put_resource_policy ¶

def put_resource_policy(
    self,
    *,
    config_overrides: Optional[CloudWatchLogsClientConfig] = None,
    policy_name: Optional[
        "capo_cloudwatch_logs.types.policy_name.PolicyName"
    ] = None,
    policy_document: Optional[
        "capo_cloudwatch_logs.types.policy_document.PolicyDocument"
    ] = None,
    resource_arn: Optional["capo_cloudwatch_logs.types.arn.Arn"] = None,
    expected_revision_id: Optional[
        "capo_cloudwatch_logs.types.expected_revision_id.ExpectedRevisionId"
    ] = None,
) -> "capo_cloudwatch_logs.types.put_resource_policy_response.PutResourcePolicyResponse":
    """<p>Creates or updates a resource policy allowing other Amazon Web Services services to put log events to this account, such as Amazon Route 53. This API has the following restrictions:</p> <ul> <li> <p> <b>Supported actions</b> - Policy only supports <code>logs:PutLogEvents</code> and <code>logs:CreateLogStream </code> actions</p> </li> <li> <p> <b>Supported principals</b> - Policy only applies when operations are invoked by Amazon Web Services service principals (not IAM users, roles, or cross-account principals</p> </li> <li> <p> <b>Policy limits</b> - An account can have a maximum of 10 policies without resourceARN and one per LogGroup resourceARN</p> </li> </ul> <important> <p>Resource policies with actions invoked by non-Amazon Web Services service principals (such as IAM users, roles, or other Amazon Web Services accounts) will not be enforced. For access control involving these principals, use the IAM policies.</p> </important>

    Args:
        policy_name: <p>Name of the new policy. This parameter is required.</p>
        policy_document: <p>Details of the new policy, including the identity of the principal that is enabled to put logs to this account. This is formatted as a JSON string. This parameter is required.</p> <p>The following example creates a resource policy enabling the Route 53 service to put DNS query logs in to the specified log group. Replace <code>"logArn"</code> with the ARN of your CloudWatch Logs resource, such as a log group or log stream.</p> <p>CloudWatch Logs also supports <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-sourcearn">aws:SourceArn</a> and <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-sourceaccount">aws:SourceAccount</a> condition context keys.</p> <p>In the example resource policy, you would replace the value of <code>SourceArn</code> with the resource making the call from Route 53 to CloudWatch Logs. You would also replace the value of <code>SourceAccount</code> with the Amazon Web Services account ID making that call.</p> <p></p> <p> <code>{ "Version": "2012-10-17", "Statement": [ { "Sid": "Route53LogsToCloudWatchLogs", "Effect": "Allow", "Principal": { "Service": [ "route53.amazonaws.com" ] }, "Action": "logs:PutLogEvents", "Resource": "logArn", "Condition": { "ArnLike": { "aws:SourceArn": "myRoute53ResourceArn" }, "StringEquals": { "aws:SourceAccount": "myAwsAccountId" } } } ] }</code> </p>
        resource_arn: <p>The ARN of the CloudWatch Logs resource to which the resource policy needs to be added or attached. Currently only supports LogGroup ARN.</p>
        expected_revision_id: <p>The expected revision ID of the resource policy. Required when <code>resourceArn</code> is provided to prevent concurrent modifications. Use <code>null</code> when creating a resource policy for the first time.</p>

    Raises:
        capo_cloudwatch_logs.errors.invalid_parameter_exception.InvalidParameterException: <p>A parameter is specified incorrectly.</p>
        capo_cloudwatch_logs.errors.limit_exceeded_exception.LimitExceededException: <p>You have reached the maximum number of resources that can be created.</p>
        capo_cloudwatch_logs.errors.operation_aborted_exception.OperationAbortedException: <p>Multiple concurrent requests to update the same resource were in conflict.</p>
        capo_cloudwatch_logs.errors.resource_not_found_exception.ResourceNotFoundException: <p>The specified resource does not exist.</p>
        capo_cloudwatch_logs.errors.service_unavailable_exception.ServiceUnavailableException: <p>The service cannot complete the request.</p>
        capo_cloudwatch_logs.errors.UnknownServiceError: The service returned an error code this client does not model.
    """

    def _handler(
        req: "OperationRequest[capo_cloudwatch_logs.types.put_resource_policy_request.PutResourcePolicyRequest]",
    ) -> OperationResponse[
        "capo_cloudwatch_logs.types.put_resource_policy_response.PutResourcePolicyResponse"
    ]:
        import capo_cloudwatch_logs._operations.logs_20140328.put_resource_policy

        output, http_response = (
            capo_cloudwatch_logs._operations.logs_20140328.put_resource_policy.put_resource_policy(
                req.options, req.input
            )
        )
        return OperationResponse(output=output, response=http_response)

    interceptors_, options_ = self.operation_options(
        config_overrides, OperationLogging("PutResourcePolicy")
    )
    input_: capo_cloudwatch_logs.types.put_resource_policy_request.PutResourcePolicyRequest = {}
    if policy_name is not None:
        input_["policy_name"] = policy_name
    if policy_document is not None:
        input_["policy_document"] = policy_document
    if resource_arn is not None:
        input_["resource_arn"] = resource_arn
    if expected_revision_id is not None:
        input_["expected_revision_id"] = expected_revision_id

    response = execute_pipeline(
        OperationRequest(input=input_, options=options_),
        handler=_handler,
        interceptors=list(interceptors_),
    )
    response.response.close()
    return response.output