agent-claw: automated task changes

cdk/node_modules/aws-cdk-lib/aws-logs/.jsiirc.json

@@ -0,0 +1,13 @@
+{
+  "targets": {
+    "java": {
+      "package": "software.amazon.awscdk.services.logs"
+    },
+    "dotnet": {
+      "namespace": "Amazon.CDK.AWS.Logs"
+    },
+    "python": {
+      "module": "aws_cdk.aws_logs"
+    }
+  }
+}

cdk/node_modules/aws-cdk-lib/aws-logs/README.md

@@ -0,0 +1,570 @@
+# Amazon CloudWatch Logs Construct Library
+
+
+This library supplies constructs for working with CloudWatch Logs.
+
+## Log Groups/Streams
+
+The basic unit of CloudWatch is a *Log Group*. Every log group typically has the
+same kind of data logged to it, in the same format. If there are multiple
+applications or services logging into the Log Group, each of them creates a new
+*Log Stream*.
+
+Every log operation creates a "log event", which can consist of a simple string
+or a single-line JSON object. JSON objects have the advantage that they afford
+more filtering abilities (see below).
+
+The only configurable attribute for log streams is the retention period, which
+configures after how much time the events in the log stream expire and are
+deleted.
+
+The default retention period if not supplied is 2 years, but it can be set to
+one of the values in the `RetentionDays` enum to configure a different
+retention period (including infinite retention).
+
+[retention example](test/example.retention.lit.ts)
+
+## LogRetention
+
+The `LogRetention` construct is a way to control the retention period of log groups that are created outside of the CDK. The construct is usually
+used on log groups that are auto created by AWS services, such as [AWS
+lambda](https://docs.aws.amazon.com/lambda/latest/dg/monitoring-cloudwatchlogs.html).
+
+This is implemented using a [CloudFormation custom
+resource](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cfn-customresource.html)
+which pre-creates the log group if it doesn't exist, and sets the specified log retention period (never expire, by default).
+
+By default, the log group will be created in the same region as the stack. The `logGroupRegion` property can be used to configure
+log groups in other regions. This is typically useful when controlling retention for log groups auto-created by global services that
+publish their log group to a specific region, such as AWS Chatbot creating a log group in `us-east-1`.
+
+By default, the log group created by LogRetention will be retained after the stack is deleted. If the RemovalPolicy is set to DESTROY, then the log group will be deleted when the stack is deleted.
+
+## Log Group Class
+
+CloudWatch Logs offers two classes of log groups:
+
+1. The CloudWatch Logs Standard log class is a full-featured option for logs that require real-time monitoring or logs that you access frequently.
+
+2. The CloudWatch Logs Infrequent Access log class is a new log class that you can use to cost-effectively consolidate your logs. This log class offers a subset of CloudWatch Logs capabilities including managed ingestion, storage, cross-account log analytics, and encryption with a lower ingestion price per GB. The Infrequent Access log class is ideal for ad-hoc querying and after-the-fact forensic analysis on infrequently accessed logs.
+
+For more details please check: [log group class documentation](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch_Logs_Log_Classes.html)
+
+## Resource Policy
+
+CloudWatch Resource Policies allow other AWS services or IAM Principals to put log events into the log groups.
+A resource policy is automatically created when `addToResourcePolicy` is called on the LogGroup for the first time:
+
+```ts
+const logGroup = new logs.LogGroup(this, 'LogGroup');
+logGroup.addToResourcePolicy(new iam.PolicyStatement({
+    actions: ['logs:CreateLogStream', 'logs:PutLogEvents'],
+    principals: [new iam.ServicePrincipal('es.amazonaws.com')],
+    resources: [logGroup.logGroupArn],
+}));
+```
+
+Or more conveniently, write permissions to the log group can be granted as follows which gives same result as in the above example.
+
+```ts
+const logGroup = new logs.LogGroup(this, 'LogGroup');
+logGroup.grants.write(new iam.ServicePrincipal('es.amazonaws.com'));
+```
+
+Similarly, read permissions can be granted to the log group as follows.
+
+```ts
+const logGroup = new logs.LogGroup(this, 'LogGroup');
+logGroup.grants.read(new iam.ServicePrincipal('es.amazonaws.com'));
+```
+
+Be aware that any ARNs or tokenized values passed to the resource policy will be converted into AWS Account IDs.
+This is because CloudWatch Logs Resource Policies do not accept ARNs as principals, but they do accept
+Account ID strings. Non-ARN principals, like Service principals or Any principals, are accepted by CloudWatch.
+
+## Encrypting Log Groups
+
+By default, log group data is always encrypted in CloudWatch Logs. You have the
+option to encrypt log group data using a AWS KMS customer master key (CMK) should
+you not wish to use the default AWS encryption. Keep in mind that if you decide to
+encrypt a log group, any service or IAM identity that needs to read the encrypted
+log streams in the future will require the same CMK to decrypt the data.
+
+Here's a simple example of creating an encrypted Log Group using a KMS CMK.
+
+```ts
+import * as kms from 'aws-cdk-lib/aws-kms';
+
+new logs.LogGroup(this, 'LogGroup', {
+  encryptionKey: new kms.Key(this, 'Key'),
+});
+```
+
+See the AWS documentation for more detailed information about [encrypting CloudWatch
+Logs](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/encrypt-log-data-kms.html).
+
+## Subscriptions and Destinations
+
+Log events matching a particular filter can be sent to either a Lambda function
+or a Kinesis stream.
+
+If the Kinesis stream lives in a different account, a `CrossAccountDestination`
+object must be explicitly created in the destination account which will act as a proxy
+for the remote Kinesis stream.
+
+Note: The aws-cdk-lib/aws-logs-destinations KinesisDestination construct does not automatically create a CrossAccountDestination for cross-account scenarios.
+
+Create a `SubscriptionFilter`, initialize it with an appropriate `Pattern` (see
+below) and supply the intended destination:
+
+```ts
+import * as destinations from 'aws-cdk-lib/aws-logs-destinations';
+
+declare const fn: lambda.Function;
+declare const logGroup: logs.LogGroup;
+
+new logs.SubscriptionFilter(this, 'Subscription', {
+  logGroup,
+  destination: new destinations.LambdaDestination(fn),
+  filterPattern: logs.FilterPattern.allTerms("ERROR", "MainThread"),
+  filterName: 'ErrorInMainThread',
+});
+```
+
+When you use `KinesisDestination`, you can choose the method used to
+distribute log data to the destination by setting the `distribution` property.
+
+```ts
+import * as destinations from 'aws-cdk-lib/aws-logs-destinations';
+import * as kinesis from 'aws-cdk-lib/aws-kinesis';
+
+declare const stream: kinesis.Stream;
+declare const logGroup: logs.LogGroup;
+
+new logs.SubscriptionFilter(this, 'Subscription', {
+  logGroup,
+  destination: new destinations.KinesisDestination(stream),
+  filterPattern: logs.FilterPattern.allTerms("ERROR", "MainThread"),
+  filterName: 'ErrorInMainThread',
+  distribution: logs.Distribution.RANDOM,
+});
+```
+
+When you use `FirehoseDestination`, you can choose the method used to
+distribute log data to the destination by setting the `distribution` property.
+
+```ts
+import * as destinations from 'aws-cdk-lib/aws-logs-destinations';
+import * as firehose from 'aws-cdk-lib/aws-kinesisfirehose';
+
+declare const deliveryStream: firehose.IDeliveryStream;
+declare const logGroup: logs.LogGroup;
+
+new logs.SubscriptionFilter(this, 'Subscription', {
+  logGroup,
+  destination: new destinations.FirehoseDestination(deliveryStream),
+  filterPattern: logs.FilterPattern.allEvents(),
+});
+```
+
+## Metric Filters
+
+CloudWatch Logs can extract and emit metrics based on a textual log stream.
+Depending on your needs, this may be a more convenient way of generating metrics
+for you application than making calls to CloudWatch Metrics yourself.
+
+A `MetricFilter` either emits a fixed number every time it sees a log event
+matching a particular pattern (see below), or extracts a number from the log
+event and uses that as the metric value.
+
+Example:
+
+[metricfilter example](test/integ.metricfilter.lit.ts)
+
+Remember that if you want to use a value from the log event as the metric value,
+you must mention it in your pattern somewhere.
+
+A very simple MetricFilter can be created by using the `logGroup.extractMetric()`
+helper function:
+
+```ts
+declare const logGroup: logs.LogGroup;
+logGroup.extractMetric('$.jsonField', 'Namespace', 'MetricName');
+```
+
+Will extract the value of `jsonField` wherever it occurs in JSON-structured
+log records in the LogGroup, and emit them to CloudWatch Metrics under
+the name `Namespace/MetricName`.
+
+### Exposing Metric on a Metric Filter
+
+You can expose a metric on a metric filter by calling the `MetricFilter.metric()` API.
+This has a default of `statistic = 'avg'` if the statistic is not set in the `props`.
+
+```ts
+declare const logGroup: logs.LogGroup;
+const mf = new logs.MetricFilter(this, 'MetricFilter', {
+  logGroup,
+  metricNamespace: 'MyApp',
+  metricName: 'Latency',
+  filterPattern: logs.FilterPattern.exists('$.latency'),
+  metricValue: '$.latency',
+  dimensions: {
+    ErrorCode: '$.errorCode',
+  },
+  unit: cloudwatch.Unit.MILLISECONDS,
+});
+
+//expose a metric from the metric filter
+const metric = mf.metric();
+
+//you can use the metric to create a new alarm
+new cloudwatch.Alarm(this, 'alarm from metric filter', {
+  metric,
+  threshold: 100,
+  evaluationPeriods: 2,
+});
+```
+
+### Metrics for IncomingLogs and IncomingBytes
+Metric methods have been defined for IncomingLogs and IncomingBytes within LogGroups. These metrics allow for the creation of alarms on log ingestion, ensuring that the log ingestion process is functioning correctly.
+
+To define an alarm based on these metrics, you can use the following template:
+```ts
+const logGroup = new logs.LogGroup(this, 'MyLogGroup');
+const incomingEventsMetric = logGroup.metricIncomingLogEvents();
+new cloudwatch.Alarm(this, 'HighLogVolumeAlarm', {
+  metric: incomingEventsMetric,
+  threshold: 1000,
+  evaluationPeriods: 1,
+});
+```
+```ts
+const logGroup = new logs.LogGroup(this, 'MyLogGroup');
+const incomingBytesMetric = logGroup.metricIncomingBytes();
+new cloudwatch.Alarm(this, 'HighDataVolumeAlarm', {
+  metric: incomingBytesMetric,
+  threshold: 5000000,  // 5 MB
+  evaluationPeriods: 1,
+});
+```
+
+## Patterns
+
+Patterns describe which log events match a subscription or metric filter. There
+are three types of patterns:
+
+* Text patterns
+* JSON patterns
+* Space-delimited table patterns
+
+All patterns are constructed by using static functions on the `FilterPattern`
+class.
+
+In addition to the patterns above, the following special patterns exist:
+
+* `FilterPattern.allEvents()`: matches all log events.
+* `FilterPattern.literal(string)`: if you already know what pattern expression to
+  use, this function takes a string and will use that as the log pattern. For
+  more information, see the [Filter and Pattern
+  Syntax](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/FilterAndPatternSyntax.html).
+
+### Text Patterns
+
+Text patterns match if the literal strings appear in the text form of the log
+line.
+
+* `FilterPattern.allTerms(term, term, ...)`: matches if all of the given terms
+  (substrings) appear in the log event.
+* `FilterPattern.anyTerm(term, term, ...)`: matches if all of the given terms
+  (substrings) appear in the log event.
+* `FilterPattern.anyTermGroup([term, term, ...], [term, term, ...], ...)`: matches if
+  all of the terms in any of the groups (specified as arrays) matches. This is
+  an OR match.
+
+Examples:
+
+```ts
+// Search for lines that contain both "ERROR" and "MainThread"
+const pattern1 = logs.FilterPattern.allTerms('ERROR', 'MainThread');
+
+// Search for lines that either contain both "ERROR" and "MainThread", or
+// both "WARN" and "Deadlock".
+const pattern2 = logs.FilterPattern.anyTermGroup(
+  ['ERROR', 'MainThread'],
+  ['WARN', 'Deadlock'],
+);
+```
+
+## JSON Patterns
+
+JSON patterns apply if the log event is the JSON representation of an object
+(without any other characters, so it cannot include a prefix such as timestamp
+or log level). JSON patterns can make comparisons on the values inside the
+fields.
+
+* **Strings**: the comparison operators allowed for strings are `=` and `!=`.
+  String values can start or end with a `*` wildcard.
+* **Numbers**: the comparison operators allowed for numbers are `=`, `!=`,
+  `<`, `<=`, `>`, `>=`.
+
+Fields in the JSON structure are identified by identifier the complete object as `$`
+and then descending into it, such as `$.field` or `$.list[0].field`.
+
+* `FilterPattern.stringValue(field, comparison, string)`: matches if the given
+  field compares as indicated with the given string value.
+* `FilterPattern.regexValue(field, comparison, string)`: matches if the given
+  field compares as indicated with the given regex pattern.
+* `FilterPattern.numberValue(field, comparison, number)`: matches if the given
+  field compares as indicated with the given numerical value.
+* `FilterPattern.isNull(field)`: matches if the given field exists and has the
+  value `null`.
+* `FilterPattern.notExists(field)`: matches if the given field is not in the JSON
+  structure.
+* `FilterPattern.exists(field)`: matches if the given field is in the JSON
+  structure.
+* `FilterPattern.booleanValue(field, boolean)`: matches if the given field
+  is exactly the given boolean value.
+* `FilterPattern.all(jsonPattern, jsonPattern, ...)`: matches if all of the
+  given JSON patterns match. This makes an AND combination of the given
+  patterns.
+* `FilterPattern.any(jsonPattern, jsonPattern, ...)`: matches if any of the
+  given JSON patterns match. This makes an OR combination of the given
+  patterns.
+
+Example:
+
+```ts
+// Search for all events where the component field is equal to
+// "HttpServer" and either error is true or the latency is higher
+// than 1000.
+const pattern = logs.FilterPattern.all(
+  logs.FilterPattern.stringValue('$.component', '=', 'HttpServer'),
+  logs.FilterPattern.any(
+    logs.FilterPattern.booleanValue('$.error', true),
+    logs.FilterPattern.numberValue('$.latency', '>', 1000),
+  ),
+  logs.FilterPattern.regexValue('$.message', '=', 'bind address already in use'),
+);
+```
+
+## Space-delimited table patterns
+
+If the log events are rows of a space-delimited table, this pattern can be used
+to identify the columns in that structure and add conditions on any of them. The
+canonical example where you would apply this type of pattern is Apache server
+logs.
+
+Text that is surrounded by `"..."` quotes or `[...]` square brackets will
+be treated as one column.
+
+* `FilterPattern.spaceDelimited(column, column, ...)`: construct a
+  `SpaceDelimitedTextPattern` object with the indicated columns. The columns
+  map one-by-one the columns found in the log event. The string `"..."` may
+  be used to specify an arbitrary number of unnamed columns anywhere in the
+  name list (but may only be specified once).
+
+After constructing a `SpaceDelimitedTextPattern`, you can use the following
+two members to add restrictions:
+
+* `pattern.whereString(field, comparison, string)`: add a string condition.
+  The rules are the same as for JSON patterns.
+* `pattern.whereNumber(field, comparison, number)`: add a numerical condition.
+  The rules are the same as for JSON patterns.
+
+Multiple restrictions can be added on the same column; they must all apply.
+
+Example:
+
+```ts
+// Search for all events where the component is "HttpServer" and the
+// result code is not equal to 200.
+const pattern = logs.FilterPattern.spaceDelimited('time', 'component', '...', 'result_code', 'latency')
+  .whereString('component', '=', 'HttpServer')
+  .whereNumber('result_code', '!=', 200);
+```
+
+## Logs Insights Query Definition
+
+Creates a query definition for CloudWatch Logs Insights.
+
+Example:
+
+```ts
+new logs.QueryDefinition(this, 'QueryDefinition', {
+  queryDefinitionName: 'MyQuery',
+  queryString: new logs.QueryString({
+    fields: ['@timestamp', '@message'],
+    parseStatements: [
+      '@message "[*] *" as loggingType, loggingMessage',
+      '@message "<*>: *" as differentLoggingType, differentLoggingMessage',
+    ],
+    filterStatements: [
+      'loggingType = "ERROR"',
+      'loggingMessage = "A very strange error occurred!"',
+    ],
+    statsStatements: [
+      'count(loggingMessage) as loggingErrors',
+      'count(differentLoggingMessage) as differentLoggingErrors',
+    ],
+    sort: '@timestamp desc',
+    limit: 20,
+  }),
+});
+```
+
+## Data Protection Policy
+
+Creates a data protection policy and assigns it to the log group. A data protection policy can help safeguard sensitive data that's ingested by the log group by auditing and masking the sensitive log data. When a user who does not have permission to view masked data views a log event that includes masked data, the sensitive data is replaced by asterisks.
+
+For more information, see [Protect sensitive log data with masking](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/mask-sensitive-log-data.html).
+
+For a list of types of managed identifiers that can be audited and masked, see [Types of data that you can protect](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/protect-sensitive-log-data-types.html).
+
+If a new identifier is supported but not yet in the `DataIdentifiers` enum, the name of the identifier can be supplied as `name` in the constructor instead.
+
+To add a custom data identifier, supply a custom `name` and `regex` to the `CustomDataIdentifiers` constructor.
+For more information on custom data identifiers, see [Custom data identifiers](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL-custom-data-identifiers.html).
+
+Each policy may consist of a log group, S3 bucket, and/or Firehose delivery stream audit destination.
+
+Example:
+
+```ts
+import * as firehose from 'aws-cdk-lib/aws-kinesisfirehose';
+
+const logGroupDestination = new logs.LogGroup(this, 'LogGroupLambdaAudit', {
+  logGroupName: 'auditDestinationForCDK',
+});
+
+const bucket = new s3.Bucket(this, 'audit-bucket');
+const s3Destination = new firehose.S3Bucket(bucket);
+
+const deliveryStream = new firehose.DeliveryStream(this, 'Delivery Stream', {
+  destination: s3Destination,
+});
+
+const dataProtectionPolicy = new logs.DataProtectionPolicy({
+  name: 'data protection policy',
+  description: 'policy description',
+  identifiers: [
+    logs.DataIdentifier.DRIVERSLICENSE_US, // managed data identifier
+    new logs.DataIdentifier('EmailAddress'), // forward compatibility for new managed data identifiers
+    new logs.CustomDataIdentifier('EmployeeId', 'EmployeeId-\\d{9}')], // custom data identifier
+  logGroupAuditDestination: logGroupDestination,
+  s3BucketAuditDestination: bucket,
+  deliveryStreamNameAuditDestination: deliveryStream.deliveryStreamName,
+});
+
+new logs.LogGroup(this, 'LogGroupLambda', {
+  logGroupName: 'cdkIntegLogGroup',
+  dataProtectionPolicy: dataProtectionPolicy,
+});
+```
+
+## Configure Deletion Protection
+
+Indicates whether deletion protection is enabled for this log group. When enabled, deletion protection blocks all deletion operations until it is explicitly disabled.
+
+For more information, see [Protecting log groups from deletion](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/protecting-log-groups-from-deletion.html).
+
+```ts
+new logs.LogGroup(this, 'LogGroup', {
+  deletionProtectionEnabled: true,
+});
+```
+
+
+## Field Index Policies
+
+Creates or updates a field index policy for the specified log group. You can use field index policies to create field indexes on fields found in log events in the log group. Creating field indexes lowers the costs for CloudWatch Logs Insights queries that reference those field indexes, because these queries attempt to skip the processing of log events that are known to not match the indexed field. Good fields to index are fields that you often need to query for and fields that have high cardinality of values.
+
+For more information, see [Create field indexes to improve query performance and reduce costs](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatchLogs-Field-Indexing.html).
+
+Only log groups in the Standard log class support field index policies.
+Currently, this array supports only one field index policy object.
+
+Example:
+
+```ts
+
+const fieldIndexPolicy = new logs.FieldIndexPolicy({
+  fields: ['Operation', 'RequestId'],
+});
+
+new logs.LogGroup(this, 'LogGroup', {
+  logGroupName: 'cdkIntegLogGroup',
+  fieldIndexPolicies: [fieldIndexPolicy],
+});
+```
+
+## Transformer
+
+A log transformer enables transforming log events into a different format, making them easier
+to process and analyze. You can transform logs from different sources into standardized formats
+that contain relevant, source-specific information. Transformations are performed at the time of log ingestion.
+Transformers support several types of processors which can be chained into a processing pipeline (subject to some restrictions, see [Usage Limits](#usage-limits)).
+
+### Processor Types
+
+1. **Parser Processors**: Parse string log events into structured log events. These are configurable parsers created using `ParserProcessor`, and support conversion to a format like Json, extracting fields from CSV input, converting vended sources to [OCSF](https://schema.ocsf.io/1.1.0/) format, regex parsing using Grok patterns or key-value parsing. Refer [configurable parsers](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.html#CloudWatch-Logs-Transformation-Configurable) for more examples.
+
+2. **Vended Log Parsers**: Parse log events from vended sources into structured log events. These are created using `VendedLogParser`, and support conversion from sources such as AWS WAF, PostGres, Route53, CloudFront and VPC. These parsers are not configurable, meaning these can be added to the pipeline but do not accept any properties or configurations. Refer [vended log parsers](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.html#CloudWatch-Logs-Transformation-BuiltIn) for more examples.
+
+3. **String Mutators**: Perform operations on string values in a field of a log event and are created using `StringMutatorProcessor`. These can be used to format string values in the log event such as changing case, removing trailing whitespaces or extracting values from a string field by splitting the string or regex backreferences. Refer [string mutators](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.html#CloudWatch-Logs-Transformation-StringMutate) for more examples.
+
+4. **JSON Mutators**: Perform operation on JSON log events and are created using `JsonMutatorProcessor`. These processors can be used to enrich log events by adding new fields, deleting, moving, renaming fields, copying values to other fields or converting a list of key-value pairs to a map. Refer [JSON mutators](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.html#CloudWatch-Logs-Transformation-JSONMutate) for more examples.
+
+5. **Data Converters**: Convert the data into different formats and are created using `DataConverterProcessor`. These can be used to convert values in a field to datatypes such as integers, string, double and boolean or to convert dates and times to different formats. Refer [datatype processors](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.html#CloudWatch-Logs-Transformation-Datatype) for more examples.
+
+### Usage Limits
+
+- A transformer can have a maximum of 20 processors
+- At least one parser-type processor is required
+- Maximum of 5 parser-type processors allowed
+- AWS vended log parser (if used) must be the first processor
+- Only one parseToOcsf processor, one grok processor, one addKeys processor, and one copyValue processor allowed per transformer
+- Transformers can only be used with log groups in the Standard log class
+
+Example:
+
+```ts
+
+// Create a log group
+const logGroup = new logs.LogGroup(this, 'MyLogGroup');
+
+// Create a JSON parser processor
+const jsonParser = new logs.ParserProcessor({
+  type: logs.ParserProcessorType.JSON
+});
+
+// Create a processor to add keys
+const addKeysProcessor = new logs.JsonMutatorProcessor({
+  type: logs.JsonMutatorType.ADD_KEYS,
+  addKeysOptions: {
+    entries: [{
+      key: 'metadata.transformed_in',
+      value: 'CloudWatchLogs'
+    }]
+  }
+});
+
+// Create a transformer with these processors
+new logs.Transformer(this, 'Transformer', {
+  transformerName: 'MyTransformer',
+  logGroup: logGroup,
+  transformerConfig: [jsonParser, addKeysProcessor]
+});
+```
+
+For more details on CloudWatch Logs transformation processors, refer to the [AWS documentation](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.html).
+
+### Usage of metric filters on transformed logs
+
+In order to use the transformed logs as search pattern, set the parameter `applyOnTransformedLogs: true` in the MetricFilterProps.
+
+## Notes
+
+Be aware that Log Group ARNs will always have the string `:*` appended to
+them, to match the behavior of [the CloudFormation `AWS::Logs::LogGroup`
+resource](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-logs-loggroup.html#aws-resource-logs-loggroup-return-values).

cdk/node_modules/aws-cdk-lib/aws-logs/grants.json

@@ -0,0 +1,26 @@
+{
+  "resources": {
+    "LogGroup": {
+      "hasResourcePolicy": true,
+      "grants": {
+        "write": {
+          "actions": [
+            "logs:CreateLogStream",
+            "logs:PutLogEvents"
+          ],
+          "docSummary": "Give permissions to create and write to streams in this log group"
+        },
+        "read": {
+          "actions": [
+            "logs:FilterLogEvents",
+            "logs:GetLogEvents",
+            "logs:GetLogGroupFields",
+            "logs:DescribeLogGroups",
+            "logs:DescribeLogStreams"
+          ],
+          "docSummary": "Give permissions to read and filter events from this log group"
+        }
+      }
+    }
+  }
+}

cdk/node_modules/aws-cdk-lib/aws-logs/index.d.ts

@@ -0,0 +1 @@
+export * from './lib';

cdk/node_modules/aws-cdk-lib/aws-logs/lib/cross-account-destination.d.ts

@@ -0,0 +1,73 @@
+import type { Construct } from 'constructs';
+import type { ILogGroupRef } from './logs.generated';
+import type { ILogSubscriptionDestination, LogSubscriptionDestinationConfig } from './subscription-filter';
+import * as iam from '../../aws-iam';
+import * as cdk from '../../core';
+/**
+ * Properties for a CrossAccountDestination
+ */
+export interface CrossAccountDestinationProps {
+    /**
+     * The name of the log destination.
+     *
+     * @default Automatically generated
+     */
+    readonly destinationName?: string;
+    /**
+     * The role to assume that grants permissions to write to 'target'.
+     *
+     * The role must be assumable by 'logs.{REGION}.amazonaws.com'.
+     */
+    readonly role: iam.IRoleRef;
+    /**
+     * The log destination target's ARN
+     */
+    readonly targetArn: string;
+}
+/**
+ * A new CloudWatch Logs Destination for use in cross-account scenarios
+ *
+ * CrossAccountDestinations are used to subscribe a Kinesis stream in a
+ * different account to a CloudWatch Subscription.
+ *
+ * For cross-account scenarios, you need to manually create a
+ * `CrossAccountDestination` in the destination account. The integration
+ * classes in the `aws-cdk-lib/aws-logs-destinations` package (such as
+ * `KinesisDestination`) only handle same-account scenarios and do not
+ * automatically create `CrossAccountDestination` for cross-account usage.
+ *
+ * @resource AWS::Logs::Destination
+ */
+export declare class CrossAccountDestination extends cdk.Resource implements ILogSubscriptionDestination {
+    /** Uniquely identifies this class. */
+    static readonly PROPERTY_INJECTION_ID: string;
+    /**
+     * Policy object of this CrossAccountDestination object
+     */
+    readonly policyDocument: iam.PolicyDocument;
+    /**
+     * The inner resource
+     */
+    private readonly resource;
+    /**
+     * The name of this CrossAccountDestination object
+     * @attribute
+     */
+    get destinationName(): string;
+    /**
+     * The ARN of this CrossAccountDestination object
+     * @attribute
+     */
+    get destinationArn(): string;
+    constructor(scope: Construct, id: string, props: CrossAccountDestinationProps);
+    addToPolicy(statement: iam.PolicyStatement): void;
+    bind(_scope: Construct, _sourceLogGroup: ILogGroupRef): LogSubscriptionDestinationConfig;
+    /**
+     * Generate a unique Destination name in case the user didn't supply one
+     */
+    private generateUniqueName;
+    /**
+     * Return a stringified JSON version of the PolicyDocument
+     */
+    private lazyStringifiedPolicyDocument;
+}

cdk/node_modules/aws-cdk-lib/aws-logs/lib/data-protection-policy.d.ts

@@ -0,0 +1,214 @@
+import type { Construct } from 'constructs';
+import type { IBucketRef } from '../../aws-s3';
+import type { ILogGroupRef } from '../../interfaces/generated/aws-logs-interfaces.generated';
+/**
+ * Creates a data protection policy for CloudWatch Logs log groups.
+ */
+export declare class DataProtectionPolicy {
+    private readonly dataProtectionPolicyProps;
+    constructor(props: DataProtectionPolicyProps);
+    /**
+     * @internal
+     */
+    _bind(_scope: Construct): DataProtectionPolicyConfig;
+}
+/**
+ * Interface representing a data protection policy
+ */
+interface DataProtectionPolicyConfig {
+    /**
+     * Name of the data protection policy
+     *
+     * @default - 'data-protection-policy-cdk'
+     */
+    readonly name: string;
+    /**
+     * Description of the data protection policy
+     *
+     * @default - 'cdk generated data protection policy'
+     */
+    readonly description: string;
+    /**
+     * Version of the data protection policy
+     */
+    readonly version: string;
+    /**
+     * Configuration of the data protection policy. Currently supports custom data identifiers
+     */
+    readonly configuration: any;
+    /**
+     * Statements within the data protection policy. Must contain one Audit and one Redact statement
+     */
+    readonly statement: any;
+}
+/**
+ * Properties for creating a data protection policy
+ */
+export interface DataProtectionPolicyProps {
+    /**
+     * Name of the data protection policy
+     *
+     * @default - 'data-protection-policy-cdk'
+     */
+    readonly name?: string;
+    /**
+     * Description of the data protection policy
+     *
+     * @default - 'cdk generated data protection policy'
+     */
+    readonly description?: string;
+    /**
+     * List of data protection identifiers.
+     *
+     * Managed data identifiers must be in the following list: https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL-managed-data-identifiers.html
+     * Custom data identifiers must have a valid regex defined: https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL-custom-data-identifiers.html#custom-data-identifiers-constraints
+     */
+    readonly identifiers: DataIdentifier[];
+    /**
+     * CloudWatch Logs log group to send audit findings to. The log group must already exist prior to creating the data protection policy.
+     *
+     * @default - no CloudWatch Logs audit destination
+     */
+    readonly logGroupAuditDestination?: ILogGroupRef;
+    /**
+     * S3 bucket to send audit findings to. The bucket must already exist.
+     *
+     * @default - no S3 bucket audit destination
+     */
+    readonly s3BucketAuditDestination?: IBucketRef;
+    /**
+     * Amazon Data Firehose delivery stream to send audit findings to. The delivery stream must already exist.
+     *
+     * @default - no firehose delivery stream audit destination
+     */
+    readonly deliveryStreamNameAuditDestination?: string;
+}
+/**
+ * A data protection identifier. If an identifier is supported but not in this class, it can be passed in the constructor instead.
+ */
+export declare class DataIdentifier {
+    readonly name: string;
+    static readonly ADDRESS: DataIdentifier;
+    static readonly AWSSECRETKEY: DataIdentifier;
+    static readonly BANKACCOUNTNUMBER_DE: DataIdentifier;
+    static readonly BANKACCOUNTNUMBER_ES: DataIdentifier;
+    static readonly BANKACCOUNTNUMBER_FR: DataIdentifier;
+    static readonly BANKACCOUNTNUMBER_GB: DataIdentifier;
+    static readonly BANKACCOUNTNUMBER_IT: DataIdentifier;
+    static readonly BANKACCOUNTNUMBER_US: DataIdentifier;
+    static readonly CEPCODE_BR: DataIdentifier;
+    static readonly CNPJ_BR: DataIdentifier;
+    static readonly CPFCODE_BR: DataIdentifier;
+    static readonly CREDITCARDEXPIRATION: DataIdentifier;
+    static readonly CREDITCARDNUMBER: DataIdentifier;
+    static readonly CREDITCARDSECURITYCODE: DataIdentifier;
+    static readonly DRIVERSLICENSE_AT: DataIdentifier;
+    static readonly DRIVERSLICENSE_AU: DataIdentifier;
+    static readonly DRIVERSLICENSE_BE: DataIdentifier;
+    static readonly DRIVERSLICENSE_BG: DataIdentifier;
+    static readonly DRIVERSLICENSE_CA: DataIdentifier;
+    static readonly DRIVERSLICENSE_CY: DataIdentifier;
+    static readonly DRIVERSLICENSE_CZ: DataIdentifier;
+    static readonly DRIVERSLICENSE_DE: DataIdentifier;
+    static readonly DRIVERSLICENSE_DK: DataIdentifier;
+    static readonly DRIVERSLICENSE_EE: DataIdentifier;
+    static readonly DRIVERSLICENSE_ES: DataIdentifier;
+    static readonly DRIVERSLICENSE_FI: DataIdentifier;
+    static readonly DRIVERSLICENSE_FR: DataIdentifier;
+    static readonly DRIVERSLICENSE_GB: DataIdentifier;
+    static readonly DRIVERSLICENSE_GR: DataIdentifier;
+    static readonly DRIVERSLICENSE_HR: DataIdentifier;
+    static readonly DRIVERSLICENSE_HU: DataIdentifier;
+    static readonly DRIVERSLICENSE_IE: DataIdentifier;
+    static readonly DRIVERSLICENSE_IT: DataIdentifier;
+    static readonly DRIVERSLICENSE_LT: DataIdentifier;
+    static readonly DRIVERSLICENSE_LU: DataIdentifier;
+    static readonly DRIVERSLICENSE_LV: DataIdentifier;
+    static readonly DRIVERSLICENSE_MT: DataIdentifier;
+    static readonly DRIVERSLICENSE_NL: DataIdentifier;
+    static readonly DRIVERSLICENSE_PL: DataIdentifier;
+    static readonly DRIVERSLICENSE_PT: DataIdentifier;
+    static readonly DRIVERSLICENSE_RO: DataIdentifier;
+    static readonly DRIVERSLICENSE_SE: DataIdentifier;
+    static readonly DRIVERSLICENSE_SI: DataIdentifier;
+    static readonly DRIVERSLICENSE_SK: DataIdentifier;
+    static readonly DRIVERSLICENSE_US: DataIdentifier;
+    static readonly DRUGENFORCEMENTAGENCYNUMBER_US: DataIdentifier;
+    static readonly ELECTORALROLLNUMBER_GB: DataIdentifier;
+    static readonly EMAILADDRESS: DataIdentifier;
+    static readonly HEALTHINSURANCECARDNUMBER_EU: DataIdentifier;
+    static readonly HEALTHINSURANCECLAIMNUMBER_US: DataIdentifier;
+    static readonly HEALTHINSURANCENUMBER_FR: DataIdentifier;
+    static readonly HEALTHCAREPROCEDURECODE_US: DataIdentifier;
+    static readonly INDIVIDUALTAXIDENTIFICATIONNUMBER_US: DataIdentifier;
+    static readonly INSEECODE_FR: DataIdentifier;
+    static readonly IPADDRESS: DataIdentifier;
+    static readonly LATLONG: DataIdentifier;
+    static readonly MEDICAREBENEFICIARYNUMBER_US: DataIdentifier;
+    static readonly NAME: DataIdentifier;
+    static readonly NATIONALDRUGCODE_US: DataIdentifier;
+    static readonly NATIONALIDENTIFICATIONNUMBER_DE: DataIdentifier;
+    static readonly NATIONALIDENTIFICATIONNUMBER_ES: DataIdentifier;
+    static readonly NATIONALIDENTIFICATIONNUMBER_IT: DataIdentifier;
+    static readonly NATIONALINSURANCENUMBER_GB: DataIdentifier;
+    static readonly NATIONALPROVIDERID_US: DataIdentifier;
+    static readonly NHSNUMBER_GB: DataIdentifier;
+    static readonly NIENUMBER_ES: DataIdentifier;
+    static readonly NIFNUMBER_ES: DataIdentifier;
+    static readonly OPENSSHPRIVATEKEY: DataIdentifier;
+    static readonly PASSPORTNUMBER_CA: DataIdentifier;
+    static readonly PASSPORTNUMBER_DE: DataIdentifier;
+    static readonly PASSPORTNUMBER_ES: DataIdentifier;
+    static readonly PASSPORTNUMBER_FR: DataIdentifier;
+    static readonly PASSPORTNUMBER_GB: DataIdentifier;
+    static readonly PASSPORTNUMBER_IT: DataIdentifier;
+    static readonly PASSPORTNUMBER_US: DataIdentifier;
+    static readonly PERMANENTRESIDENCENUMBER_CA: DataIdentifier;
+    static readonly PERSONALHEALTHNUMBER_CA: DataIdentifier;
+    static readonly PGPPRIVATEKEY: DataIdentifier;
+    static readonly PHONENUMBER_BR: DataIdentifier;
+    static readonly PHONENUMBER_DE: DataIdentifier;
+    static readonly PHONENUMBER_ES: DataIdentifier;
+    static readonly PHONENUMBER_FR: DataIdentifier;
+    static readonly PHONENUMBER_GB: DataIdentifier;
+    static readonly PHONENUMBER_IT: DataIdentifier;
+    static readonly PHONENUMBER_US: DataIdentifier;
+    static readonly PKCSPRIVATEKEY: DataIdentifier;
+    static readonly POSTALCODE_CA: DataIdentifier;
+    static readonly PUTTYPRIVATEKEY: DataIdentifier;
+    static readonly RGNUMBER_BR: DataIdentifier;
+    static readonly SOCIALINSURANCENUMBER_CA: DataIdentifier;
+    static readonly SSN_ES: DataIdentifier;
+    static readonly SSN_US: DataIdentifier;
+    static readonly TAXID_DE: DataIdentifier;
+    static readonly TAXID_ES: DataIdentifier;
+    static readonly TAXID_FR: DataIdentifier;
+    static readonly TAXID_GB: DataIdentifier;
+    static readonly VEHICLEIDENTIFICATIONNUMBER: DataIdentifier;
+    static readonly ZIPCODE_US: DataIdentifier;
+    /**
+     * Create a managed data identifier not in the list of static members. This is used to maintain forward compatibility, in case a new managed identifier is supported but not updated in CDK yet.
+     * @param name - name of the identifier.
+     */
+    constructor(name: string);
+    toString(): string;
+}
+/**
+ * A custom data identifier. Include a custom data identifier name and regular expression in the JSON policy used to define the data protection policy.
+ */
+export declare class CustomDataIdentifier extends DataIdentifier {
+    readonly name: string;
+    readonly regex: string;
+    /**
+     * Create a custom data identifier.
+     * @param name - the name of the custom data identifier. This cannot share the same name as a managed data identifier.
+     * @param regex - the regular expression to detect and mask log events for.
+     */
+    constructor(name: string, regex: string);
+    /**
+     * String representation of a CustomDataIdentifier
+     * @returns the name and RegEx of the custom data identifier
+     */
+    toString(): string;
+}
+export {};

cdk/node_modules/aws-cdk-lib/aws-logs/lib/field-index-policy.d.ts

@@ -0,0 +1,25 @@
+import type { Construct } from 'constructs';
+/**
+ * Creates a field index policy for CloudWatch Logs log groups.
+ */
+export declare class FieldIndexPolicy {
+    private readonly fieldIndexPolicyProps;
+    constructor(props: FieldIndexPolicyProps);
+    /**
+     * @internal
+     */
+    _bind(_scope: Construct): {
+        Fields: string[];
+    };
+}
+/**
+ * Properties for creating field index policies
+ */
+export interface FieldIndexPolicyProps {
+    /**
+     * List of fields to index in log events.
+     *
+     * @default no fields
+     */
+    readonly fields: string[];
+}

cdk/node_modules/aws-cdk-lib/aws-logs/lib/field-index-policy.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.FieldIndexPolicy=void 0;var jsiiDeprecationWarnings=()=>{var tmp=require("../../.warnings.jsii.js");return jsiiDeprecationWarnings=()=>tmp,tmp};const JSII_RTTI_SYMBOL_1=Symbol.for("jsii.rtti");var core_1=()=>{var tmp=require("../../core");return core_1=()=>tmp,tmp},literal_string_1=()=>{var tmp=require("../../core/lib/private/literal-string");return literal_string_1=()=>tmp,tmp};class FieldIndexPolicy{static[JSII_RTTI_SYMBOL_1]={fqn:"aws-cdk-lib.aws_logs.FieldIndexPolicy",version:"2.252.0"};fieldIndexPolicyProps;constructor(props){try{jsiiDeprecationWarnings().aws_cdk_lib_aws_logs_FieldIndexPolicyProps(props)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,FieldIndexPolicy),error}if(props.fields.length>20)throw new(core_1()).UnscopedValidationError((0,literal_string_1().lit)`MaximumFieldsIndexedGroup`,"A maximum of 20 fields can be indexed per log group");this.fieldIndexPolicyProps=props}_bind(_scope){return{Fields:this.fieldIndexPolicyProps.fields}}}exports.FieldIndexPolicy=FieldIndexPolicy;

cdk/node_modules/aws-cdk-lib/aws-logs/lib/index.d.ts

@@ -0,0 +1,15 @@
+import './private/default-traits';
+export * from './cross-account-destination';
+export * from './log-group';
+export * from './log-stream';
+export * from './metric-filter';
+export * from './pattern';
+export * from './subscription-filter';
+export * from './log-retention';
+export * from './policy';
+export * from './query-definition';
+export * from './data-protection-policy';
+export * from './field-index-policy';
+export * from './transformer';
+export * from './logs.generated';
+export * from './logs-grants.generated';

cdk/node_modules/aws-cdk-lib/aws-logs/lib/log-group.d.ts

@@ -0,0 +1,604 @@
+import type { Construct } from 'constructs';
+import type { DataProtectionPolicy } from './data-protection-policy';
+import type { FieldIndexPolicy } from './field-index-policy';
+import { LogStream } from './log-stream';
+import { LogGroupGrants } from './logs-grants.generated';
+import type { ILogGroupRef, LogGroupReference } from './logs.generated';
+import { MetricFilter } from './metric-filter';
+import type { IFilterPattern } from './pattern';
+import type { ILogSubscriptionDestination } from './subscription-filter';
+import { SubscriptionFilter } from './subscription-filter';
+import type { IProcessor } from './transformer';
+import { Transformer } from './transformer';
+import * as cloudwatch from '../../aws-cloudwatch';
+import * as iam from '../../aws-iam';
+import type * as kms from '../../aws-kms';
+import type { RemovalPolicy } from '../../core';
+import { Resource } from '../../core';
+export interface ILogGroup extends iam.IResourceWithPolicy, ILogGroupRef {
+    /**
+     * The ARN of this log group, with ':*' appended
+     *
+     * @attribute
+     */
+    readonly logGroupArn: string;
+    /**
+     * The name of this log group
+     * @attribute
+     */
+    readonly logGroupName: string;
+    /**
+     * Create a new Log Stream for this Log Group
+     *
+     * @param id Unique identifier for the construct in its parent
+     * @param props Properties for creating the LogStream
+     */
+    addStream(id: string, props?: StreamOptions): LogStream;
+    /**
+     * Create a new Subscription Filter on this Log Group
+     *
+     * @param id Unique identifier for the construct in its parent
+     * @param props Properties for creating the SubscriptionFilter
+     */
+    addSubscriptionFilter(id: string, props: SubscriptionFilterOptions): SubscriptionFilter;
+    /**
+     * Create a new Metric Filter on this Log Group
+     *
+     * @param id Unique identifier for the construct in its parent
+     * @param props Properties for creating the MetricFilter
+     */
+    addMetricFilter(id: string, props: MetricFilterOptions): MetricFilter;
+    /**
+     * Create a new Transformer on this Log Group
+     *
+     * @param id Unique identifier for the construct in its parent
+     * @param props Properties for creating the Transformer
+     */
+    addTransformer(id: string, props: TransformerOptions): Transformer;
+    /**
+     * Extract a metric from structured log events in the LogGroup
+     *
+     * Creates a MetricFilter on this LogGroup that will extract the value
+     * of the indicated JSON field in all records where it occurs.
+     *
+     * The metric will be available in CloudWatch Metrics under the
+     * indicated namespace and name.
+     *
+     * @param jsonField JSON field to extract (example: '$.myfield')
+     * @param metricNamespace Namespace to emit the metric under
+     * @param metricName Name to emit the metric under
+     * @returns A Metric object representing the extracted metric
+     */
+    extractMetric(jsonField: string, metricNamespace: string, metricName: string): cloudwatch.Metric;
+    /**
+     * Give permissions to write to create and write to streams in this log group
+     */
+    grantWrite(grantee: iam.IGrantable): iam.Grant;
+    /**
+     * Give permissions to read from this log group and streams
+     */
+    grantRead(grantee: iam.IGrantable): iam.Grant;
+    /**
+     * Give the indicated permissions on this log group and all streams
+     */
+    grant(grantee: iam.IGrantable, ...actions: string[]): iam.Grant;
+    /**
+     * Public method to get the physical name of this log group
+     */
+    logGroupPhysicalName(): string;
+    /**
+     * Return the given named metric for this Log Group
+     *
+     * @param metricName The name of the metric
+     * @param props Properties for the metric
+     */
+    metric(metricName: string, props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The number of log events uploaded to CloudWatch Logs.
+     * When used with the LogGroupName dimension, this is the number of
+     * log events uploaded to the log group.
+     *
+     * @param props Properties for the Cloudwatch metric
+     */
+    metricIncomingLogEvents(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The volume of log events in uncompressed bytes uploaded to CloudWatch Logs.
+     * When used with the LogGroupName dimension, this is the volume of log events
+     * in uncompressed bytes uploaded to the log group.
+     *
+     * @param props Properties for the Cloudwatch metric
+     */
+    metricIncomingBytes(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+}
+/**
+ * An CloudWatch Log Group
+ */
+declare abstract class LogGroupBase extends Resource implements ILogGroup {
+    /**
+     * The ARN of this log group, with ':*' appended
+     */
+    abstract readonly logGroupArn: string;
+    /**
+     * The name of this log group
+     */
+    abstract readonly logGroupName: string;
+    /**
+     * Collection of grant methods for a LogGroup
+     */
+    readonly grants: LogGroupGrants;
+    private policy?;
+    /**
+     * Create a new Log Stream for this Log Group
+     *
+     * @param id Unique identifier for the construct in its parent
+     * @param props Properties for creating the LogStream
+     */
+    addStream(id: string, props?: StreamOptions): LogStream;
+    get logGroupRef(): LogGroupReference;
+    /**
+     * Create a new Subscription Filter on this Log Group
+     *
+     * @param id Unique identifier for the construct in its parent
+     * @param props Properties for creating the SubscriptionFilter
+     */
+    addSubscriptionFilter(id: string, props: SubscriptionFilterOptions): SubscriptionFilter;
+    /**
+     * Create a new Metric Filter on this Log Group
+     *
+     * @param id Unique identifier for the construct in its parent
+     * @param props Properties for creating the MetricFilter
+     */
+    addMetricFilter(id: string, props: MetricFilterOptions): MetricFilter;
+    /**
+     * Create a new Transformer on this Log Group
+     *
+     * @param id Unique identifier for the construct in its parent
+     * @param props Properties for creating the Transformer
+     */
+    addTransformer(id: string, props: TransformerOptions): Transformer;
+    /**
+     * Extract a metric from structured log events in the LogGroup
+     *
+     * Creates a MetricFilter on this LogGroup that will extract the value
+     * of the indicated JSON field in all records where it occurs.
+     *
+     * The metric will be available in CloudWatch Metrics under the
+     * indicated namespace and name.
+     *
+     * @param jsonField JSON field to extract (example: '$.myfield')
+     * @param metricNamespace Namespace to emit the metric under
+     * @param metricName Name to emit the metric under
+     * @returns A Metric object representing the extracted metric
+     */
+    extractMetric(jsonField: string, metricNamespace: string, metricName: string): cloudwatch.Metric;
+    /**
+     * Give permissions to create and write to streams in this log group
+     *
+     *
+     * The use of this method is discouraged. Please use `grants.write()` instead.
+     *
+     * [disable-awslint:no-grants]
+     */
+    grantWrite(grantee: iam.IGrantable): iam.Grant;
+    /**
+     * Give permissions to read and filter events from this log group
+     *
+     *
+     * The use of this method is discouraged. Please use `grants.read()` instead.
+     *
+     * [disable-awslint:no-grants]
+     */
+    grantRead(grantee: iam.IGrantable): iam.Grant;
+    /**
+     * Give the indicated permissions on this log group and all streams
+     *
+     * [disable-awslint:no-grants]
+     */
+    grant(grantee: iam.IGrantable, ...actions: string[]): iam.Grant;
+    /**
+     * Public method to get the physical name of this log group
+     * @returns Physical name of log group
+     */
+    logGroupPhysicalName(): string;
+    /**
+     * Adds a statement to the resource policy associated with this log group.
+     * A resource policy will be automatically created upon the first call to `addToResourcePolicy`.
+     *
+     * Any ARN Principals inside of the statement will be converted into AWS Account ID strings
+     * because CloudWatch Logs Resource Policies do not accept ARN principals.
+     *
+     * @param statement The policy statement to add
+     */
+    addToResourcePolicy(statement: iam.PolicyStatement): iam.AddToResourcePolicyResult;
+    private convertArnPrincipalToAccountId;
+    /**
+     * Creates a CloudWatch metric for the number of incoming log events to this log group.
+     *
+     * @param props - Optional. Configuration options for the metric.
+     * @returns A CloudWatch Metric object representing the IncomingLogEvents metric.
+     *
+     * This method allows you to monitor the rate at which log events are being ingested
+     * into the log group. It's useful for understanding the volume of logging activity
+     * and can help in capacity planning or detecting unusual spikes in logging.
+     *
+     * Example usage:
+     * ```
+     * const logGroup = new logs.LogGroup(this, 'MyLogGroup');
+     * logGroup.metricIncomingLogEvents().createAlarm(stack, 'IncomingEventsPerInstanceAlarm', {
+     * threshold: 1,
+     * evaluationPeriods: 1,
+     * });
+     * ```
+     */
+    metricIncomingLogEvents(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * Creates a CloudWatch metric for the volume of incoming log data in bytes to this log group.
+     *
+     * @param props - Optional. Configuration options for the metric.
+     * @returns A CloudWatch Metric object representing the IncomingBytes metric.
+     *
+     * This method allows you to monitor the volume of data being ingested into the log group.
+     * It's useful for understanding the size of your logs, which can impact storage costs
+     * and help in identifying unexpectedly large log entries.
+     *
+     * Example usage:
+     * ```
+     * const logGroup = new logs.LogGroup(this, 'MyLogGroup');
+     * logGroup.metricIncomingBytes().createAlarm(stack, 'IncomingBytesPerInstanceAlarm', {
+     *   threshold: 1,
+     *   evaluationPeriods: 1,
+     * });
+     * ```
+     */
+    metricIncomingBytes(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * Creates a CloudWatch metric for this log group.
+     *
+     * @param metricName - The name of the metric to create.
+     * @param props - Optional. Additional properties to configure the metric.
+     * @returns A CloudWatch Metric object representing the specified metric for this log group.
+     *
+     * This method creates a CloudWatch Metric object with predefined settings for the log group.
+     * It sets the namespace to 'AWS/Logs' and the statistic to 'Sum' by default.
+     *
+     * The created metric is automatically associated with this log group using the `attachTo` method.
+     *
+     * Common metric names for log groups include:
+     * - 'IncomingBytes': The volume of log data in bytes ingested into the log group.
+     * - 'IncomingLogEvents': The number of log events ingested into the log group.
+     * ```
+     */
+    metric(metricName: string, props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+}
+/**
+ * How long, in days, the log contents will be retained.
+ */
+export declare enum RetentionDays {
+    /**
+     * 1 day
+     */
+    ONE_DAY = 1,
+    /**
+     * 3 days
+     */
+    THREE_DAYS = 3,
+    /**
+     * 5 days
+     */
+    FIVE_DAYS = 5,
+    /**
+     * 1 week
+     */
+    ONE_WEEK = 7,
+    /**
+     * 2 weeks
+     */
+    TWO_WEEKS = 14,
+    /**
+     * 1 month
+     */
+    ONE_MONTH = 30,
+    /**
+     * 2 months
+     */
+    TWO_MONTHS = 60,
+    /**
+     * 3 months
+     */
+    THREE_MONTHS = 90,
+    /**
+     * 4 months
+     */
+    FOUR_MONTHS = 120,
+    /**
+     * 5 months
+     */
+    FIVE_MONTHS = 150,
+    /**
+     * 6 months
+     */
+    SIX_MONTHS = 180,
+    /**
+     * 1 year
+     */
+    ONE_YEAR = 365,
+    /**
+     * 13 months
+     */
+    THIRTEEN_MONTHS = 400,
+    /**
+     * 18 months
+     */
+    EIGHTEEN_MONTHS = 545,
+    /**
+     * 2 years
+     */
+    TWO_YEARS = 731,
+    /**
+     * 3 years
+     */
+    THREE_YEARS = 1096,
+    /**
+     * 5 years
+     */
+    FIVE_YEARS = 1827,
+    /**
+     * 6 years
+     */
+    SIX_YEARS = 2192,
+    /**
+     * 7 years
+     */
+    SEVEN_YEARS = 2557,
+    /**
+     * 8 years
+     */
+    EIGHT_YEARS = 2922,
+    /**
+     * 9 years
+     */
+    NINE_YEARS = 3288,
+    /**
+     * 10 years
+     */
+    TEN_YEARS = 3653,
+    /**
+     * Retain logs forever
+     */
+    INFINITE = 9999
+}
+/**
+ * Class of Log Group.
+ */
+export declare enum LogGroupClass {
+    /**
+     * Default class of logs services
+     */
+    STANDARD = "STANDARD",
+    /**
+     * Class for reduced logs services
+     */
+    INFREQUENT_ACCESS = "INFREQUENT_ACCESS"
+}
+/**
+ * Properties for a LogGroup
+ */
+export interface LogGroupProps {
+    /**
+     * The KMS customer managed key to encrypt the log group with.
+     *
+     * @default Server-side encryption managed by the CloudWatch Logs service
+     */
+    readonly encryptionKey?: kms.IKeyRef;
+    /**
+     * Name of the log group.
+     *
+     * @default Automatically generated
+     */
+    readonly logGroupName?: string;
+    /**
+     * Data Protection Policy for this log group.
+     *
+     * @default - no data protection policy
+     */
+    readonly dataProtectionPolicy?: DataProtectionPolicy;
+    /**
+     * Indicates whether deletion protection is enabled for this log group. When enabled,
+     * deletion protection blocks all deletion operations until it is explicitly disabled.
+     *
+     * @default false
+     */
+    readonly deletionProtectionEnabled?: boolean;
+    /**
+     * Field Index Policies for this log group.
+     *
+     * @default - no field index policies for this log group.
+     */
+    readonly fieldIndexPolicies?: FieldIndexPolicy[];
+    /**
+     * How long, in days, the log contents will be retained.
+     *
+     * To retain all logs, set this value to RetentionDays.INFINITE.
+     *
+     * @default RetentionDays.TWO_YEARS
+     */
+    readonly retention?: RetentionDays;
+    /**
+     * The class of the log group. Possible values are: STANDARD and INFREQUENT_ACCESS.
+     *
+     * INFREQUENT_ACCESS class provides customers a cost-effective way to consolidate
+     * logs which supports querying using Logs Insights. The logGroupClass property cannot
+     * be changed once the log group is created.
+     *
+     * @default LogGroupClass.STANDARD
+     */
+    readonly logGroupClass?: LogGroupClass;
+    /**
+     * Determine the removal policy of this log group.
+     *
+     * Normally you want to retain the log group so you can diagnose issues
+     * from logs even after a deployment that no longer includes the log group.
+     * In that case, use the normal date-based retention policy to age out your
+     * logs.
+     *
+     * @default RemovalPolicy.Retain
+     */
+    readonly removalPolicy?: RemovalPolicy;
+}
+/**
+ * The method used to distribute log data to the destination.
+ */
+export declare enum Distribution {
+    /**
+     * Log events from the same log stream are kept together and sent to the same destination.
+     */
+    BY_LOG_STREAM = "ByLogStream",
+    /**
+     * Log events are distributed across the log destinations randomly.
+     */
+    RANDOM = "Random"
+}
+/**
+ * Define a CloudWatch Log Group
+ */
+export declare class LogGroup extends LogGroupBase {
+    /**
+     * Uniquely identifies this class.
+     */
+    static readonly PROPERTY_INJECTION_ID: string;
+    /**
+     * Import an existing LogGroup given its ARN
+     */
+    static fromLogGroupArn(scope: Construct, id: string, logGroupArn: string): ILogGroup;
+    /**
+     * Import an existing LogGroup given its name
+     */
+    static fromLogGroupName(scope: Construct, id: string, logGroupName: string): ILogGroup;
+    private readonly resource;
+    /**
+     * The ARN of this log group
+     */
+    get logGroupArn(): string;
+    /**
+     * The name of this log group
+     */
+    get logGroupName(): string;
+    constructor(scope: Construct, id: string, props?: LogGroupProps);
+}
+/**
+ * Properties for a new LogStream created from a LogGroup
+ */
+export interface StreamOptions {
+    /**
+     * The name of the log stream to create.
+     *
+     * The name must be unique within the log group.
+     *
+     * @default Automatically generated
+     */
+    readonly logStreamName?: string;
+}
+/**
+ * Properties for a new SubscriptionFilter created from a LogGroup
+ */
+export interface SubscriptionFilterOptions {
+    /**
+     * The destination to send the filtered events to.
+     *
+     * For example, a Kinesis stream or a Lambda function.
+     */
+    readonly destination: ILogSubscriptionDestination;
+    /**
+     * Log events matching this pattern will be sent to the destination.
+     */
+    readonly filterPattern: IFilterPattern;
+    /**
+     * The name of the subscription filter.
+     *
+     * @default Automatically generated
+     */
+    readonly filterName?: string;
+    /**
+     * The method used to distribute log data to the destination.
+     * This property can only be used with KinesisDestination.
+     *
+     * @default Distribution.BY_LOG_STREAM
+     */
+    readonly distribution?: Distribution;
+}
+/**
+ * Properties for a MetricFilter created from a LogGroup
+ */
+export interface MetricFilterOptions {
+    /**
+     * Pattern to search for log events.
+     */
+    readonly filterPattern: IFilterPattern;
+    /**
+     * The namespace of the metric to emit.
+     */
+    readonly metricNamespace: string;
+    /**
+     * The name of the metric to emit.
+     */
+    readonly metricName: string;
+    /**
+     * The value to emit for the metric.
+     *
+     * Can either be a literal number (typically "1"), or the name of a field in the structure
+     * to take the value from the matched event. If you are using a field value, the field
+     * value must have been matched using the pattern.
+     *
+     * If you want to specify a field from a matched JSON structure, use '$.fieldName',
+     * and make sure the field is in the pattern (if only as '$.fieldName = *').
+     *
+     * If you want to specify a field from a matched space-delimited structure,
+     * use '$fieldName'.
+     *
+     * @default "1"
+     */
+    readonly metricValue?: string;
+    /**
+     * The value to emit if the pattern does not match a particular event.
+     *
+     * @default No metric emitted.
+     */
+    readonly defaultValue?: number;
+    /**
+     * The fields to use as dimensions for the metric. One metric filter can include as many as three dimensions.
+     *
+     * @see https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-logs-metricfilter-metrictransformation.html#cfn-logs-metricfilter-metrictransformation-dimensions
+     * @default - No dimensions attached to metrics.
+     */
+    readonly dimensions?: Record<string, string>;
+    /**
+     * The unit to assign to the metric.
+     *
+     * @see https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-logs-metricfilter-metrictransformation.html#cfn-logs-metricfilter-metrictransformation-unit
+     * @default - No unit attached to metrics.
+     */
+    readonly unit?: cloudwatch.Unit;
+    /**
+     * The name of the metric filter.
+     *
+     * @default - Cloudformation generated name.
+     */
+    readonly filterName?: string;
+    /**
+     * Whether the metric filter is applied on the tranformed logs. This parameter is valid only for log groups that have an active log transformer.
+     * If this value is true, the metric filter is applied on the transformed version of the log events instead of the original ingested log events.
+     *
+     * @default - false
+     */
+    readonly applyOnTransformedLogs?: boolean;
+}
+/**
+ * Properties for Transformer created from LogGroup.
+ */
+export interface TransformerOptions {
+    /** Name of the transformer. */
+    readonly transformerName: string;
+    /** List of processors in a transformer */
+    readonly transformerConfig: Array<IProcessor>;
+}
+export {};

cdk/node_modules/aws-cdk-lib/aws-logs/lib/log-retention.d.ts

@@ -0,0 +1,80 @@
+import { Construct } from 'constructs';
+import { RetentionDays } from './log-group';
+import * as iam from '../../aws-iam';
+import * as cdk from '../../core';
+/**
+ * Construction properties for a LogRetention.
+ */
+export interface LogRetentionProps {
+    /**
+     * The log group name.
+     */
+    readonly logGroupName: string;
+    /**
+     * The region where the log group should be created
+     * @default - same region as the stack
+     */
+    readonly logGroupRegion?: string;
+    /**
+     * The number of days log events are kept in CloudWatch Logs.
+     */
+    readonly retention: RetentionDays;
+    /**
+     * The IAM role for the Lambda function associated with the custom resource.
+     *
+     * @default - A new role is created
+     */
+    readonly role?: iam.IRole;
+    /**
+     * Retry options for all AWS API calls.
+     *
+     * @default - AWS SDK default retry options
+     */
+    readonly logRetentionRetryOptions?: LogRetentionRetryOptions;
+    /**
+     * The removalPolicy for the log group when the stack is deleted
+     * @default RemovalPolicy.RETAIN
+     */
+    readonly removalPolicy?: cdk.RemovalPolicy;
+}
+/**
+ * Retry options for all AWS API calls.
+ */
+export interface LogRetentionRetryOptions {
+    /**
+     * The maximum amount of retries.
+     *
+     * @default 5
+     */
+    readonly maxRetries?: number;
+    /**
+     * The base duration to use in the exponential backoff for operation retries.
+     *
+     * @deprecated Unused since the upgrade to AWS SDK v3, which uses a different retry strategy
+     * @default - none, not used anymore
+     */
+    readonly base?: cdk.Duration;
+}
+/**
+ * Creates a custom resource to control the retention policy of a CloudWatch Logs
+ * log group. The log group is created if it doesn't already exist. The policy
+ * is removed when `retentionDays` is `undefined` or equal to `Infinity`.
+ * Log group can be created in the region that is different from stack region by
+ * specifying `logGroupRegion`
+ */
+export declare class LogRetention extends Construct {
+    /**
+     * Uniquely identifies this class.
+     */
+    static readonly PROPERTY_INJECTION_ID: string;
+    /**
+     * The ARN of the LogGroup.
+     */
+    readonly logGroupArn: string;
+    constructor(scope: Construct, id: string, props: LogRetentionProps);
+    /**
+     * Helper method to ensure that only one instance of LogRetentionFunction resources are in the stack mimicking the
+     * behaviour of aws-cdk-lib/aws-lambda's SingletonFunction to prevent circular dependencies
+     */
+    private ensureSingletonLogRetentionFunction;
+}

cdk/node_modules/aws-cdk-lib/aws-logs/lib/log-stream.d.ts

@@ -0,0 +1,79 @@
+import type { Construct } from 'constructs';
+import type { IResource, RemovalPolicy } from '../../core';
+import { Resource } from '../../core';
+import type { ILogGroupRef, ILogStreamRef, LogStreamReference } from '../../interfaces/generated/aws-logs-interfaces.generated';
+export interface ILogStream extends IResource, ILogStreamRef {
+    /**
+     * The name of this log stream
+     * @attribute
+     */
+    readonly logStreamName: string;
+}
+/**
+ * Attributes for importing a LogStream
+ */
+export interface LogStreamAttributes {
+    /**
+     * The name of the log stream
+     */
+    readonly logStreamName: string;
+    /**
+     * The name of the log group
+     *
+     * @default - When not provided, logStreamRef will throw an error
+     */
+    readonly logGroupName: string;
+}
+/**
+ * Properties for a LogStream
+ */
+export interface LogStreamProps {
+    /**
+     * The log group to create a log stream for.
+     */
+    readonly logGroup: ILogGroupRef;
+    /**
+     * The name of the log stream to create.
+     *
+     * The name must be unique within the log group.
+     *
+     * @default Automatically generated
+     */
+    readonly logStreamName?: string;
+    /**
+     * Determine what happens when the log stream resource is removed from the
+     * app.
+     *
+     * Normally you want to retain the log stream so you can diagnose issues from
+     * logs even after a deployment that no longer includes the log stream.
+     *
+     * The date-based retention policy of your log group will age out the logs
+     * after a certain time.
+     *
+     * @default RemovalPolicy.Retain
+     */
+    readonly removalPolicy?: RemovalPolicy;
+}
+/**
+ * Define a Log Stream in a Log Group
+ */
+export declare class LogStream extends Resource implements ILogStream {
+    /** Uniquely identifies this class. */
+    static readonly PROPERTY_INJECTION_ID: string;
+    /**
+     * Import an existing LogStream
+     */
+    static fromLogStreamName(scope: Construct, id: string, logStreamName: string): ILogStream;
+    /**
+     * Import an existing LogStream using its attributes
+     */
+    static fromLogStreamAttributes(scope: Construct, id: string, attrs: LogStreamAttributes): ILogStream;
+    private readonly resource;
+    private readonly logGroupName;
+    /**
+     * The name of this log stream
+     */
+    get logStreamName(): string;
+    constructor(scope: Construct, id: string, props: LogStreamProps);
+    get logStreamRef(): LogStreamReference;
+}

cdk/node_modules/aws-cdk-lib/aws-logs/lib/logs-canned-metrics.generated.d.ts

@@ -0,0 +1,68 @@
+export interface MetricWithDims<D> {
+    readonly namespace: string;
+    readonly metricName: string;
+    readonly statistic: string;
+    readonly dimensionsMap: D;
+}
+export declare class LogsMetrics {
+    static incomingLogEventsSum(this: void, dimensions: {
+        LogGroupName: string;
+    }): MetricWithDims<{
+        LogGroupName: string;
+    }>;
+    static incomingBytesSum(this: void, dimensions: {
+        LogGroupName: string;
+    }): MetricWithDims<{
+        LogGroupName: string;
+    }>;
+    static emfValidationErrorsSum(this: void, dimensions: {
+        LogGroupName: string;
+    }): MetricWithDims<{
+        LogGroupName: string;
+    }>;
+    static emfParsingErrorsSum(this: void, dimensions: {
+        LogGroupName: string;
+    }): MetricWithDims<{
+        LogGroupName: string;
+    }>;
+    static transformedLogEventsSum(this: void, dimensions: {
+        LogGroupName: string;
+    }): MetricWithDims<{
+        LogGroupName: string;
+    }>;
+    static transformedBytesSum(this: void, dimensions: {
+        LogGroupName: string;
+    }): MetricWithDims<{
+        LogGroupName: string;
+    }>;
+    static transformationErrorsSum(this: void, dimensions: {
+        LogGroupName: string;
+    }): MetricWithDims<{
+        LogGroupName: string;
+    }>;
+    static forwardedLogEventsSum(this: void, dimensions: {
+        LogGroupName: string;
+    }): MetricWithDims<{
+        LogGroupName: string;
+    }>;
+    static deliveryErrorsSum(this: void, dimensions: {
+        LogGroupName: string;
+    }): MetricWithDims<{
+        LogGroupName: string;
+    }>;
+    static deliveryThrottlingSum(this: void, dimensions: {
+        LogGroupName: string;
+    }): MetricWithDims<{
+        LogGroupName: string;
+    }>;
+    static logEventsWithFindingsSum(this: void, dimensions: {
+        LogGroupName: string;
+    }): MetricWithDims<{
+        LogGroupName: string;
+    }>;
+    static anomalyCountSum(this: void, dimensions: {
+        LogGroupName: string;
+    }): MetricWithDims<{
+        LogGroupName: string;
+    }>;
+}

cdk/node_modules/aws-cdk-lib/aws-logs/lib/logs-canned-metrics.generated.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.LogsMetrics=void 0;class LogsMetrics{static incomingLogEventsSum(dimensions){return{namespace:"AWS/Logs",metricName:"IncomingLogEvents",dimensionsMap:dimensions,statistic:"Sum"}}static incomingBytesSum(dimensions){return{namespace:"AWS/Logs",metricName:"IncomingBytes",dimensionsMap:dimensions,statistic:"Sum"}}static emfValidationErrorsSum(dimensions){return{namespace:"AWS/Logs",metricName:"EMFValidationErrors",dimensionsMap:dimensions,statistic:"Sum"}}static emfParsingErrorsSum(dimensions){return{namespace:"AWS/Logs",metricName:"EMFParsingErrors",dimensionsMap:dimensions,statistic:"Sum"}}static transformedLogEventsSum(dimensions){return{namespace:"AWS/Logs",metricName:"TransformedLogEvents",dimensionsMap:dimensions,statistic:"Sum"}}static transformedBytesSum(dimensions){return{namespace:"AWS/Logs",metricName:"TransformedBytes",dimensionsMap:dimensions,statistic:"Sum"}}static transformationErrorsSum(dimensions){return{namespace:"AWS/Logs",metricName:"TransformationErrors",dimensionsMap:dimensions,statistic:"Sum"}}static forwardedLogEventsSum(dimensions){return{namespace:"AWS/Logs",metricName:"ForwardedLogEvents",dimensionsMap:dimensions,statistic:"Sum"}}static deliveryErrorsSum(dimensions){return{namespace:"AWS/Logs",metricName:"DeliveryErrors",dimensionsMap:dimensions,statistic:"Sum"}}static deliveryThrottlingSum(dimensions){return{namespace:"AWS/Logs",metricName:"DeliveryThrottling",dimensionsMap:dimensions,statistic:"Sum"}}static logEventsWithFindingsSum(dimensions){return{namespace:"AWS/Logs",metricName:"LogEventsWithFindings",dimensionsMap:dimensions,statistic:"Sum"}}static anomalyCountSum(dimensions){return{namespace:"AWS/Logs",metricName:"AnomalyCount",dimensionsMap:dimensions,statistic:"Sum"}}}exports.LogsMetrics=LogsMetrics;

cdk/node_modules/aws-cdk-lib/aws-logs/lib/logs-grants.generated.d.ts

@@ -0,0 +1,27 @@
+import * as logs from "./logs.generated";
+import * as iam from "../../aws-iam";
+import * as cdk from "../../core/lib";
+/**
+ * Collection of grant methods for a ILogGroupRef
+ */
+export declare class LogGroupGrants {
+    /**
+     * Creates grants for LogGroupGrants
+     */
+    static fromLogGroup(resource: logs.ILogGroupRef): LogGroupGrants;
+    protected readonly resource: logs.ILogGroupRef;
+    protected readonly policyResource?: iam.IResourceWithPolicyV2;
+    private constructor();
+    /**
+     * Grant the given identity custom permissions
+     */
+    actions(grantee: iam.IGrantable, actions: Array<string>, options?: cdk.PermissionsOptions): iam.Grant;
+    /**
+     * Give permissions to create and write to streams in this log group
+     */
+    write(grantee: iam.IGrantable): iam.Grant;
+    /**
+     * Give permissions to read and filter events from this log group
+     */
+    read(grantee: iam.IGrantable): iam.Grant;
+}

cdk/node_modules/aws-cdk-lib/aws-logs/lib/logs-grants.generated.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.LogGroupGrants=void 0;var jsiiDeprecationWarnings=()=>{var tmp=require("../../.warnings.jsii.js");return jsiiDeprecationWarnings=()=>tmp,tmp};const JSII_RTTI_SYMBOL_1=Symbol.for("jsii.rtti");var logs=()=>{var tmp=require("./logs.generated");return logs=()=>tmp,tmp},iam=()=>{var tmp=require("../../aws-iam");return iam=()=>tmp,tmp};class LogGroupGrants{static[JSII_RTTI_SYMBOL_1]={fqn:"aws-cdk-lib.aws_logs.LogGroupGrants",version:"2.252.0"};static fromLogGroup(resource){try{jsiiDeprecationWarnings().aws_cdk_lib_interfaces_aws_logs_ILogGroupRef(resource)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,this.fromLogGroup),error}return new LogGroupGrants({resource,policyResource:iam().ResourceWithPolicies.of(resource)})}resource;policyResource;constructor(props){this.resource=props.resource,this.policyResource=props.policyResource}actions(grantee,actions,options={}){try{jsiiDeprecationWarnings().aws_cdk_lib_aws_iam_IGrantable(grantee),jsiiDeprecationWarnings().aws_cdk_lib_PermissionsOptions(options)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,this.actions),error}return this.policyResource?iam().Grant.addToPrincipalOrResource({actions,grantee,resourceArns:options.resourceArns??[logs().CfnLogGroup.arnForLogGroup(this.resource)],resource:this.policyResource}):iam().Grant.addToPrincipal({actions,grantee,resourceArns:options.resourceArns??[logs().CfnLogGroup.arnForLogGroup(this.resource)]})}write(grantee){try{jsiiDeprecationWarnings().aws_cdk_lib_aws_iam_IGrantable(grantee)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,this.write),error}const actions=["logs:CreateLogStream","logs:PutLogEvents"];return this.actions(grantee,actions,{})}read(grantee){try{jsiiDeprecationWarnings().aws_cdk_lib_aws_iam_IGrantable(grantee)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,this.read),error}const actions=["logs:FilterLogEvents","logs:GetLogEvents","logs:GetLogGroupFields","logs:DescribeLogGroups","logs:DescribeLogStreams"];return this.actions(grantee,actions,{})}}exports.LogGroupGrants=LogGroupGrants;

cdk/node_modules/aws-cdk-lib/aws-logs/lib/metric-filter.d.ts

@@ -0,0 +1,31 @@
+import type { Construct } from 'constructs';
+import type { MetricFilterOptions } from './log-group';
+import type { MetricOptions } from '../../aws-cloudwatch';
+import { Metric } from '../../aws-cloudwatch';
+import { Resource } from '../../core';
+import type { ILogGroupRef } from '../../interfaces/generated/aws-logs-interfaces.generated';
+/**
+ * Properties for a MetricFilter
+ */
+export interface MetricFilterProps extends MetricFilterOptions {
+    /**
+     * The log group to create the filter on.
+     */
+    readonly logGroup: ILogGroupRef;
+}
+/**
+ * A filter that extracts information from CloudWatch Logs and emits to CloudWatch Metrics
+ */
+export declare class MetricFilter extends Resource {
+    /** Uniquely identifies this class. */
+    static readonly PROPERTY_INJECTION_ID: string;
+    private readonly metricName;
+    private readonly metricNamespace;
+    constructor(scope: Construct, id: string, props: MetricFilterProps);
+    /**
+     * Return the given named metric for this Metric Filter
+     *
+     * @default avg over 5 minutes
+     */
+    metric(props?: MetricOptions): Metric;
+}

cdk/node_modules/aws-cdk-lib/aws-logs/lib/pattern.d.ts

@@ -0,0 +1,213 @@
+/**
+ * Interface for objects that can render themselves to log patterns.
+ */
+export interface IFilterPattern {
+    readonly logPatternString: string;
+}
+/**
+ * Base class for patterns that only match JSON log events.
+ */
+export declare abstract class JsonPattern implements IFilterPattern {
+    readonly jsonPatternString: string;
+    constructor(jsonPatternString: string);
+    get logPatternString(): string;
+}
+/**
+ * A collection of static methods to generate appropriate ILogPatterns
+ */
+export declare class FilterPattern {
+    /**
+     * Use the given string as log pattern.
+     *
+     * See https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/FilterAndPatternSyntax.html
+     * for information on writing log patterns.
+     *
+     * @param logPatternString The pattern string to use.
+     */
+    static literal(logPatternString: string): IFilterPattern;
+    /**
+     * A log pattern that matches all events.
+     */
+    static allEvents(): IFilterPattern;
+    /**
+     * A log pattern that matches if all the strings given appear in the event.
+     *
+     * @param terms The words to search for. All terms must match.
+     */
+    static allTerms(...terms: string[]): IFilterPattern;
+    /**
+     * A log pattern that matches if any of the strings given appear in the event.
+     *
+     * @param terms The words to search for. Any terms must match.
+     */
+    static anyTerm(...terms: string[]): IFilterPattern;
+    /**
+     * A log pattern that matches if any of the given term groups matches the event.
+     *
+     * A term group matches an event if all the terms in it appear in the event string.
+     *
+     * @param termGroups A list of term groups to search for. Any one of the clauses must match.
+     */
+    static anyTermGroup(...termGroups: string[][]): IFilterPattern;
+    /**
+     * A JSON log pattern that compares string values.
+     *
+     * This pattern only matches if the event is a JSON event, and the indicated field inside
+     * compares with the string value.
+     *
+     * Use '$' to indicate the root of the JSON structure. The comparison operator can only
+     * compare equality or inequality. The '*' wildcard may appear in the value may at the
+     * start or at the end.
+     *
+     * For more information, see:
+     *
+     * https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/FilterAndPatternSyntax.html
+     *
+     * @param jsonField Field inside JSON. Example: "$.myField"
+     * @param comparison Comparison to carry out. Either = or !=.
+     * @param value The string value to compare to. May use '*' as wildcard at start or end of string.
+     */
+    static stringValue(jsonField: string, comparison: string, value: string): JsonPattern;
+    /**
+     * A JSON log pattern that compares numerical values.
+     *
+     * This pattern only matches if the event is a JSON event, and the indicated field inside
+     * compares with the value in the indicated way.
+     *
+     * Use '$' to indicate the root of the JSON structure. The comparison operator can only
+     * compare equality or inequality. The '*' wildcard may appear in the value may at the
+     * start or at the end.
+     *
+     * For more information, see:
+     *
+     * https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/FilterAndPatternSyntax.html
+     *
+     * @param jsonField Field inside JSON. Example: "$.myField"
+     * @param comparison Comparison to carry out. One of =, !=, <, <=, >, >=.
+     * @param value The numerical value to compare to
+     */
+    static numberValue(jsonField: string, comparison: string, value: number): JsonPattern;
+    /**
+     * A JSON log pattern that compares against a Regex values.
+     *
+     * This pattern only matches if the event is a JSON event, and the indicated field inside
+     * compares with the regex value.
+     *
+     * Use '$' to indicate the root of the JSON structure. The comparison operator can only
+     * compare equality or inequality.
+     *
+     * For more information, see:
+     *
+     * https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/FilterAndPatternSyntax.html
+     *
+     * @param jsonField Field inside JSON. Example: "$.myField"
+     * @param comparison Comparison to carry out. Either = or !=.
+     * @param value The regex value to compare to.
+     */
+    static regexValue(jsonField: string, comparison: string, value: string): JsonPattern;
+    /**
+     * A JSON log pattern that matches if the field exists and has the special value 'null'.
+     *
+     * @param jsonField Field inside JSON. Example: "$.myField"
+     */
+    static isNull(jsonField: string): JsonPattern;
+    /**
+     * A JSON log pattern that matches if the field does not exist.
+     *
+     * @param jsonField Field inside JSON. Example: "$.myField"
+     */
+    static notExists(jsonField: string): JsonPattern;
+    /**
+     * A JSON log patter that matches if the field exists.
+     *
+     * This is a readable convenience wrapper over 'field = *'
+     *
+     * @param jsonField Field inside JSON. Example: "$.myField"
+     */
+    static exists(jsonField: string): JsonPattern;
+    /**
+     * A JSON log pattern that matches if the field exists and equals the boolean value.
+     *
+     * @param jsonField Field inside JSON. Example: "$.myField"
+     * @param value The value to match
+     */
+    static booleanValue(jsonField: string, value: boolean): JsonPattern;
+    /**
+     * A JSON log pattern that matches if all given JSON log patterns match
+     */
+    static all(...patterns: JsonPattern[]): JsonPattern;
+    /**
+     * A JSON log pattern that matches if any of the given JSON log patterns match
+     */
+    static any(...patterns: JsonPattern[]): JsonPattern;
+    /**
+     * A space delimited log pattern matcher.
+     *
+     * The log event is divided into space-delimited columns (optionally
+     * enclosed by "" or [] to capture spaces into column values), and names
+     * are given to each column.
+     *
+     * '...' may be specified once to match any number of columns.
+     *
+     * Afterwards, conditions may be added to individual columns.
+     *
+     * @param columns The columns in the space-delimited log stream.
+     */
+    static spaceDelimited(...columns: string[]): SpaceDelimitedTextPattern;
+}
+export type RestrictionMap = {
+    [column: string]: ColumnRestriction[];
+};
+/**
+ * Space delimited text pattern
+ */
+export declare class SpaceDelimitedTextPattern implements IFilterPattern {
+    private readonly columns;
+    private readonly restrictions;
+    /**
+     * Construct a new instance of a space delimited text pattern
+     *
+     * Since this class must be public, we can't rely on the user only creating it through
+     * the `LogPattern.spaceDelimited()` factory function. We must therefore validate the
+     * argument in the constructor. Since we're returning a copy on every mutation, and we
+     * don't want to re-validate the same things on every construction, we provide a limited
+     * set of mutator functions and only validate the new data every time.
+     */
+    static construct(columns: string[]): SpaceDelimitedTextPattern;
+    protected constructor(columns: string[], restrictions: RestrictionMap);
+    /**
+     * Restrict where the pattern applies
+     */
+    whereString(columnName: string, comparison: string, value: string): SpaceDelimitedTextPattern;
+    /**
+     * Restrict where the pattern applies
+     */
+    whereNumber(columnName: string, comparison: string, value: number): SpaceDelimitedTextPattern;
+    get logPatternString(): string;
+    /**
+     * Return the column expression for the given column
+     */
+    private columnExpression;
+    /**
+     * Make a copy of the current restrictions and add one
+     */
+    private addRestriction;
+}
+export interface ColumnRestriction {
+    /**
+     * Comparison operator to use
+     */
+    readonly comparison: string;
+    /**
+     * String value to compare to
+     *
+     * Exactly one of 'stringValue' and 'numberValue' must be set.
+     */
+    readonly stringValue?: string;
+    /**
+     * Number value to compare to
+     *
+     * Exactly one of 'stringValue' and 'numberValue' must be set.
+     */
+    readonly numberValue?: number;
+}

cdk/node_modules/aws-cdk-lib/aws-logs/lib/policy.d.ts

@@ -0,0 +1,43 @@
+import type { Construct } from 'constructs';
+import type { PolicyStatement } from '../../aws-iam';
+import { PolicyDocument } from '../../aws-iam';
+import { Resource } from '../../core';
+/**
+ * Properties to define Cloudwatch log group resource policy
+ */
+export interface ResourcePolicyProps {
+    /**
+     * Name of the log group resource policy
+     * @default - Uses a unique id based on the construct path
+     */
+    readonly resourcePolicyName?: string;
+    /**
+     * Initial statements to add to the resource policy
+     *
+     * @default - No statements
+     */
+    readonly policyStatements?: PolicyStatement[];
+}
+/**
+ * Resource Policy for CloudWatch Log Groups
+ *
+ * Policies define the operations that are allowed on this resource.
+ *
+ * You almost never need to define this construct directly.
+ *
+ * All AWS resources that support resource policies have a method called
+ * `addToResourcePolicy()`, which will automatically create a new resource
+ * policy if one doesn't exist yet, otherwise it will add to the existing
+ * policy.
+ *
+ * Prefer to use `addToResourcePolicy()` instead.
+ */
+export declare class ResourcePolicy extends Resource {
+    /** Uniquely identifies this class. */
+    static readonly PROPERTY_INJECTION_ID: string;
+    /**
+     * The IAM policy document for this resource policy.
+     */
+    readonly document: PolicyDocument;
+    constructor(scope: Construct, id: string, props?: ResourcePolicyProps);
+}

cdk/node_modules/aws-cdk-lib/aws-logs/lib/policy.js

@@ -0,0 +1 @@
+"use strict";var __esDecorate=exports&&exports.__esDecorate||function(ctor,descriptorIn,decorators,contextIn,initializers,extraInitializers){function accept(f){if(f!==void 0&&typeof f!="function")throw new TypeError("Function expected");return f}for(var kind=contextIn.kind,key=kind==="getter"?"get":kind==="setter"?"set":"value",target=!descriptorIn&&ctor?contextIn.static?ctor:ctor.prototype:null,descriptor=descriptorIn||(target?Object.getOwnPropertyDescriptor(target,contextIn.name):{}),_,done=!1,i=decorators.length-1;i>=0;i--){var context={};for(var p in contextIn)context[p]=p==="access"?{}:contextIn[p];for(var p in contextIn.access)context.access[p]=contextIn.access[p];context.addInitializer=function(f){if(done)throw new TypeError("Cannot add initializers after decoration has completed");extraInitializers.push(accept(f||null))};var result=(0,decorators[i])(kind==="accessor"?{get:descriptor.get,set:descriptor.set}:descriptor[key],context);if(kind==="accessor"){if(result===void 0)continue;if(result===null||typeof result!="object")throw new TypeError("Object expected");(_=accept(result.get))&&(descriptor.get=_),(_=accept(result.set))&&(descriptor.set=_),(_=accept(result.init))&&initializers.unshift(_)}else(_=accept(result))&&(kind==="field"?initializers.unshift(_):descriptor[key]=_)}target&&Object.defineProperty(target,contextIn.name,descriptor),done=!0},__runInitializers=exports&&exports.__runInitializers||function(thisArg,initializers,value){for(var useValue=arguments.length>2,i=0;i<initializers.length;i++)value=useValue?initializers[i].call(thisArg,value):initializers[i].call(thisArg);return useValue?value:void 0};Object.defineProperty(exports,"__esModule",{value:!0}),exports.ResourcePolicy=void 0;var jsiiDeprecationWarnings=()=>{var tmp=require("../../.warnings.jsii.js");return jsiiDeprecationWarnings=()=>tmp,tmp};const JSII_RTTI_SYMBOL_1=Symbol.for("jsii.rtti");var logs_generated_1=()=>{var tmp=require("./logs.generated");return logs_generated_1=()=>tmp,tmp},aws_iam_1=()=>{var tmp=require("../../aws-iam");return aws_iam_1=()=>tmp,tmp},core_1=()=>{var tmp=require("../../core");return core_1=()=>tmp,tmp},metadata_resource_1=()=>{var tmp=require("../../core/lib/metadata-resource");return metadata_resource_1=()=>tmp,tmp},prop_injectable_1=()=>{var tmp=require("../../core/lib/prop-injectable");return prop_injectable_1=()=>tmp,tmp};let ResourcePolicy=(()=>{let _classDecorators=[prop_injectable_1().propertyInjectable],_classDescriptor,_classExtraInitializers=[],_classThis,_classSuper=core_1().Resource;var ResourcePolicy2=class extends _classSuper{static{_classThis=this}static{const _metadata=typeof Symbol=="function"&&Symbol.metadata?Object.create(_classSuper[Symbol.metadata]??null):void 0;__esDecorate(null,_classDescriptor={value:_classThis},_classDecorators,{kind:"class",name:_classThis.name,metadata:_metadata},null,_classExtraInitializers),ResourcePolicy2=_classThis=_classDescriptor.value,_metadata&&Object.defineProperty(_classThis,Symbol.metadata,{enumerable:!0,configurable:!0,writable:!0,value:_metadata})}static[JSII_RTTI_SYMBOL_1]={fqn:"aws-cdk-lib.aws_logs.ResourcePolicy",version:"2.252.0"};static PROPERTY_INJECTION_ID="aws-cdk-lib.aws-logs.ResourcePolicy";document=new(aws_iam_1()).PolicyDocument;constructor(scope,id,props){super(scope,id,{physicalName:props?.resourcePolicyName});try{jsiiDeprecationWarnings().aws_cdk_lib_aws_logs_ResourcePolicyProps(props)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,ResourcePolicy2),error}(0,metadata_resource_1().addConstructMetadata)(this,props);const l1=new(logs_generated_1()).CfnResourcePolicy(this,"ResourcePolicy",{policyName:core_1().Lazy.string({produce:()=>props?.resourcePolicyName??core_1().Names.uniqueId(this)}),policyDocument:core_1().Lazy.string({produce:()=>JSON.stringify(this.document)})});this.node.defaultChild=l1,props?.policyStatements&&this.document.addStatements(...props.policyStatements)}static{__runInitializers(_classThis,_classExtraInitializers)}};return ResourcePolicy2=_classThis})();exports.ResourcePolicy=ResourcePolicy;

cdk/node_modules/aws-cdk-lib/aws-logs/lib/private/default-traits.d.ts

@@ -0,0 +1 @@
+export {};

cdk/node_modules/aws-cdk-lib/aws-logs/lib/private/default-traits.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0});var aws_iam_1=()=>{var tmp=require("../../../aws-iam");return aws_iam_1=()=>tmp,tmp},core_1=()=>{var tmp=require("../../../core");return core_1=()=>tmp,tmp},literal_string_1=()=>{var tmp=require("../../../core/lib/private/literal-string");return literal_string_1=()=>tmp,tmp},logs_generated_1=()=>{var tmp=require("../logs.generated");return logs_generated_1=()=>tmp,tmp};class LogGroupWithPolicyFactory{forResource(resource){return ifCfnLogGroup(resource,r=>new CfnLogGroupWithPolicy(r))}}class CfnLogGroupWithPolicy{logGroup;env;policy;policyDocument;constructor(logGroup){this.logGroup=logGroup,this.env=logGroup.env}addToResourcePolicy(statement){return this.policy||(this.policy=new(logs_generated_1()).CfnResourcePolicy(this.logGroup,"LogGroupPolicy",{policyDocument:JSON.stringify({Statement:[]}),policyName:core_1().Names.uniqueId(this.logGroup)})),this.policyDocument||(this.policyDocument=aws_iam_1().PolicyDocument.fromJson(JSON.parse(this.policy.policyDocument)??{Statement:[]})),this.policyDocument.addStatements(statement),this.policy.policyDocument=JSON.stringify(this.policyDocument.toJSON()),{statementAdded:!0,policyDependable:this.policy}}}function ifCfnLogGroup(resource,factory){if(!logs_generated_1().CfnLogGroup.isCfnLogGroup(resource))throw new(core_1()).ValidationError((0,literal_string_1().lit)`Construct`,`Construct ${resource.node.path} is not of type CfnLogGroup`,resource);return factory(resource)}aws_iam_1().DefaultPolicyFactories.set("AWS::Logs::LogGroup",new LogGroupWithPolicyFactory);

cdk/node_modules/aws-cdk-lib/aws-logs/lib/private/ref-utils.d.ts

@@ -0,0 +1,7 @@
+import type { ILogGroupRef } from '../../../interfaces/generated/aws-logs-interfaces.generated';
+import type { ILogGroup } from '../log-group';
+/**
+ * Convert an ILogGroupRef to ILogGroup, validating that it implements the full interface
+ * @internal
+ */
+export declare function toILogGroup(logGroup: ILogGroupRef): ILogGroup;

cdk/node_modules/aws-cdk-lib/aws-logs/lib/private/ref-utils.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.toILogGroup=toILogGroup;var core_1=()=>{var tmp=require("../../../core");return core_1=()=>tmp,tmp},literal_string_1=()=>{var tmp=require("../../../core/lib/private/literal-string");return literal_string_1=()=>tmp,tmp};function toILogGroup(logGroup){if(typeof logGroup.addStream!="function"||typeof logGroup.grant!="function")throw new(core_1()).UnscopedValidationError((0,literal_string_1().lit)`LoggroupInstanceShouldImplement`,`'logGroup' instance should implement ILogGroup, but doesn't: ${logGroup.constructor.name}`);return logGroup}

cdk/node_modules/aws-cdk-lib/aws-logs/lib/query-definition.d.ts

@@ -0,0 +1,157 @@
+import type { Construct } from 'constructs';
+import { Resource } from '../../core';
+import type { ILogGroupRef } from '../../interfaces/generated/aws-logs-interfaces.generated';
+/**
+ * Properties for a QueryString
+ */
+export interface QueryStringProps {
+    /**
+     * Retrieves the specified fields from log events for display.
+     *
+     * @default - no fields in QueryString
+     */
+    readonly fields?: string[];
+    /**
+     * A single statement for parsing data from a log field and creating ephemeral fields that can
+     * be processed further in the query.
+     *
+     * @deprecated Use `parseStatements` instead
+     * @default - no parse in QueryString
+     */
+    readonly parse?: string;
+    /**
+     * An array of one or more statements for parsing data from a log field and creating ephemeral
+     * fields that can be processed further in the query. Each provided statement generates a separate
+     * parse line in the query string.
+     *
+     * Note: If provided, this property overrides any value provided for the `parse` property.
+     *
+     * @default - no parse in QueryString
+     */
+    readonly parseStatements?: string[];
+    /**
+     * A single statement for filtering the results of a query based on a boolean expression.
+     *
+     * @deprecated Use `filterStatements` instead
+     * @default - no filter in QueryString
+     */
+    readonly filter?: string;
+    /**
+     * An array of one or more statements for filtering the results of a query based on a boolean
+     * expression. Each provided statement generates a separate filter line in the query string.
+     *
+     * Note: If provided, this property overrides any value provided for the `filter` property.
+     *
+     * @default - no filter in QueryString
+     */
+    readonly filterStatements?: string[];
+    /**
+     * A single statement for using log field values to calculate aggregate statistics.
+     *
+     * @deprecated Use `statsStatements` instead
+     * @default - no stats in QueryString
+     */
+    readonly stats?: string;
+    /**
+     * An array of one or more statements for calculating aggregate statistics.
+     * CloudWatch Logs Insights supports up to two stats commands in a single query.
+     * Each provided statement generates a separate stats line in the query string.
+     *
+     * Note: If provided, this property overrides any value provided for the `stats` property.
+     *
+     * @default - no stats in QueryString
+     */
+    readonly statsStatements?: string[];
+    /**
+     * Sorts the retrieved log events.
+     *
+     * @default - no sort in QueryString
+     */
+    readonly sort?: string;
+    /**
+     * Specifies the number of log events returned by the query.
+     *
+     * @default - no limit in QueryString
+     */
+    readonly limit?: Number;
+    /**
+     * Specifies which fields to display in the query results.
+     *
+     * @default - no display in QueryString
+     */
+    readonly display?: string;
+}
+/**
+ * Define a QueryString
+ */
+export declare class QueryString {
+    private readonly fields?;
+    private readonly parse;
+    private readonly filter;
+    private readonly stats;
+    private readonly sort?;
+    private readonly limit?;
+    private readonly display?;
+    /**
+     * Length of statsStatements
+     */
+    readonly statsStatementsLength?: number;
+    /**
+     * If the props for the query string have both stats and statsStatements
+     */
+    readonly hasStatsAndStatsStatements: boolean;
+    constructor(props?: QueryStringProps);
+    /**
+     * String representation of this QueryString.
+     */
+    toString(): string;
+    /**
+     * Build an array of query lines given a command and statement(s).
+     *
+     * @param command a query command
+     * @param statements one or more query statements for the specified command, or undefined
+     * @returns an array of the query string lines generated from the provided command and statements
+     */
+    private buildQueryLines;
+    /**
+     * Build a single query line given a command and statement.
+     *
+     * @param command a query command
+     * @param statement a single query statement
+     * @returns a single query string line generated from the provided command and statement
+     */
+    private buildQueryLine;
+}
+/**
+ * Properties for a QueryDefinition
+ */
+export interface QueryDefinitionProps {
+    /**
+     * Name of the query definition.
+     */
+    readonly queryDefinitionName: string;
+    /**
+     * The query string to use for this query definition.
+     */
+    readonly queryString: QueryString;
+    /**
+     * Specify certain log groups for the query definition.
+     *
+     * @default - no specified log groups
+     */
+    readonly logGroups?: ILogGroupRef[];
+}
+/**
+ * Define a query definition for CloudWatch Logs Insights
+ */
+export declare class QueryDefinition extends Resource {
+    /** Uniquely identifies this class. */
+    static readonly PROPERTY_INJECTION_ID: string;
+    /**
+     * The ID of the query definition.
+     *
+     * @attribute
+     */
+    readonly queryDefinitionId: string;
+    constructor(scope: Construct, id: string, props: QueryDefinitionProps);
+}

cdk/node_modules/aws-cdk-lib/aws-logs/lib/query-definition.js

@@ -0,0 +1,2 @@
+"use strict";var __esDecorate=exports&&exports.__esDecorate||function(ctor,descriptorIn,decorators,contextIn,initializers,extraInitializers){function accept(f){if(f!==void 0&&typeof f!="function")throw new TypeError("Function expected");return f}for(var kind=contextIn.kind,key=kind==="getter"?"get":kind==="setter"?"set":"value",target=!descriptorIn&&ctor?contextIn.static?ctor:ctor.prototype:null,descriptor=descriptorIn||(target?Object.getOwnPropertyDescriptor(target,contextIn.name):{}),_,done=!1,i=decorators.length-1;i>=0;i--){var context={};for(var p in contextIn)context[p]=p==="access"?{}:contextIn[p];for(var p in contextIn.access)context.access[p]=contextIn.access[p];context.addInitializer=function(f){if(done)throw new TypeError("Cannot add initializers after decoration has completed");extraInitializers.push(accept(f||null))};var result=(0,decorators[i])(kind==="accessor"?{get:descriptor.get,set:descriptor.set}:descriptor[key],context);if(kind==="accessor"){if(result===void 0)continue;if(result===null||typeof result!="object")throw new TypeError("Object expected");(_=accept(result.get))&&(descriptor.get=_),(_=accept(result.set))&&(descriptor.set=_),(_=accept(result.init))&&initializers.unshift(_)}else(_=accept(result))&&(kind==="field"?initializers.unshift(_):descriptor[key]=_)}target&&Object.defineProperty(target,contextIn.name,descriptor),done=!0},__runInitializers=exports&&exports.__runInitializers||function(thisArg,initializers,value){for(var useValue=arguments.length>2,i=0;i<initializers.length;i++)value=useValue?initializers[i].call(thisArg,value):initializers[i].call(thisArg);return useValue?value:void 0};Object.defineProperty(exports,"__esModule",{value:!0}),exports.QueryDefinition=exports.QueryString=void 0;var jsiiDeprecationWarnings=()=>{var tmp=require("../../.warnings.jsii.js");return jsiiDeprecationWarnings=()=>tmp,tmp};const JSII_RTTI_SYMBOL_1=Symbol.for("jsii.rtti");var _1=()=>{var tmp=require(".");return _1=()=>tmp,tmp},core_1=()=>{var tmp=require("../../core");return core_1=()=>tmp,tmp},metadata_resource_1=()=>{var tmp=require("../../core/lib/metadata-resource");return metadata_resource_1=()=>tmp,tmp},literal_string_1=()=>{var tmp=require("../../core/lib/private/literal-string");return literal_string_1=()=>tmp,tmp},prop_injectable_1=()=>{var tmp=require("../../core/lib/prop-injectable");return prop_injectable_1=()=>tmp,tmp};class QueryString{static[JSII_RTTI_SYMBOL_1]={fqn:"aws-cdk-lib.aws_logs.QueryString",version:"2.252.0"};fields;parse;filter;stats;sort;limit;display;statsStatementsLength;hasStatsAndStatsStatements;constructor(props={}){try{jsiiDeprecationWarnings().aws_cdk_lib_aws_logs_QueryStringProps(props)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,QueryString),error}this.fields=props.fields,this.sort=props.sort,this.limit=props.limit,this.display=props.display,this.statsStatementsLength=props.statsStatements?.length,this.hasStatsAndStatsStatements=!!(props.statsStatements&&props.stats),props.parseStatements?this.parse=props.parseStatements:props.parse?this.parse=[props.parse]:this.parse=[],props.filterStatements?this.filter=props.filterStatements:props.filter?this.filter=[props.filter]:this.filter=[],props.statsStatements?this.stats=props.statsStatements:props.stats?this.stats=[props.stats]:this.stats=[]}toString(){return[this.buildQueryLine("fields",this.fields?.join(", ")),...this.buildQueryLines("parse",this.parse),...this.buildQueryLines("filter",this.filter),...this.buildQueryLines("stats",this.stats),this.buildQueryLine("sort",this.sort),this.buildQueryLine("limit",this.limit?.toString()),this.buildQueryLine("display",this.display)].filter(queryLine=>queryLine!==void 0&&queryLine.length>0).join(`
+| `)}buildQueryLines(command,statements){return statements===void 0?[]:statements.map(statement=>this.buildQueryLine(command,statement))}buildQueryLine(command,statement){return statement?`${command} ${statement}`:""}}exports.QueryString=QueryString;let QueryDefinition=(()=>{let _classDecorators=[prop_injectable_1().propertyInjectable],_classDescriptor,_classExtraInitializers=[],_classThis,_classSuper=core_1().Resource;var QueryDefinition2=class extends _classSuper{static{_classThis=this}static{const _metadata=typeof Symbol=="function"&&Symbol.metadata?Object.create(_classSuper[Symbol.metadata]??null):void 0;__esDecorate(null,_classDescriptor={value:_classThis},_classDecorators,{kind:"class",name:_classThis.name,metadata:_metadata},null,_classExtraInitializers),QueryDefinition2=_classThis=_classDescriptor.value,_metadata&&Object.defineProperty(_classThis,Symbol.metadata,{enumerable:!0,configurable:!0,writable:!0,value:_metadata})}static[JSII_RTTI_SYMBOL_1]={fqn:"aws-cdk-lib.aws_logs.QueryDefinition",version:"2.252.0"};static PROPERTY_INJECTION_ID="aws-cdk-lib.aws-logs.QueryDefinition";queryDefinitionId;constructor(scope,id,props){super(scope,id,{physicalName:props.queryDefinitionName});try{jsiiDeprecationWarnings().aws_cdk_lib_aws_logs_QueryDefinitionProps(props)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,QueryDefinition2),error}if((0,metadata_resource_1().addConstructMetadata)(this,props),props.queryString.statsStatementsLength&&props.queryString.statsStatementsLength>2)throw new(core_1()).ValidationError((0,literal_string_1().lit)`CloudWatchLogsInsightsSupports`,`CloudWatch Logs Insights only supports up to two stats commands in a single query, received ${props.queryString.statsStatementsLength}.`,this);props.queryString.hasStatsAndStatsStatements&&core_1().Annotations.of(this).addWarningV2("QueryDefinitionStatsWarning","Both stats and statsStatements properties are provided. The stats property is deprecated and will be ignored in favor of statsStatements.");const queryDefinition=new(_1()).CfnQueryDefinition(this,"Resource",{name:props.queryDefinitionName,queryString:props.queryString.toString(),logGroupNames:typeof props.logGroups>"u"?[]:props.logGroups.flatMap(logGroup=>logGroup.logGroupRef.logGroupName)});this.queryDefinitionId=queryDefinition.attrQueryDefinitionId}static{__runInitializers(_classThis,_classExtraInitializers)}};return QueryDefinition2=_classThis})();exports.QueryDefinition=QueryDefinition;

cdk/node_modules/aws-cdk-lib/aws-logs/lib/subscription-filter.d.ts

@@ -0,0 +1,53 @@
+import type { Construct } from 'constructs';
+import type { SubscriptionFilterOptions } from './log-group';
+import type * as iam from '../../aws-iam';
+import { Resource } from '../../core';
+import type { ILogGroupRef } from '../../interfaces/generated/aws-logs-interfaces.generated';
+/**
+ * Interface for classes that can be the destination of a log Subscription
+ */
+export interface ILogSubscriptionDestination {
+    /**
+     * Return the properties required to send subscription events to this destination.
+     *
+     * If necessary, the destination can use the properties of the SubscriptionFilter
+     * object itself to configure its permissions to allow the subscription to write
+     * to it.
+     *
+     * The destination may reconfigure its own permissions in response to this
+     * function call.
+     */
+    bind(scope: Construct, sourceLogGroup: ILogGroupRef): LogSubscriptionDestinationConfig;
+}
+/**
+ * Properties returned by a Subscription destination
+ */
+export interface LogSubscriptionDestinationConfig {
+    /**
+     * The ARN of the subscription's destination
+     */
+    readonly arn: string;
+    /**
+     * The role to assume to write log events to the destination
+     *
+     * @default No role assumed
+     */
+    readonly role?: iam.IRole;
+}
+/**
+ * Properties for a SubscriptionFilter
+ */
+export interface SubscriptionFilterProps extends SubscriptionFilterOptions {
+    /**
+     * The log group to create the subscription on.
+     */
+    readonly logGroup: ILogGroupRef;
+}
+/**
+ * A new Subscription on a CloudWatch log group.
+ */
+export declare class SubscriptionFilter extends Resource {
+    /** Uniquely identifies this class. */
+    static readonly PROPERTY_INJECTION_ID: string;
+    constructor(scope: Construct, id: string, props: SubscriptionFilterProps);
+}

cdk/node_modules/aws-cdk-lib/aws-logs/lib/subscription-filter.js

@@ -0,0 +1 @@
+"use strict";var __esDecorate=exports&&exports.__esDecorate||function(ctor,descriptorIn,decorators,contextIn,initializers,extraInitializers){function accept(f){if(f!==void 0&&typeof f!="function")throw new TypeError("Function expected");return f}for(var kind=contextIn.kind,key=kind==="getter"?"get":kind==="setter"?"set":"value",target=!descriptorIn&&ctor?contextIn.static?ctor:ctor.prototype:null,descriptor=descriptorIn||(target?Object.getOwnPropertyDescriptor(target,contextIn.name):{}),_,done=!1,i=decorators.length-1;i>=0;i--){var context={};for(var p in contextIn)context[p]=p==="access"?{}:contextIn[p];for(var p in contextIn.access)context.access[p]=contextIn.access[p];context.addInitializer=function(f){if(done)throw new TypeError("Cannot add initializers after decoration has completed");extraInitializers.push(accept(f||null))};var result=(0,decorators[i])(kind==="accessor"?{get:descriptor.get,set:descriptor.set}:descriptor[key],context);if(kind==="accessor"){if(result===void 0)continue;if(result===null||typeof result!="object")throw new TypeError("Object expected");(_=accept(result.get))&&(descriptor.get=_),(_=accept(result.set))&&(descriptor.set=_),(_=accept(result.init))&&initializers.unshift(_)}else(_=accept(result))&&(kind==="field"?initializers.unshift(_):descriptor[key]=_)}target&&Object.defineProperty(target,contextIn.name,descriptor),done=!0},__runInitializers=exports&&exports.__runInitializers||function(thisArg,initializers,value){for(var useValue=arguments.length>2,i=0;i<initializers.length;i++)value=useValue?initializers[i].call(thisArg,value):initializers[i].call(thisArg);return useValue?value:void 0};Object.defineProperty(exports,"__esModule",{value:!0}),exports.SubscriptionFilter=void 0;var jsiiDeprecationWarnings=()=>{var tmp=require("../../.warnings.jsii.js");return jsiiDeprecationWarnings=()=>tmp,tmp};const JSII_RTTI_SYMBOL_1=Symbol.for("jsii.rtti");var logs_generated_1=()=>{var tmp=require("./logs.generated");return logs_generated_1=()=>tmp,tmp},aws_logs_destinations_1=()=>{var tmp=require("../../aws-logs-destinations");return aws_logs_destinations_1=()=>tmp,tmp},core_1=()=>{var tmp=require("../../core");return core_1=()=>tmp,tmp},metadata_resource_1=()=>{var tmp=require("../../core/lib/metadata-resource");return metadata_resource_1=()=>tmp,tmp},literal_string_1=()=>{var tmp=require("../../core/lib/private/literal-string");return literal_string_1=()=>tmp,tmp},prop_injectable_1=()=>{var tmp=require("../../core/lib/prop-injectable");return prop_injectable_1=()=>tmp,tmp};let SubscriptionFilter=(()=>{let _classDecorators=[prop_injectable_1().propertyInjectable],_classDescriptor,_classExtraInitializers=[],_classThis,_classSuper=core_1().Resource;var SubscriptionFilter2=class extends _classSuper{static{_classThis=this}static{const _metadata=typeof Symbol=="function"&&Symbol.metadata?Object.create(_classSuper[Symbol.metadata]??null):void 0;__esDecorate(null,_classDescriptor={value:_classThis},_classDecorators,{kind:"class",name:_classThis.name,metadata:_metadata},null,_classExtraInitializers),SubscriptionFilter2=_classThis=_classDescriptor.value,_metadata&&Object.defineProperty(_classThis,Symbol.metadata,{enumerable:!0,configurable:!0,writable:!0,value:_metadata})}static[JSII_RTTI_SYMBOL_1]={fqn:"aws-cdk-lib.aws_logs.SubscriptionFilter",version:"2.252.0"};static PROPERTY_INJECTION_ID="aws-cdk-lib.aws-logs.SubscriptionFilter";constructor(scope,id,props){super(scope,id,{physicalName:props.filterName});try{jsiiDeprecationWarnings().aws_cdk_lib_aws_logs_SubscriptionFilterProps(props)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,SubscriptionFilter2),error}if((0,metadata_resource_1().addConstructMetadata)(this,props),props.distribution&&!core_1().Token.isUnresolved(props.distribution)&&!core_1().Token.isUnresolved(props.destination)&&!(props.destination instanceof aws_logs_destinations_1().KinesisDestination))throw new(core_1()).ValidationError((0,literal_string_1().lit)`DistributionPropertyKinesisDestination`,"distribution property can only be used with KinesisDestination.",this);const destProps=props.destination.bind(this,props.logGroup);new(logs_generated_1()).CfnSubscriptionFilter(this,"Resource",{logGroupName:props.logGroup.logGroupRef.logGroupName,destinationArn:destProps.arn,roleArn:destProps.role?.roleArn,filterPattern:props.filterPattern.logPatternString,filterName:this.physicalName,distribution:props.distribution})}static{__runInitializers(_classThis,_classExtraInitializers)}};return SubscriptionFilter2=_classThis})();exports.SubscriptionFilter=SubscriptionFilter;

cdk/node_modules/aws-cdk-lib/aws-logs/lib/transformer.d.ts

@@ -0,0 +1,867 @@
+/**
+ * Generated TypeScript code for L2 Construct Design: AWS Logs Transformer
+ *
+ * This file contains TypeScript definitions for the AWS Logs Transformer L2 Construct.
+ *
+ * A log transformer enables transforming log events into a different format, making them easier
+ * to process and analyze. You can also transform logs from different sources into standardized formats
+ * that contain relevant, source-specific information.
+ *
+ * After you create a transformer, CloudWatch performs the transformations at the time of log ingestion.
+ * You can then refer to the transformed versions of the logs during operations such as
+ * querying with CloudWatch Logs Insights or creating metric filters or subscription filters.
+ *
+ * Resource Structure:
+ * - AWS::Logs::Transformer: Interface (ITransformer) directly implemented by concrete classes (Transformer)
+ *   This follows a direct implementation pattern where concrete classes implement the interface directly without a shared base class.
+ */
+import type { Construct } from 'constructs';
+import { Resource } from '../../core';
+import type { ILogGroupRef } from '../../interfaces/generated/aws-logs-interfaces.generated';
+/**
+ * Valid data types for type conversion in the TypeConverter processor.
+ * Used to specify the target data type for field conversion.
+ */
+export declare enum TypeConverterType {
+    /** Convert value to boolean type */
+    BOOLEAN = "boolean",
+    /** Convert value to integer type */
+    INTEGER = "integer",
+    /** Convert value to double (floating point) type */
+    DOUBLE = "double",
+    /** Convert value to string type */
+    STRING = "string"
+}
+/**
+ * Standard datetime formats for the DateTimeConverter processor.
+ * Provides common format patterns for date/time conversion.
+ */
+export declare enum DateTimeFormat {
+    /** ISO 8601 format (yyyy-MM-ddTHH:mm:ssZ) */
+    ISO_8601 = "yyyy-MM-dd'T'HH:mm:ss'Z'",
+    /** Unix timestamp (seconds since epoch) */
+    UNIX_TIMESTAMP = "epoch",
+    /** Custom format specified by the targetFormat parameter */
+    CUSTOM = "custom"
+}
+/**
+ * Valid delimiter characters for CSV processor.
+ * Defines the character used to separate each column in CSV data.
+ */
+export declare enum DelimiterCharacter {
+    /** Comma character */
+    COMMA = ",",
+    /** Tab character */
+    TAB = "\t",
+    /** Space character */
+    SPACE = " ",
+    /** Semicolon character */
+    SEMICOLON = ";",
+    /** Pipe character */
+    PIPE = "|"
+}
+/**
+ * Valid quote characters for CSV processor.
+ * Defines the character used as a text qualifier for a single column of data.
+ */
+export declare enum QuoteCharacter {
+    /** Double quote character (default) */
+    DOUBLE_QUOTE = "\"",
+    /** Single quote character */
+    SINGLE_QUOTE = "'"
+}
+/**
+ * Valid field delimiters for ParseKeyValue processor.
+ * Defines the delimiter string used between key-value pairs in the original log events.
+ */
+export declare enum KeyValuePairDelimiter {
+    /** Ampersand character (default) */
+    AMPERSAND = "&",
+    /** Semicolon character */
+    SEMICOLON = ";",
+    /** Space character */
+    SPACE = " ",
+    /** Newline character */
+    NEWLINE = "\n"
+}
+/**
+ * Valid key-value delimiters for ParseKeyValue processor.
+ * Defines the delimiter string to use between the key and value in each pair.
+ */
+export declare enum KeyValueDelimiter {
+    /** Equal sign (default) */
+    EQUAL = "=",
+    /** Colon character */
+    COLON = ":"
+}
+/**
+ * Types of event sources supported to convert to OCSF format.
+ */
+export declare enum OCSFSourceType {
+    /** Log events from CloudTrail */
+    CLOUD_TRAIL = "CloudTrail",
+    /** Log events from Route53Resolver */
+    ROUTE53_RESOLVER = "Route53Resolver",
+    /** Log events from VPCFlow */
+    VPC_FLOW = "VPCFlow",
+    /** Log events from EKSAudit */
+    EKS_AUDIT = "EKSAudit",
+    /** Log events from AWSWAF */
+    AWS_WAF = "AWSWAF"
+}
+/**
+ * OCSF Schema versions supported by transformers.
+ */
+export declare enum OCSFVersion {
+    /**
+     * OCSF schema version 1.1.
+     * @see https://schema.ocsf.io/1.1.0/
+     */
+    V1_1 = "V1.1"
+}
+/**
+ * Types of configurable parser processors.
+ * Defines the various parser types that can be used to process log events.
+ */
+export declare enum ParserProcessorType {
+    /** Parse log entries as JSON */
+    JSON = 0,
+    /** Parse log entries as key-value pairs */
+    KEY_VALUE = 1,
+    /** Parse log entries in CSV format */
+    CSV = 2,
+    /** Parse log entries using Grok patterns */
+    GROK = 3,
+    /** Parse logs to OCSF format */
+    OCSF = 4
+}
+/**
+ * Types of AWS vended logs with built-in parsers.
+ * AWS provides specialized parsers for common log formats produced by various AWS services.
+ */
+export declare enum VendedLogType {
+    /** Parse CloudFront logs */
+    CLOUDFRONT = 0,
+    /** Parse VPC flow logs */
+    VPC = 1,
+    /** Parse AWS WAF logs */
+    WAF = 2,
+    /** Parse Route 53 logs */
+    ROUTE53 = 3,
+    /** Parse PostgreSQL logs */
+    POSTGRES = 4
+}
+/**
+ * Types of string mutation operations.
+ * Defines various operations that can be performed to modify string values in log events.
+ */
+export declare enum StringMutatorType {
+    /** Convert strings to lowercase */
+    LOWER_CASE = 0,
+    /** Convert strings to uppercase */
+    UPPER_CASE = 1,
+    /** Trim whitespace from strings */
+    TRIM = 2,
+    /** Split strings by delimiter */
+    SPLIT = 3,
+    /** Replace substrings in strings */
+    SUBSTITUTE = 4
+}
+/**
+ * Types of JSON mutation operations.
+ * Defines operations that can be performed to modify the JSON structure of log events.
+ */
+export declare enum JsonMutatorType {
+    /** Add new keys to the log event */
+    ADD_KEYS = 0,
+    /** Delete keys from the log event */
+    DELETE_KEYS = 1,
+    /** Move keys to different locations */
+    MOVE_KEYS = 2,
+    /** Rename keys in the log event */
+    RENAME_KEYS = 3,
+    /** Copy values between keys */
+    COPY_VALUE = 4,
+    /** Convert a list to a map */
+    LIST_TO_MAP = 5
+}
+/**
+ * Types of data conversion operations.
+ * Defines operations that can convert data from one format to another.
+ */
+export declare enum DataConverterType {
+    /** Convert data types */
+    TYPE_CONVERTER = 0,
+    /** Convert datetime formats */
+    DATETIME_CONVERTER = 1
+}
+/**
+ * Processor to parse events from CloudTrail, Route53Resolver, VPCFlow, EKSAudit and AWSWAF into OCSF V1.1 format.
+ */
+export interface ParseToOCSFProperty {
+    /**
+     * Path to the field in the log event that will be parsed. Use dot notation to access child fields.
+     * @default '@message'
+     */
+    readonly source?: string;
+    /**
+     * Type of input log event source to convert to OCSF format.
+     */
+    readonly eventSource: OCSFSourceType;
+    /**
+     * Version of OCSF schema to convert to.
+     */
+    readonly ocsfVersion: OCSFVersion;
+}
+/**
+ * This processor parses log events that are in JSON format. It can extract JSON key-value pairs and place them
+ * under a destination that you specify.
+ * Additionally, because you must have at least one parse-type processor in a transformer, you can use ParseJSON as that
+ * processor for JSON-format logs, so that you can also apply other processors, such as mutate processors, to these logs.
+ * For more information about this processor including examples, see parseJSON in the CloudWatch Logs User Guide.
+ */
+export interface ParseJSONProperty {
+    /**
+     * Path to the field in the log event that will be parsed. Use dot notation to access child fields.
+     * @default '@message'
+     */
+    readonly source?: string;
+    /**
+     * The location to put the parsed key value pair into.
+     * @default - Placed under root of log event
+     */
+    readonly destination?: string;
+}
+/**
+ * This processor parses a specified field in the original log event into key-value pairs.
+ * For more information about this processor including examples, see parseKeyValue in the CloudWatch Logs User Guide.
+ */
+export interface ParseKeyValueProperty {
+    /**
+     * Path to the field in the log event that will be parsed. Use dot notation to access child fields.
+     * @default '@message'
+     */
+    readonly source?: string;
+    /**
+     * The destination field to put the extracted key-value pairs into.
+     * @default - Places at the root of the JSON input.
+     */
+    readonly destination?: string;
+    /**
+     * The field delimiter string that is used between key-value pairs in the original log events.
+     * @default KeyValuePairDelimiter.AMPERSAND
+     */
+    readonly fieldDelimiter?: KeyValuePairDelimiter;
+    /**
+     * The delimiter string to use between the key and value in each pair in the transformed log event.
+     * @default KeyValueDelimiter.EQUAL
+     */
+    readonly keyValueDelimiter?: KeyValueDelimiter;
+    /**
+     * If you want to add a prefix to all transformed keys, specify it here.
+     * @default - No prefix is added to the keys.
+     */
+    readonly keyPrefix?: string;
+    /**
+     * A value to insert into the value field in the result, when a key-value pair is not successfully split.
+     * @default - No values is inserted when split is not successful.
+     */
+    readonly nonMatchValue?: string;
+    /**
+     * Specifies whether to overwrite the value if the destination key already exists.
+     * @default false
+     */
+    readonly overwriteIfExists?: boolean;
+}
+/**
+ * Copy Value processor, copies values from source to target for each entry.
+ */
+export interface CopyValueProperty {
+    /**
+     * List of sources and target to copy.
+     */
+    readonly entries: Array<CopyValueEntryProperty>;
+}
+/**
+ * The CSV processor parses comma-separated values (CSV) from the log events into columns.
+ * For more information about this processor including examples, see csv in the CloudWatch Logs User Guide.
+ */
+export interface CsvProperty {
+    /**
+     * Character used as a text qualifier for a single column of data.
+     * @default QuoteCharacter.DOUBLE_QUOTE
+     */
+    readonly quoteCharacter?: QuoteCharacter;
+    /**
+     * Character used to separate each column in the original comma-separated value log event.
+     * @default DelimiterCharacter.COMMA
+     */
+    readonly delimiter?: DelimiterCharacter;
+    /**
+     * The path to the field in the log event that has the comma separated values to be parsed.
+     * @default '@message'
+     */
+    readonly source?: string;
+    /**
+     * An array of names to use for the columns in the transformed log event.
+     * @default - Column names ([column_1, column_2 ...]) are used
+     */
+    readonly columns?: Array<string>;
+}
+/**
+ * This processor converts a datetime string into a format that you specify.
+ * For more information about this processor including examples, see datetimeConverter in the CloudWatch Logs User Guide.
+ */
+export interface DateTimeConverterProperty {
+    /**
+     * The key to apply the date conversion to.
+     */
+    readonly source: string;
+    /**
+     * The JSON field to store the result in.
+     */
+    readonly target: string;
+    /**
+     * The datetime format to use for the converted data in the target field.
+     * @default "yyyy-MM-dd'T'HH:mm:ss.SSS'Z'"
+     */
+    readonly targetFormat?: string;
+    /**
+     * A list of patterns to match against the source field.
+     */
+    readonly matchPatterns: Array<string>;
+    /**
+     * The time zone of the source field.
+     * @default UTC
+     */
+    readonly sourceTimezone?: string;
+    /**
+     * The time zone of the target field.
+     * @default UTC
+     */
+    readonly targetTimezone?: string;
+    /**
+     * The locale of the source field.
+     */
+    readonly locale: string;
+}
+/**
+ * This processor uses pattern matching to parse and structure unstructured data. This processor can also extract fields from log messages.
+ * For more information about this processor including examples, see grok in the CloudWatch Logs User Guide.
+ */
+export interface GrokProperty {
+    /**
+     * The path to the field in the log event that you want to parse.
+     * @default '@message'
+     */
+    readonly source?: string;
+    /**
+     * The grok pattern to match against the log event. For a list of supported grok patterns,
+     * see Supported grok patterns in the CloudWatch Logs User Guide.
+     */
+    readonly match: string;
+}
+/**
+ * This processor takes a list of objects that contain key fields, and converts them into a map of target keys.
+ * For more information about this processor including examples, see listToMap in the CloudWatch Logs User Guide.
+ */
+export interface ListToMapProperty {
+    /**
+     * The key in the log event that has a list of objects that will be converted to a map.
+     */
+    readonly source: string;
+    /**
+     * The key of the field to be extracted as keys in the generated map.
+     */
+    readonly key: string;
+    /**
+     * If this is specified, the values that you specify in this parameter will be extracted from the source objects
+     * and put into the values of the generated map.
+     * @default - Original objects in the source list will be put into the values of the generated map
+     */
+    readonly valueKey?: string;
+    /**
+     * The key of the field that will hold the generated map.
+     * @default - Stored at the root of the log event
+     */
+    readonly target?: string;
+    /**
+     * A Boolean value to indicate whether the list will be flattened into single items.
+     * @default false
+     */
+    readonly flatten?: boolean;
+    /**
+     * If you set flatten to true, use flattenedElement to specify which element, first or last, to keep.
+     * You must specify this parameter if flatten is true.
+     * @default - Must be specified if flatten is true and if flatten is false, has no effect
+     */
+    readonly flattenedElement?: string;
+}
+/**
+ * This processor adds new key-value pairs to the log event.
+ * For more information about this processor including examples, see addKeys in the CloudWatch Logs User Guide.
+ */
+export interface AddKeysProperty {
+    /**
+     * An array of objects, where each object contains information about one key to add to the log event.
+     */
+    readonly entries: Array<AddKeyEntryProperty>;
+}
+/**
+ * This processor adds new key-value pairs to the log event.
+ * For more information about this processor including examples, see addKeys in the CloudWatch Logs User Guide.
+ */
+export interface ProcessorDeleteKeysProperty {
+    /**
+     * A list of keys to delete
+     */
+    readonly withKeys: Array<String>;
+}
+/**
+ * This processor copies values within a log event.
+ * You can also use this processor to add metadata to log events by copying values from metadata keys.
+ * For more information about this processor including examples, see copyValue in the CloudWatch Logs User Guide.
+ */
+export interface CopyValueProperty {
+    /**
+     * An array of CopyValueEntry objects, where each object contains information about one field value to copy.
+     */
+    readonly entries: Array<CopyValueEntryProperty>;
+}
+/**
+ * This processor moves a key from one field to another. The original key is deleted.
+ * For more information about this processor including examples, see moveKeys in the CloudWatch Logs User Guide.
+ */
+export interface MoveKeysProperty {
+    /**
+     * An array of objects, where each object contains information about one key to move.
+     */
+    readonly entries: Array<MoveKeyEntryProperty>;
+}
+/**
+ * Use this processor to rename keys in a log event.
+ * For more information about this processor including examples, see renameKeys in the CloudWatch Logs User Guide.
+ */
+export interface RenameKeysProperty {
+    /**
+     * An array of RenameKeyEntry objects, where each object contains information about one key to rename.
+     */
+    readonly entries: Array<RenameKeyEntryProperty>;
+}
+/**
+ * Use this processor to split a field into an array of strings using a delimiting character.
+ * For more information about this processor including examples, see splitString in the CloudWatch Logs User Guide.
+ */
+export interface SplitStringProperty {
+    /**
+     * An array of SplitStringEntry objects, where each object contains information about one field to split.
+     */
+    readonly entries: Array<SplitStringEntryProperty>;
+}
+/**
+ * This processor matches a key's value against a regular expression and replaces all matches with a replacement string.
+ * For more information about this processor including examples, see substituteString in the CloudWatch Logs User Guide.
+ */
+export interface SubstituteStringProperty {
+    /**
+     * An array of objects, where each object contains information about one key to match and replace.
+     */
+    readonly entries: Array<SubstituteStringEntryProperty>;
+}
+/**
+ * Use this processor to convert a value type associated with the specified key to the specified type.
+ * It's a casting processor that changes the types of the specified fields.
+ * For more information about this processor including examples, see typeConverter in the CloudWatch Logs User Guide.
+ */
+export interface TypeConverterProperty {
+    /**
+     * An array of TypeConverterEntry objects, where each object contains information about one field to change the type of.
+     */
+    readonly entries: Array<TypeConverterEntryProperty>;
+}
+/**
+ * Interface representing a single processor in a CloudWatch Logs transformer.
+ * A log transformer is a series of processors, where each processor applies one type of transformation
+ * to the log events. The processors work one after another, in the order that they are listed, like a pipeline.
+ */
+export interface IProcessor {
+    /**
+     * Returns the L1 processor configuration
+     * @internal
+     */
+    _render(): any;
+}
+/** Base properties for all processor types */
+export interface BaseProcessorProps {
+}
+/** Properties for creating configurable parser processors */
+export interface ParserProcessorProps extends BaseProcessorProps {
+    /** The type of parser processor */
+    readonly type: ParserProcessorType;
+    /**
+     * Options for JSON parser. Required when type is JSON.
+     * @default - No JSON parser is created if props not set
+     */
+    readonly jsonOptions?: ParseJSONProperty;
+    /**
+     * Options for key-value parser. Required when type is KEY_VALUE.
+     * @default - No key-value parser is created if props not set
+     */
+    readonly keyValueOptions?: ParseKeyValueProperty;
+    /**
+     * Options for CSV parser. Required when type is CSV.
+     * @default - No CSV parser is created if props not set
+     */
+    readonly csvOptions?: CsvProperty;
+    /**
+     * Options for Grok parser. Required when type is GROK.
+     * @default - No Grok parser is created if props not set
+     */
+    readonly grokOptions?: GrokProperty;
+    /**
+     * Options for ParseToOCSF parser. Required when type is set to OCSF
+     * @default - no OCSF parser is created.
+     */
+    readonly parseToOCSFOptions?: ParseToOCSFProperty;
+}
+/** Properties for creating AWS vended log parsers */
+export interface VendedLogParserProps extends BaseProcessorProps {
+    /** The type of AWS vended log to parse */
+    readonly logType: VendedLogType;
+    /**
+     * Source field to parse.
+     * @default @message
+     */
+    readonly source?: string;
+}
+/** Properties for creating string mutator processors */
+export interface StringMutatorProps extends BaseProcessorProps {
+    /** The type of string mutation operation */
+    readonly type: StringMutatorType;
+    /**
+     * Keys for strings to convert to lowercase. Required when type is LOWER_CASE.
+     * @default - No lowercase processor is created if props not set
+     */
+    readonly lowerCaseKeys?: Array<string>;
+    /**
+     * Keys for strings to convert to uppercase. Required when type is UPPER_CASE.
+     * @default - No uppercase processor is created if props not set
+     */
+    readonly upperCaseKeys?: Array<string>;
+    /**
+     * Keys for strings to trim. Required when type is TRIM.
+     * @default - No trim processor is created if props not set
+     */
+    readonly trimKeys?: Array<string>;
+    /**
+     * Options for string splitting. Required when type is SPLIT.
+     * @default - No string splitting processor is created if props not set
+     */
+    readonly splitOptions?: SplitStringProperty;
+    /**
+     * Options for string substitution. Required when type is SUBSTITUTE.
+     * @default - No string substitution processor is created if props not set
+     */
+    readonly substituteOptions?: SubstituteStringProperty;
+}
+/** Properties for creating JSON mutator processors */
+export interface JsonMutatorProps extends BaseProcessorProps {
+    /** The type of JSON mutation operation */
+    readonly type: JsonMutatorType;
+    /**
+     * Options for adding keys. Required when type is ADD_KEYS.
+     * @default - No adding keys processor is created if props not set
+     */
+    readonly addKeysOptions?: AddKeysProperty;
+    /**
+     * Keys to delete. Required when type is DELETE_KEYS.
+     * @default - No delete key processor is created if props not set
+     */
+    readonly deleteKeysOptions?: ProcessorDeleteKeysProperty;
+    /**
+     * Options for moving keys. Required when type is MOVE_KEYS.
+     * @default - No move key processor is created if props not set
+     */
+    readonly moveKeysOptions?: MoveKeysProperty;
+    /**
+     * Options for renaming keys. Required when type is RENAME_KEYS.
+     * @default - No rename key processor is created if props not set
+     */
+    readonly renameKeysOptions?: RenameKeysProperty;
+    /**
+     * Options for copying values. Required when type is COPY_VALUE.
+     * @default - No copy value processor is created if props not set
+     */
+    readonly copyValueOptions?: CopyValueProperty;
+    /**
+     * Options for converting lists to maps. Required when type is LIST_TO_MAP.
+     * @default - No list-to-map processor is created if props not set
+     */
+    readonly listToMapOptions?: ListToMapProperty;
+}
+/** Properties for creating data converter processors */
+export interface DataConverterProps extends BaseProcessorProps {
+    /** The type of data conversion operation */
+    readonly type: DataConverterType;
+    /**
+     * Options for type conversion. Required when type is TYPE_CONVERTER.
+     * @default - No type convertor processor is created if not set
+     */
+    readonly typeConverterOptions?: TypeConverterProperty;
+    /**
+     * Options for datetime conversion. Required when type is DATETIME_CONVERTER.
+     * @default - No date time converter processor is created if not set
+     */
+    readonly dateTimeConverterOptions?: DateTimeConverterProperty;
+}
+/**
+ * This object defines one key that will be added with the addKeys processor.
+ */
+export interface AddKeyEntryProperty {
+    /**
+     * The key of the new entry to be added to the log event.
+     */
+    readonly key: string;
+    /**
+     * The value of the new entry to be added to the log event.
+     */
+    readonly value: string;
+    /**
+     * Specifies whether to overwrite the value if the key already exists.
+     * @default false
+     */
+    readonly overwriteIfExists?: boolean;
+}
+/**
+ * This object defines one value to be copied with the copyValue processor.
+ */
+export interface CopyValueEntryProperty {
+    /**
+     * The key to copy.
+     */
+    readonly source: string;
+    /**
+     * The key of the field to copy the value to.
+     */
+    readonly target: string;
+    /**
+     * Specifies whether to overwrite the value if the target key already exists.
+     * @default false
+     */
+    readonly overwriteIfExists?: boolean;
+}
+/**
+ * This object defines one key that will be moved with the moveKey processor.
+ */
+export interface MoveKeyEntryProperty {
+    /**
+     * The key to move.
+     */
+    readonly source: string;
+    /**
+     * The key to move to.
+     */
+    readonly target: string;
+    /**
+     * Specifies whether to overwrite the value if the target key already exists.
+     * @default false
+     */
+    readonly overwriteIfExists?: boolean;
+}
+/**
+ * This object defines one key that will be renamed with the renameKey processor.
+ */
+export interface RenameKeyEntryProperty {
+    /**
+     * The key to rename.
+     */
+    readonly key: string;
+    /**
+     * The string to use for the new key name.
+     */
+    readonly renameTo: string;
+    /**
+     * Whether to overwrite the target key if it already exists.
+     * @default false
+     */
+    readonly overwriteIfExists?: boolean;
+}
+/**
+ * This object defines one log field that will be split with the splitString processor.
+ */
+export interface SplitStringEntryProperty {
+    /**
+     * The key of the field to split.
+     */
+    readonly source: string;
+    /** The separator character to split the string on */
+    readonly delimiter: DelimiterCharacter;
+}
+/**
+ * This object defines one log field key that will be replaced using the substituteString processor.
+ */
+export interface SubstituteStringEntryProperty {
+    /**
+     * The key to modify.
+     */
+    readonly source: string;
+    /**
+     * The regular expression string to be replaced.
+     */
+    readonly from: string;
+    /**
+     * The string to be substituted for each match of from.
+     */
+    readonly to: string;
+}
+/**
+ * This object defines one value type that will be converted using the typeConverter processor.
+ */
+export interface TypeConverterEntryProperty {
+    /**
+     * The key with the value that is to be converted to a different type.
+     */
+    readonly key: string;
+    /** The data type to convert the field value to. */
+    readonly type: TypeConverterType;
+}
+/**
+ * The Resource properties for AWS::Logs::Transformer resource. This
+ * interface defines all configuration options for the CfnTransformer construct.
+ */
+export interface TransformerProps {
+    /**
+     * Name of the transformer.
+     */
+    readonly transformerName: string;
+    /** Existing log group that you want to associate with this transformer. */
+    readonly logGroup: ILogGroupRef;
+    /** List of processors in a transformer */
+    readonly transformerConfig: Array<IProcessor>;
+}
+/** Parser processor for common data formats */
+export declare class ParserProcessor implements IProcessor {
+    /** The type of parser */
+    type: ParserProcessorType;
+    /** Options for JSON parser */
+    private jsonOptions?;
+    /** Options for key-value parser */
+    private keyValueOptions?;
+    /** Options for CSV parser */
+    private csvOptions?;
+    /** Options for Grok parser */
+    private grokOptions?;
+    /** Options for OCSF parser */
+    private parseToOCSFOptions?;
+    /** Creates a new parser processor */
+    constructor(props: ParserProcessorProps);
+    /**
+     * Returns the L1 processor configuration for this parser
+     * @internal
+     */
+    _render(): any;
+}
+/** Parser processor for AWS vended logs */
+export declare class VendedLogParser implements IProcessor {
+    /** The type of AWS vended log */
+    logType: VendedLogType;
+    /** Creates a new vended log parser processor */
+    constructor(props: VendedLogParserProps);
+    /**
+     * Returns the L1 processor configuration for this vended log parser
+     * @internal
+     */
+    _render(): any;
+}
+/** Processor for string mutation operations */
+export declare class StringMutatorProcessor implements IProcessor {
+    /** The type of string mutation operation */
+    type: StringMutatorType;
+    /** Keys for strings to convert to lowercase */
+    private lowerCaseKeys?;
+    /** Keys for strings to convert to uppercase */
+    private upperCaseKeys?;
+    /** Keys for strings to trim */
+    private trimKeys?;
+    /** Options for string splitting */
+    private splitOptions?;
+    /** Options for string substitution */
+    private substituteOptions?;
+    /** Creates a new string mutator processor */
+    constructor(props: StringMutatorProps);
+    /**
+     * Returns the L1 processor configuration for this string mutator
+     * @internal
+     */
+    _render(): any;
+}
+/** Processor for JSON mutation operations */
+export declare class JsonMutatorProcessor implements IProcessor {
+    /** The type of JSON mutation operation */
+    type: JsonMutatorType;
+    /** Options for adding keys */
+    private addKeysOptions?;
+    /** Keys to delete */
+    private deleteKeysOptions?;
+    /** Options for moving keys */
+    private moveKeysOptions?;
+    /** Options for renaming keys */
+    private renameKeysOptions?;
+    /** Options for copying values */
+    private copyValueOptions?;
+    /** Options for converting lists to maps */
+    private listToMapOptions?;
+    /** Creates a new JSON mutator processor */
+    constructor(props: JsonMutatorProps);
+    /**
+     * Returns the L1 processor configuration for this JSON mutator
+     * @internal
+     */
+    _render(): any;
+}
+/** Processor for data conversion operations */
+export declare class DataConverterProcessor implements IProcessor {
+    /** The type of data conversion operation */
+    type: DataConverterType;
+    /** Options for type conversion */
+    private typeConverterOptions?;
+    /** Options for datetime conversion */
+    private dateTimeConverterOptions?;
+    /** Creates a new data converter processor */
+    constructor(props: DataConverterProps);
+    /**
+     * Returns the L1 processor configuration for this data converter
+     * @internal
+     */
+    _render(): any;
+}
+/** Represent the L2 construct for the AWS::Logs::Transformer CloudFormation resource. */
+export declare class Transformer extends Resource {
+    /**
+     * The property injection ID for this resource class.
+     * Used by the CDK frameworks for managing resource lifecycle.
+     */
+    static readonly PROPERTY_INJECTION_ID: string;
+    /** The Transformer L2 construct that represents AWS::Logs::Transformer CFN resource. */
+    constructor(scope: Construct, id: string, props: TransformerProps);
+    /**
+     * @internal Validates that the number of processors doesn't exceed the AWS limit of 20 per transformer, and that at least
+     * one processor is provided.
+     */
+    private validateProcessorCount;
+    /**
+     * @internal Validates parser processor requirements: at least one parser-type processor is required, maximum of 5
+     * parser-type processors allowed, and if including a vended log parser, it must be the first processor.
+     */
+    private validateParserProcessors;
+    /**
+     * @internal Validates that certain processor types appear at most once: only one grok processor, one addKeys processor,
+     * and one copyValue processor allowed.
+     */
+    private validateUniqueProcessorTypes;
+    /**
+     * @internal Validates that the log group is in the Standard log class, as transformers can only be used with Standard log
+     * groups.
+     */
+    private validateLogGroupClass;
+}