2026/02/24 - CloudWatch Observability Admin Service - 5 updated api methods
Changes Adding a new field in the CreateCentralizationRuleForOrganization, UpdateCentralizationRuleForOrganization API and updating the GetCentralizationRuleForOrganization API response to include the new field
{'Rule': {'Destination': {'DestinationLogsConfiguration': {'LogGroupNameConfiguration': {'LogGroupNamePattern': 'string'}}}}}
Creates a centralization rule that applies across an Amazon Web Services Organization. This operation can only be called by the organization's management account or a delegated administrator account.
See also: AWS API Documentation
Request Syntax
client.create_centralization_rule_for_organization(
RuleName='string',
Rule={
'Source': {
'Regions': [
'string',
],
'Scope': 'string',
'SourceLogsConfiguration': {
'LogGroupSelectionCriteria': 'string',
'EncryptedLogGroupStrategy': 'ALLOW'|'SKIP'
}
},
'Destination': {
'Region': 'string',
'Account': 'string',
'DestinationLogsConfiguration': {
'LogsEncryptionConfiguration': {
'EncryptionStrategy': 'CUSTOMER_MANAGED'|'AWS_OWNED',
'KmsKeyArn': 'string',
'EncryptionConflictResolutionStrategy': 'ALLOW'|'SKIP'
},
'BackupConfiguration': {
'Region': 'string',
'KmsKeyArn': 'string'
},
'LogGroupNameConfiguration': {
'LogGroupNamePattern': 'string'
}
}
}
},
Tags={
'string': 'string'
}
)
string
[REQUIRED]
A unique name for the organization-wide centralization rule being created.
dict
[REQUIRED]
The configuration details for the organization-wide centralization rule, including the source configuration and the destination configuration to centralize telemetry data across the organization.
Source (dict) -- [REQUIRED]
Configuration determining the source of the telemetry data to be centralized.
Regions (list) -- [REQUIRED]
The list of source regions from which telemetry data should be centralized.
(string) --
Scope (string) --
The organizational scope from which telemetry data should be centralized, specified using organization id, accounts or organizational unit ids.
SourceLogsConfiguration (dict) --
Log specific configuration for centralization source log groups.
LogGroupSelectionCriteria (string) -- [REQUIRED]
The selection criteria that specifies which source log groups to centralize. The selection criteria uses the same format as OAM link filters.
EncryptedLogGroupStrategy (string) -- [REQUIRED]
A strategy determining whether to centralize source log groups that are encrypted with customer managed KMS keys (CMK). ALLOW will consider CMK encrypted source log groups for centralization while SKIP will skip CMK encrypted source log groups from centralization.
Destination (dict) -- [REQUIRED]
Configuration determining where the telemetry data should be centralized, backed up, as well as encryption configuration for the primary and backup destinations.
Region (string) -- [REQUIRED]
The primary destination region to which telemetry data should be centralized.
Account (string) --
The destination account (within the organization) to which the telemetry data should be centralized.
DestinationLogsConfiguration (dict) --
Log specific configuration for centralization destination log groups.
LogsEncryptionConfiguration (dict) --
The encryption configuration for centralization destination log groups.
EncryptionStrategy (string) -- [REQUIRED]
Configuration that determines the encryption strategy of the destination log groups. CUSTOMER_MANAGED uses the configured KmsKeyArn to encrypt newly created destination log groups.
KmsKeyArn (string) --
KMS Key ARN belonging to the primary destination account and region, to encrypt newly created central log groups in the primary destination.
EncryptionConflictResolutionStrategy (string) --
Conflict resolution strategy for centralization if the encryption strategy is set to CUSTOMER_MANAGED and the destination log group is encrypted with an AWS_OWNED KMS Key. ALLOW lets centralization go through while SKIP prevents centralization into the destination log group.
BackupConfiguration (dict) --
Configuration defining the backup region and an optional KMS key for the backup destination.
Region (string) -- [REQUIRED]
Logs specific backup destination region within the primary destination account to which log data should be centralized.
KmsKeyArn (string) --
KMS Key ARN belonging to the primary destination account and backup region, to encrypt newly created central log groups in the backup destination.
LogGroupNameConfiguration (dict) --
Configuration that specifies a naming pattern for destination log groups created during centralization. The pattern supports static text and dynamic variables that are replaced with source attributes when log groups are created.
LogGroupNamePattern (string) -- [REQUIRED]
The pattern used to generate destination log group names during centralization. The pattern can contain static text and dynamic variables that are replaced with source attributes. If a variable cannot be resolved, it inherits the value from its parent variable in the hierarchy. The pattern must be between 1 and 512 characters.
Supported variables:
${source.logGroup} — The original log group name from the source account.
${source.accountId} — The AWS account ID where the log originated.
${source.region} — The AWS Region where the log originated.
${source.org.id} — The AWS Organization ID of the source account.
${source.org.ouId} — The organizational unit ID of the source account.
${source.org.rootId} — The organization Root ID.
${source.org.path} — The organizational path from account to root.
dict
The key-value pairs to associate with the organization telemetry rule resource for categorization and management purposes.
(string) --
(string) --
dict
Response Syntax
{
'RuleArn': 'string'
}
Response Structure
(dict) --
RuleArn (string) --
The Amazon Resource Name (ARN) of the created organization centralization rule.
{'CentralizationRule': {'Destination': {'DestinationLogsConfiguration': {'LogGroupNameConfiguration': {'LogGroupNamePattern': 'string'}}}}}
Retrieves the details of a specific organization centralization rule. This operation can only be called by the organization's management account or a delegated administrator account.
See also: AWS API Documentation
Request Syntax
client.get_centralization_rule_for_organization(
RuleIdentifier='string'
)
string
[REQUIRED]
The identifier (name or ARN) of the organization centralization rule to retrieve.
dict
Response Syntax
{
'RuleName': 'string',
'RuleArn': 'string',
'CreatorAccountId': 'string',
'CreatedTimeStamp': 123,
'CreatedRegion': 'string',
'LastUpdateTimeStamp': 123,
'RuleHealth': 'Healthy'|'Unhealthy'|'Provisioning',
'FailureReason': 'TRUSTED_ACCESS_NOT_ENABLED'|'DESTINATION_ACCOUNT_NOT_IN_ORGANIZATION'|'INTERNAL_SERVER_ERROR',
'CentralizationRule': {
'Source': {
'Regions': [
'string',
],
'Scope': 'string',
'SourceLogsConfiguration': {
'LogGroupSelectionCriteria': 'string',
'EncryptedLogGroupStrategy': 'ALLOW'|'SKIP'
}
},
'Destination': {
'Region': 'string',
'Account': 'string',
'DestinationLogsConfiguration': {
'LogsEncryptionConfiguration': {
'EncryptionStrategy': 'CUSTOMER_MANAGED'|'AWS_OWNED',
'KmsKeyArn': 'string',
'EncryptionConflictResolutionStrategy': 'ALLOW'|'SKIP'
},
'BackupConfiguration': {
'Region': 'string',
'KmsKeyArn': 'string'
},
'LogGroupNameConfiguration': {
'LogGroupNamePattern': 'string'
}
}
}
}
}
Response Structure
(dict) --
RuleName (string) --
The name of the organization centralization rule.
RuleArn (string) --
The Amazon Resource Name (ARN) of the organization centralization rule.
CreatorAccountId (string) --
The Amazon Web Services Account that created the organization centralization rule.
CreatedTimeStamp (integer) --
The timestamp when the organization centralization rule was created.
CreatedRegion (string) --
The Amazon Web Services region where the organization centralization rule was created.
LastUpdateTimeStamp (integer) --
The timestamp when the organization centralization rule was last updated.
RuleHealth (string) --
The health status of the organization centralization rule.
FailureReason (string) --
The reason why an organization centralization rule is marked UNHEALTHY.
CentralizationRule (dict) --
The configuration details for the organization centralization rule.
Source (dict) --
Configuration determining the source of the telemetry data to be centralized.
Regions (list) --
The list of source regions from which telemetry data should be centralized.
(string) --
Scope (string) --
The organizational scope from which telemetry data should be centralized, specified using organization id, accounts or organizational unit ids.
SourceLogsConfiguration (dict) --
Log specific configuration for centralization source log groups.
LogGroupSelectionCriteria (string) --
The selection criteria that specifies which source log groups to centralize. The selection criteria uses the same format as OAM link filters.
EncryptedLogGroupStrategy (string) --
A strategy determining whether to centralize source log groups that are encrypted with customer managed KMS keys (CMK). ALLOW will consider CMK encrypted source log groups for centralization while SKIP will skip CMK encrypted source log groups from centralization.
Destination (dict) --
Configuration determining where the telemetry data should be centralized, backed up, as well as encryption configuration for the primary and backup destinations.
Region (string) --
The primary destination region to which telemetry data should be centralized.
Account (string) --
The destination account (within the organization) to which the telemetry data should be centralized.
DestinationLogsConfiguration (dict) --
Log specific configuration for centralization destination log groups.
LogsEncryptionConfiguration (dict) --
The encryption configuration for centralization destination log groups.
EncryptionStrategy (string) --
Configuration that determines the encryption strategy of the destination log groups. CUSTOMER_MANAGED uses the configured KmsKeyArn to encrypt newly created destination log groups.
KmsKeyArn (string) --
KMS Key ARN belonging to the primary destination account and region, to encrypt newly created central log groups in the primary destination.
EncryptionConflictResolutionStrategy (string) --
Conflict resolution strategy for centralization if the encryption strategy is set to CUSTOMER_MANAGED and the destination log group is encrypted with an AWS_OWNED KMS Key. ALLOW lets centralization go through while SKIP prevents centralization into the destination log group.
BackupConfiguration (dict) --
Configuration defining the backup region and an optional KMS key for the backup destination.
Region (string) --
Logs specific backup destination region within the primary destination account to which log data should be centralized.
KmsKeyArn (string) --
KMS Key ARN belonging to the primary destination account and backup region, to encrypt newly created central log groups in the backup destination.
LogGroupNameConfiguration (dict) --
Configuration that specifies a naming pattern for destination log groups created during centralization. The pattern supports static text and dynamic variables that are replaced with source attributes when log groups are created.
LogGroupNamePattern (string) --
The pattern used to generate destination log group names during centralization. The pattern can contain static text and dynamic variables that are replaced with source attributes. If a variable cannot be resolved, it inherits the value from its parent variable in the hierarchy. The pattern must be between 1 and 512 characters.
Supported variables:
${source.logGroup} — The original log group name from the source account.
${source.accountId} — The AWS account ID where the log originated.
${source.region} — The AWS Region where the log originated.
${source.org.id} — The AWS Organization ID of the source account.
${source.org.ouId} — The organizational unit ID of the source account.
${source.org.rootId} — The organization Root ID.
${source.org.path} — The organizational path from account to root.
{'TelemetryConfigurations': {'TelemetrySourceType': 'VPC_FLOW_LOGS | '
'ROUTE53_RESOLVER_QUERY_LOGS '
'| EKS_AUDIT_LOGS | '
'EKS_AUTHENTICATOR_LOGS | '
'EKS_CONTROLLER_MANAGER_LOGS '
'| EKS_SCHEDULER_LOGS | '
'EKS_API_LOGS'}}
Returns a list of telemetry configurations for Amazon Web Services resources supported by telemetry config. For more information, see Auditing CloudWatch telemetry configurations.
See also: AWS API Documentation
Request Syntax
client.list_resource_telemetry(
ResourceIdentifierPrefix='string',
ResourceTypes=[
'AWS::EC2::Instance'|'AWS::EC2::VPC'|'AWS::Lambda::Function'|'AWS::CloudTrail'|'AWS::EKS::Cluster'|'AWS::WAFv2::WebACL'|'AWS::ElasticLoadBalancingV2::LoadBalancer'|'AWS::Route53Resolver::ResolverEndpoint'|'AWS::BedrockAgentCore::Runtime'|'AWS::BedrockAgentCore::Browser'|'AWS::BedrockAgentCore::CodeInterpreter',
],
TelemetryConfigurationState={
'string': 'Enabled'|'Disabled'|'NotApplicable'
},
ResourceTags={
'string': 'string'
},
MaxResults=123,
NextToken='string'
)
string
A string used to filter resources which have a ResourceIdentifier starting with the ResourceIdentifierPrefix.
list
A list of resource types used to filter resources supported by telemetry config. If this parameter is provided, the resources will be returned in the same order used in the request.
(string) --
dict
A key-value pair to filter resources based on the telemetry type and the state of the telemetry configuration. The key is the telemetry type and the value is the state.
(string) --
(string) --
dict
A key-value pair to filter resources based on tags associated with the resource. For more information about tags, see What are tags?
(string) --
(string) --
integer
A number field used to limit the number of results within the returned list.
string
The token for the next set of items to return. A previous call generates this token.
dict
Response Syntax
{
'TelemetryConfigurations': [
{
'AccountIdentifier': 'string',
'TelemetryConfigurationState': {
'string': 'Enabled'|'Disabled'|'NotApplicable'
},
'ResourceType': 'AWS::EC2::Instance'|'AWS::EC2::VPC'|'AWS::Lambda::Function'|'AWS::CloudTrail'|'AWS::EKS::Cluster'|'AWS::WAFv2::WebACL'|'AWS::ElasticLoadBalancingV2::LoadBalancer'|'AWS::Route53Resolver::ResolverEndpoint'|'AWS::BedrockAgentCore::Runtime'|'AWS::BedrockAgentCore::Browser'|'AWS::BedrockAgentCore::CodeInterpreter',
'ResourceIdentifier': 'string',
'ResourceTags': {
'string': 'string'
},
'LastUpdateTimeStamp': 123,
'TelemetrySourceType': 'VPC_FLOW_LOGS'|'ROUTE53_RESOLVER_QUERY_LOGS'|'EKS_AUDIT_LOGS'|'EKS_AUTHENTICATOR_LOGS'|'EKS_CONTROLLER_MANAGER_LOGS'|'EKS_SCHEDULER_LOGS'|'EKS_API_LOGS'
},
],
'NextToken': 'string'
}
Response Structure
(dict) --
TelemetryConfigurations (list) --
A list of telemetry configurations for Amazon Web Services resources supported by telemetry config in the caller's account.
(dict) --
A model representing the state of a resource within an account according to telemetry config.
AccountIdentifier (string) --
The account ID which contains the resource managed in telemetry configuration. An example of a valid account ID is 012345678901.
TelemetryConfigurationState (dict) --
The configuration state for the resource, for example { Logs: NotApplicable; Metrics: Enabled; Traces: NotApplicable; }.
(string) --
(string) --
ResourceType (string) --
The type of resource, for example Amazon Web Services::EC2::Instance, or Amazon Web Services::EKS::Cluster, etc.
ResourceIdentifier (string) --
The identifier of the resource, for example for Amazon VPC, it would be vpc-1a2b3c4d5e6f1a2b3.
ResourceTags (dict) --
Tags associated with the resource, for example { Name: "ExampleInstance", Environment: "Development" }.
(string) --
(string) --
LastUpdateTimeStamp (integer) --
The timestamp of the last change to the telemetry configuration for the resource. For example, 1728679196318.
TelemetrySourceType (string) --
Specifies the type of telemetry source for a resource, such as EKS cluster logs.
NextToken (string) --
The token for the next set of items to return. A previous call generates this token.
{'TelemetryConfigurations': {'TelemetrySourceType': 'VPC_FLOW_LOGS | '
'ROUTE53_RESOLVER_QUERY_LOGS '
'| EKS_AUDIT_LOGS | '
'EKS_AUTHENTICATOR_LOGS | '
'EKS_CONTROLLER_MANAGER_LOGS '
'| EKS_SCHEDULER_LOGS | '
'EKS_API_LOGS'}}
Returns a list of telemetry configurations for Amazon Web Services resources supported by telemetry config in the organization.
See also: AWS API Documentation
Request Syntax
client.list_resource_telemetry_for_organization(
AccountIdentifiers=[
'string',
],
ResourceIdentifierPrefix='string',
ResourceTypes=[
'AWS::EC2::Instance'|'AWS::EC2::VPC'|'AWS::Lambda::Function'|'AWS::CloudTrail'|'AWS::EKS::Cluster'|'AWS::WAFv2::WebACL'|'AWS::ElasticLoadBalancingV2::LoadBalancer'|'AWS::Route53Resolver::ResolverEndpoint'|'AWS::BedrockAgentCore::Runtime'|'AWS::BedrockAgentCore::Browser'|'AWS::BedrockAgentCore::CodeInterpreter',
],
TelemetryConfigurationState={
'string': 'Enabled'|'Disabled'|'NotApplicable'
},
ResourceTags={
'string': 'string'
},
MaxResults=123,
NextToken='string'
)
list
A list of Amazon Web Services accounts used to filter the resources to those associated with the specified accounts.
(string) --
string
A string used to filter resources in the organization which have a ResourceIdentifier starting with the ResourceIdentifierPrefix.
list
A list of resource types used to filter resources in the organization. If this parameter is provided, the resources will be returned in the same order used in the request.
(string) --
dict
A key-value pair to filter resources in the organization based on the telemetry type and the state of the telemetry configuration. The key is the telemetry type and the value is the state.
(string) --
(string) --
dict
A key-value pair to filter resources in the organization based on tags associated with the resource. Fore more information about tags, see What are tags?
(string) --
(string) --
integer
A number field used to limit the number of results within the returned list.
string
The token for the next set of items to return. A previous call provides this token.
dict
Response Syntax
{
'TelemetryConfigurations': [
{
'AccountIdentifier': 'string',
'TelemetryConfigurationState': {
'string': 'Enabled'|'Disabled'|'NotApplicable'
},
'ResourceType': 'AWS::EC2::Instance'|'AWS::EC2::VPC'|'AWS::Lambda::Function'|'AWS::CloudTrail'|'AWS::EKS::Cluster'|'AWS::WAFv2::WebACL'|'AWS::ElasticLoadBalancingV2::LoadBalancer'|'AWS::Route53Resolver::ResolverEndpoint'|'AWS::BedrockAgentCore::Runtime'|'AWS::BedrockAgentCore::Browser'|'AWS::BedrockAgentCore::CodeInterpreter',
'ResourceIdentifier': 'string',
'ResourceTags': {
'string': 'string'
},
'LastUpdateTimeStamp': 123,
'TelemetrySourceType': 'VPC_FLOW_LOGS'|'ROUTE53_RESOLVER_QUERY_LOGS'|'EKS_AUDIT_LOGS'|'EKS_AUTHENTICATOR_LOGS'|'EKS_CONTROLLER_MANAGER_LOGS'|'EKS_SCHEDULER_LOGS'|'EKS_API_LOGS'
},
],
'NextToken': 'string'
}
Response Structure
(dict) --
TelemetryConfigurations (list) --
A list of telemetry configurations for Amazon Web Services resources supported by telemetry config in the organization.
(dict) --
A model representing the state of a resource within an account according to telemetry config.
AccountIdentifier (string) --
The account ID which contains the resource managed in telemetry configuration. An example of a valid account ID is 012345678901.
TelemetryConfigurationState (dict) --
The configuration state for the resource, for example { Logs: NotApplicable; Metrics: Enabled; Traces: NotApplicable; }.
(string) --
(string) --
ResourceType (string) --
The type of resource, for example Amazon Web Services::EC2::Instance, or Amazon Web Services::EKS::Cluster, etc.
ResourceIdentifier (string) --
The identifier of the resource, for example for Amazon VPC, it would be vpc-1a2b3c4d5e6f1a2b3.
ResourceTags (dict) --
Tags associated with the resource, for example { Name: "ExampleInstance", Environment: "Development" }.
(string) --
(string) --
LastUpdateTimeStamp (integer) --
The timestamp of the last change to the telemetry configuration for the resource. For example, 1728679196318.
TelemetrySourceType (string) --
Specifies the type of telemetry source for a resource, such as EKS cluster logs.
NextToken (string) --
The token for the next set of items to return. A previous call provides this token.
{'Rule': {'Destination': {'DestinationLogsConfiguration': {'LogGroupNameConfiguration': {'LogGroupNamePattern': 'string'}}}}}
Updates an existing centralization rule that applies across an Amazon Web Services Organization. This operation can only be called by the organization's management account or a delegated administrator account.
See also: AWS API Documentation
Request Syntax
client.update_centralization_rule_for_organization(
RuleIdentifier='string',
Rule={
'Source': {
'Regions': [
'string',
],
'Scope': 'string',
'SourceLogsConfiguration': {
'LogGroupSelectionCriteria': 'string',
'EncryptedLogGroupStrategy': 'ALLOW'|'SKIP'
}
},
'Destination': {
'Region': 'string',
'Account': 'string',
'DestinationLogsConfiguration': {
'LogsEncryptionConfiguration': {
'EncryptionStrategy': 'CUSTOMER_MANAGED'|'AWS_OWNED',
'KmsKeyArn': 'string',
'EncryptionConflictResolutionStrategy': 'ALLOW'|'SKIP'
},
'BackupConfiguration': {
'Region': 'string',
'KmsKeyArn': 'string'
},
'LogGroupNameConfiguration': {
'LogGroupNamePattern': 'string'
}
}
}
}
)
string
[REQUIRED]
The identifier (name or ARN) of the organization centralization rule to update.
dict
[REQUIRED]
The configuration details for the organization-wide centralization rule, including the source configuration and the destination configuration to centralize telemetry data across the organization.
Source (dict) -- [REQUIRED]
Configuration determining the source of the telemetry data to be centralized.
Regions (list) -- [REQUIRED]
The list of source regions from which telemetry data should be centralized.
(string) --
Scope (string) --
The organizational scope from which telemetry data should be centralized, specified using organization id, accounts or organizational unit ids.
SourceLogsConfiguration (dict) --
Log specific configuration for centralization source log groups.
LogGroupSelectionCriteria (string) -- [REQUIRED]
The selection criteria that specifies which source log groups to centralize. The selection criteria uses the same format as OAM link filters.
EncryptedLogGroupStrategy (string) -- [REQUIRED]
A strategy determining whether to centralize source log groups that are encrypted with customer managed KMS keys (CMK). ALLOW will consider CMK encrypted source log groups for centralization while SKIP will skip CMK encrypted source log groups from centralization.
Destination (dict) -- [REQUIRED]
Configuration determining where the telemetry data should be centralized, backed up, as well as encryption configuration for the primary and backup destinations.
Region (string) -- [REQUIRED]
The primary destination region to which telemetry data should be centralized.
Account (string) --
The destination account (within the organization) to which the telemetry data should be centralized.
DestinationLogsConfiguration (dict) --
Log specific configuration for centralization destination log groups.
LogsEncryptionConfiguration (dict) --
The encryption configuration for centralization destination log groups.
EncryptionStrategy (string) -- [REQUIRED]
Configuration that determines the encryption strategy of the destination log groups. CUSTOMER_MANAGED uses the configured KmsKeyArn to encrypt newly created destination log groups.
KmsKeyArn (string) --
KMS Key ARN belonging to the primary destination account and region, to encrypt newly created central log groups in the primary destination.
EncryptionConflictResolutionStrategy (string) --
Conflict resolution strategy for centralization if the encryption strategy is set to CUSTOMER_MANAGED and the destination log group is encrypted with an AWS_OWNED KMS Key. ALLOW lets centralization go through while SKIP prevents centralization into the destination log group.
BackupConfiguration (dict) --
Configuration defining the backup region and an optional KMS key for the backup destination.
Region (string) -- [REQUIRED]
Logs specific backup destination region within the primary destination account to which log data should be centralized.
KmsKeyArn (string) --
KMS Key ARN belonging to the primary destination account and backup region, to encrypt newly created central log groups in the backup destination.
LogGroupNameConfiguration (dict) --
Configuration that specifies a naming pattern for destination log groups created during centralization. The pattern supports static text and dynamic variables that are replaced with source attributes when log groups are created.
LogGroupNamePattern (string) -- [REQUIRED]
The pattern used to generate destination log group names during centralization. The pattern can contain static text and dynamic variables that are replaced with source attributes. If a variable cannot be resolved, it inherits the value from its parent variable in the hierarchy. The pattern must be between 1 and 512 characters.
Supported variables:
${source.logGroup} — The original log group name from the source account.
${source.accountId} — The AWS account ID where the log originated.
${source.region} — The AWS Region where the log originated.
${source.org.id} — The AWS Organization ID of the source account.
${source.org.ouId} — The organizational unit ID of the source account.
${source.org.rootId} — The organization Root ID.
${source.org.path} — The organizational path from account to root.
dict
Response Syntax
{
'RuleArn': 'string'
}
Response Structure
(dict) --
RuleArn (string) --
The Amazon Resource Name (ARN) of the updated organization centralization rule.