Add Missing Field for CloudTrail Events

[hi-artem]

Description

Add a field allowed by AWS Cloudtrail API and described in this documentation https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_AdvancedEventSelector.html

Relations

Fixes #36280 (comment)

Example

resource "aws_cloudtrail" "example" {
  ...
  advanced_event_selector {
    name = "Capture DynamoDB data events filtered by human roles"

    field_selector {
      field  = "eventCategory"
      equals = ["Data"]
    }

    field_selector {
      field = "userIdentity.arn"

      ends_with = [
        "HumanRole"
      ]
    }

    field_selector {
      field  = "resources.type"
      equals = ["AWS::DynamoDB::Table"]
    }
  }
}

Error:

Error: expected advanced_event_selector.3.field_selector.0.field to be one of ["eventCategory" "eventName" "eventSource" "readOnly" "resources.ARN" "resources.type"], got userIdentity.arn

  on ../../modules/tf12/aws-cloudtrail/main.tf line 268, in resource "aws_cloudtrail" "main":
 268:   advanced_event_selector {

References

See https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_AdvancedEventSelector.html

Output from Acceptance Testing

n/a

[github-actions]

Community Note

Voting for Prioritization

• Please vote on this pull request by adding a 👍 reaction to the original post to help the community and maintainers prioritize this pull request.
• Please see our prioritization guide for information on how we prioritize.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

For Submitters

• Review the contribution guide relating to the type of change you are making to ensure all of the necessary steps have been taken.
• For new resources and data sources, use skaff to generate scaffolding with comments detailing common expectations.
• Whether or not the branch has been rebased will not impact prioritization, but doing so is always a welcome surprise.

[github-actions]

Welcome @hi-artem 👋

It looks like this is your first Pull Request submission to the Terraform AWS Provider! If you haven’t already done so please make sure you have checked out our CONTRIBUTOR guide and FAQ to make sure your contribution is adhering to best practice and has all the necessary elements in place for a successful approval.

Also take a look at our FAQ which details how we prioritize Pull Requests for inclusion.

Thanks again, and welcome to the community! 😃

[nam054]

LGTM 🚀

> make testacc PKG=cloudtrail TESTS=TestAccCloudTrailEventDataStore_
make: Verifying source code with gofmt...
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go1.23.3 test ./internal/service/cloudtrail/... -v -count 1 -parallel 20 -run='TestAccCloudTrailEventDataStore_'  -timeout 360m -vet=off
2025/01/15 00:27:27 Initializing Terraform AWS Provider...
=== RUN   TestAccCloudTrailEventDataStore_basic
=== PAUSE TestAccCloudTrailEventDataStore_basic
=== RUN   TestAccCloudTrailEventDataStore_billingMode
=== PAUSE TestAccCloudTrailEventDataStore_billingMode
=== RUN   TestAccCloudTrailEventDataStore_kmsKeyId
=== PAUSE TestAccCloudTrailEventDataStore_kmsKeyId
=== RUN   TestAccCloudTrailEventDataStore_disappears
=== PAUSE TestAccCloudTrailEventDataStore_disappears
=== RUN   TestAccCloudTrailEventDataStore_tags
=== PAUSE TestAccCloudTrailEventDataStore_tags
=== RUN   TestAccCloudTrailEventDataStore_options
=== PAUSE TestAccCloudTrailEventDataStore_options
=== RUN   TestAccCloudTrailEventDataStore_advancedEventSelector
=== PAUSE TestAccCloudTrailEventDataStore_advancedEventSelector
=== CONT  TestAccCloudTrailEventDataStore_basic
=== CONT  TestAccCloudTrailEventDataStore_tags
=== CONT  TestAccCloudTrailEventDataStore_kmsKeyId
=== CONT  TestAccCloudTrailEventDataStore_billingMode
=== CONT  TestAccCloudTrailEventDataStore_disappears
=== CONT  TestAccCloudTrailEventDataStore_options
=== CONT  TestAccCloudTrailEventDataStore_advancedEventSelector
=== NAME  TestAccCloudTrailEventDataStore_options
    event_data_store_test.go:206: this AWS account must be the management account of an AWS Organization
--- SKIP: TestAccCloudTrailEventDataStore_options (0.77s)
--- PASS: TestAccCloudTrailEventDataStore_disappears (16.00s)
--- PASS: TestAccCloudTrailEventDataStore_basic (18.22s)
--- PASS: TestAccCloudTrailEventDataStore_advancedEventSelector (18.68s)
--- PASS: TestAccCloudTrailEventDataStore_kmsKeyId (23.48s)
--- PASS: TestAccCloudTrailEventDataStore_billingMode (26.91s)
--- PASS: TestAccCloudTrailEventDataStore_tags (38.75s)
PASS
ok      github.com/hashicorp/terraform-provider-aws/internal/service/cloudtrail 45.464s

[jar-b]

LGTM 🚀

[github-actions]

This functionality has been released in v5.84.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

[github-actions]

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.