How to use DATASOURCE::VPC::FlowLogs to query flow logs - Resource Orchestration Service

Syntax

{
  "Type": "DATASOURCE::VPC::FlowLogs",
  "Properties": {
    "FlowLogName": String,
    "Description": String,
    "LogStoreName": String,
    "ResourceId": String,
    "ProjectName": String,
    "ResourceType": String,
    "FlowLogId": String,
    "TrafficType": String,
    "RefreshOptions": String
  }
}

Properties

Property	Type	Required	Editable	Description	Constraint
FlowLogName	String	No	Yes	The name of the flow log.	The name must be 1 to 128 characters in length and cannot start with `http://` or `https://`.
Description	String	No	Yes	The description of the flow log.	None.
LogStoreName	String	No	Yes	The Logstore that stores the captured traffic data.	None.
ResourceId	String	No	Yes	The ID of the resource from which traffic is captured.	None.
ProjectName	String	No	Yes	The project that manages the captured traffic data.	None.
ResourceType	String	No	Yes	The type of resource from which traffic is captured.	Valid values: NetworkInterface: an elastic network interface (ENI) vSwitch: all ENIs in a vSwitch VPC: all ENIs in a virtual private cloud (VPC)
FlowLogId	String	No	Yes	The ID of the flow log.	None.
TrafficType	String	No	Yes	The type of traffic captured by the flow log.	Valid values: All: all traffic Allow: traffic that is allowed by Resource Access Management (RAM) Drop: traffic that is denied by RAM
RefreshOptions	String	No	Yes	The refresh policy for data source resources when the stack is updated.	Valid values: Never (default): Does not refresh data source resources when the stack is updated. Always: Refreshes data source resources when the stack is updated.

Return values

Fn::GetAtt

FlowLogs: details of the flow logs.
FlowLogIds: the IDs of the flow logs.

Property	Type	Description	Constraint
FlowLogIds	List	The IDs of the flow logs.	None.
FlowLogs	List	Details of the flow logs.	None.
Status	String	The status of the flow log.	Valid values: Active: The flow log is active. Activating: The flow log is being created. Inactive: The flow log is inactive.
FlowLogName	String	The name of the flow log.	None.
Description	String	The description of the flow log.	None.
ResourceType	String	The type of resource from which traffic is captured.	Valid values: NetworkInterface: an ENI vSwitch: all ENIs in a vSwitch VPC: all ENIs in a VPC
ProjectName	String	The project that manages the captured traffic data.	None.
RegionId	String	The region ID of the flow log.	None.
TrafficType	String	The type of traffic captured.	Valid values: All: all traffic Allow: traffic that is allowed by RAM Drop: traffic that is denied by RAM
LogStoreName	String	The Logstore that stores the captured traffic data.	None.
ResourceId	String	The ID of the resource from which traffic is captured.	None.
FlowLogId	String	The ID of the flow log.	None.
CreateTime	String	The time when the flow log was created.	None.

Examples

YAML

ROSTemplateFormatVersion: '2015-09-01'
Parameters: {}
Resources:
  ExtensionDataSource:
    Type: DATASOURCE::VPC::FlowLogs
    Properties:
      ResourceType: VPC
      TrafficType: All
Outputs:
  FlowLogs:
    Description: The list of flow logs.
    Value:
      Fn::GetAtt:
        - ExtensionDataSource
        - FlowLogs
  FlowLogIds:
    Description: The list of flow log IDs.
    Value:
      Fn::GetAtt:
        - ExtensionDataSource
        - FlowLogIds

JSON

{
  "ROSTemplateFormatVersion": "2015-09-01",
  "Parameters": {
  },
  "Resources": {
    "ExtensionDataSource": {
      "Type": "DATASOURCE::VPC::FlowLogs",
      "Properties": {
        "ResourceType": "VPC",
        "TrafficType": "All"
      }
    }
  },
  "Outputs": {
    "FlowLogs": {
      "Description": "The list of flow logs.",
      "Value": {
        "Fn::GetAtt": [
          "ExtensionDataSource",
          "FlowLogs"
        ]
      }
    },
    "FlowLogIds": {
      "Description": "The list of flow log IDs.",
      "Value": {
        "Fn::GetAtt": [
          "ExtensionDataSource",
          "FlowLogIds"
        ]
      }
    }
  }
}