Provides the WazuhWodleAwsS3BucketConfiguration which allows to parse the buckets subsection of the aws-s3 section of the Wazuh local configuration (ossec.conf).

class WazuhWodleAwsS3BucketConfiguration(**kwargs)

Bases: object

Object representation of an agent’s aws-s3 wodle configuration’s buckets section.

Wazuh reference: https://documentation.wazuh.com/current/user-manual/reference/ossec-conf/wodle-s3.html#buckets

access_key: str | None

*Deprecated since version 4.4.0*

The access key ID of the IAM user.

aws_account_alias: str | None

Name for the AWS account.

aws_account_id: str | None

The ID of the AWS Account, which is used to request the logs.

aws_organization_id: str | None

Name of the AWS organization.

aws_profile: str | None

Shared Credential profile name.

discard_regex: str | None

Regular expression which causes events to be discarded when matched.

iam_role_arn: str | None

Role ARN.

iam_role_duration: str | None

Expiration time in seconds for which a session with the assumed role is valid.

name: str | None

Name of the S3 bucket from where logs are read.

only_logs_after: str | None

Date in the format YYYY-MMM-DD from which logs will be requested onward.

path: str | None

Prefixed bucket path.

path_suffix: str | None

Suffixed bucket path.

regions: list[str]

List of regions the logs are being collected for.

remove_from_bucket: bool

Indicates whether collected logs will be deleted after they have been collected.

secret_key: str | None

*Deprecated since version 4.4.0*

The secret key of the IAM user.

service_endpoint: str | None

URL of the AWS S3 endpoint.

sts_endpoint: str | None

URL of the AWS Security Token Service VPC endpoint.

type: str | None

Type of the configured service.

On this page