AWS API Changes

2026/03/30 - Amazon CloudWatch Logs - 5 new api methods

Changes Adds Lookup Tables to CloudWatch Logs for log enrichment using CSV key-value data with KMS encryption support.

DeleteLookupTable (new)

Deletes a lookup table permanently. This operation cannot be undone.

Queries that reference a deleted table will return an error. Before deleting a lookup table, review any saved queries or dashboards that may reference it.

See also: AWS API Documentation

Request Syntax

client.delete_lookup_table(
    lookupTableArn='string'
)

type lookupTableArn:

string

param lookupTableArn:

[REQUIRED]

The ARN of the lookup table to delete.

returns:

None

GetLookupTable (new)

Link ¶

Retrieves the full content of a lookup table, including the CSV data.

See also: AWS API Documentation

Request Syntax

client.get_lookup_table(
    lookupTableArn='string'
)

type lookupTableArn:

string

param lookupTableArn:

[REQUIRED]

The ARN of the lookup table to retrieve.

rtype:

dict

returns:

Response Syntax

{
    'lookupTableArn': 'string',
    'lookupTableName': 'string',
    'description': 'string',
    'tableBody': 'string',
    'sizeBytes': 123,
    'lastUpdatedTime': 123,
    'kmsKeyId': 'string'
}

Response Structure

(dict) --
- lookupTableArn (string) --
  
  The ARN of the lookup table.
- lookupTableName (string) --
  
  The name of the lookup table.
- description (string) --
  
  The description of the lookup table.
- tableBody (string) --
  
  The full CSV content of the lookup table.
- sizeBytes (integer) --
  
  The size of the lookup table in bytes.
- lastUpdatedTime (integer) --
  
  The time when the lookup table was last updated, expressed as the number of milliseconds after Jan 1, 1970 00:00:00 UTC.
- kmsKeyId (string) --
  
  The ARN of the KMS key used to encrypt the lookup table data, if applicable.

UpdateLookupTable (new)

Link ¶

Updates an existing lookup table by replacing all of its CSV content. After the update completes, queries that use this table will use the new data.

This is a full replacement operation. All existing content is replaced with the new CSV data.

See also: AWS API Documentation

Request Syntax

client.update_lookup_table(
    lookupTableArn='string',
    description='string',
    tableBody='string',
    kmsKeyId='string'
)

type lookupTableArn:

string

param lookupTableArn:

[REQUIRED]

The ARN of the lookup table to update.

type description:

string

param description:

An updated description of the lookup table.

type tableBody:

string

param tableBody:

[REQUIRED]

The new CSV content to replace the existing data. The first row must be a header row with column names. The content must use UTF-8 encoding and not exceed 10 MB.

type kmsKeyId:

string

param kmsKeyId:

The ARN of the KMS key to use to encrypt the lookup table data. You can use this parameter to add, update, or remove the KMS key. To remove the KMS key and use an Amazon Web Services-owned key instead, specify an empty string.

rtype:

dict

returns:

Response Syntax

{
    'lookupTableArn': 'string',
    'lastUpdatedTime': 123
}

Response Structure

(dict) --
- lookupTableArn (string) --
  
  The ARN of the lookup table that was updated.
- lastUpdatedTime (integer) --
  
  The time when the lookup table was last updated, expressed as the number of milliseconds after Jan 1, 1970 00:00:00 UTC.

DescribeLookupTables (new)

Link ¶

Retrieves metadata about lookup tables in your account. You can optionally filter the results by table name prefix. Results are sorted by table name in ascending order.

See also: AWS API Documentation

Request Syntax

client.describe_lookup_tables(
    lookupTableNamePrefix='string',
    maxResults=123,
    nextToken='string'
)

type lookupTableNamePrefix:

string

param lookupTableNamePrefix:

A prefix to filter lookup tables by name. Only tables whose names start with this prefix are returned. If you don't specify a prefix, all tables in the account and Region are returned.

type maxResults:

integer

param maxResults:

The maximum number of lookup tables to return in the response. The default value is 50 and the maximum value is 100.

type nextToken:

string

param nextToken:

The token for the next set of items to return. (You received this token from a previous call.)

rtype:

dict

returns:

Response Syntax

{
    'lookupTables': [
        {
            'lookupTableArn': 'string',
            'lookupTableName': 'string',
            'description': 'string',
            'tableFields': [
                'string',
            ],
            'recordsCount': 123,
            'sizeBytes': 123,
            'lastUpdatedTime': 123,
            'kmsKeyId': 'string'
        },
    ],
    'nextToken': 'string'
}

Response Structure

(dict) --
- lookupTables (list) --
  
  An array of structures, where each structure contains metadata about one lookup table.
  - (dict) --
    
    Contains metadata about a lookup table returned by DescribeLookupTables.
    - lookupTableArn (string) --
      
      The ARN of the lookup table.
    - lookupTableName (string) --
      
      The name of the lookup table.
    - description (string) --
      
      The description of the lookup table.
    - tableFields (list) --
      
      The column headers from the first row of the CSV file.
      - (string) --
    - recordsCount (integer) --
      
      The number of data rows in the lookup table, excluding the header row.
    - sizeBytes (integer) --
      
      The size of the lookup table in bytes.
    - lastUpdatedTime (integer) --
      
      The time when the lookup table was last updated, expressed as the number of milliseconds after Jan 1, 1970 00:00:00 UTC.
    - kmsKeyId (string) --
      
      The ARN of the KMS key used to encrypt the lookup table data, if applicable.
- nextToken (string) --
  
  The token to use when requesting the next set of items.

CreateLookupTable (new)

Link ¶

Creates a lookup table by uploading CSV data. You can use lookup tables to enrich log data in CloudWatch Logs Insights queries with reference data such as user details, application names, or error descriptions.

The table name must be unique within your account and Region. The CSV content must include a header row with column names, use UTF-8 encoding, and not exceed 10 MB.

See also: AWS API Documentation

Request Syntax

client.create_lookup_table(
    lookupTableName='string',
    description='string',
    tableBody='string',
    kmsKeyId='string',
    tags={
        'string': 'string'
    }
)

type lookupTableName:

string

param lookupTableName:

[REQUIRED]

The name of the lookup table. The name must be unique within your account and Region. The name can contain only alphanumeric characters and underscores, and can be up to 256 characters long.

type description:

string

param description:

A description of the lookup table. The description can be up to 1024 characters long.

type tableBody:

string

param tableBody:

[REQUIRED]

The CSV content of the lookup table. The first row must be a header row with column names. The content must use UTF-8 encoding and not exceed 10 MB.

type kmsKeyId:

string

param kmsKeyId:

The ARN of the KMS key to use to encrypt the lookup table data. If you don't specify a key, the data is encrypted with an Amazon Web Services-owned key.

type tags:

dict

param tags:

A list of key-value pairs to associate with the lookup table. You can associate as many as 50 tags with a lookup table. Tags can help you organize and categorize your resources.

(string) --
- (string) --

rtype:

dict

returns:

Response Syntax

{
    'lookupTableArn': 'string',
    'createdAt': 123
}

Response Structure

(dict) --
- lookupTableArn (string) --
  
  The ARN of the lookup table that was created.
- createdAt (integer) --
  
  The time when the lookup table was created, expressed as the number of milliseconds after Jan 1, 1970 00:00:00 UTC.