AWS CloudTrail Insights & ApiErrorRateInsight

[drmaciej]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

CloudTrail Insights is designed to automatically analyze management events from your CloudTrail trails to establish a baseline for normal behavior, and then raise issues by generating Insights events when it detects unusual patterns.
ApiErrorRateInsight is a new type of insight offered.

New or Affected Resource(s)

• aws_cloudtrail

Potential Terraform Configuration

resource "aws_cloudtrail" "example" {
  insight_selector {
    insight_type = "ApiCallRateInsight"
  }
  insight_selector {
    insight_type = "ApiErrorRateInsight"
  }
}

References

• https://aws.amazon.com/about-aws/whats-new/2021/11/aws-cloudtrail-announces-launch-errorrate-insights/

[DrFaust92]

Hi, the latest provider version already supports this, can you double check?

[drmaciej]

Before creating this issue I tried with 3.65.0 - did not work.
I just checked with 3.66.0 and I see

│ Error: expected insight_selector.0.insight_type to be one of [ApiCallRateInsight], got ApiErrorRateInsight

[josephbleroy]

I'm having the same issue with the following provider terraform-provider-aws_v3.66.0_x5, using the following configuration:

    insight_selector {
        insight_type = "ApiCallRateInsight"
    }
    
    insight_selector {
        insight_type = "ApiErrorRateInsight"
    }

Here's the error when running terraform plan:

│ Error: expected insight_selector.1.insight_type to be one of [ApiCallRateInsight], got ApiErrorRateInsight
│ 
│   with aws_cloudtrail.compliance-cloudtrail,
│   on main.tf line 314, in resource "aws_cloudtrail" "compliance-cloudtrail":
│  314:         insight_type = "ApiErrorRateInsight"

[evilr00t]

@josephbleroy looks like it's valid behaviour based on docs: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudtrail#insight_selector

insight_selector

This configuration block supports the following attributes:

    insight_type - (Optional) Type of insights to log on a trail. The valid value is ApiCallRateInsight

@DrFaust92 I don't see in the code anything related to ApiErrorRateInsight so I guess it hasn't been merged/prepared yet.

[DrFaust92]

Yeah seems it will be available next provider version. See my tests here on current main branch #21882

[ewbankkit]

The new enumeration value has been available since AWS SDK v1.42.6 which was merged into main via #21853.
This functionality has been available since Terraform AWS Provider v3.67.0.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.