wildcards like * . To match multiple values with a single condition, you may use StartsWith, EndsWith, NotStartsWith, or NotEndsWith to explicitly match the beginning or end of the event field.

not_ends_with instance-attribute 

not_ends_with: NotRequired[Operator]

An operator that excludes events that match the last few characters of the event record field specified as the value of Field.

not_equals instance-attribute 

not_equals: NotRequired[Operator]

An operator that excludes events that match the exact value of the event record field specified as the value of Field.

not_starts_with instance-attribute 

not_starts_with: NotRequired[Operator]

An operator that excludes events that match the first few characters of the event record field specified as the value of Field.

starts_with instance-attribute 

starts_with: NotRequired[Operator]

An operator that includes events that match the first few characters of the event record field specified as the value of Field.