feat(client-cloudwatch-logs): This change adds support for account level data protection policies using 3 new APIs, PutAccountPolicy, DeleteAccountPolicy and DescribeAccountPolicy. DescribeLogGroup API has been modified to indicate if account level policy is applied to the LogGroup via "inheritedProperties" list in the response.

Author: awstools

clients/client-cloudwatch-logs/README.md

@@ -276,6 +276,14 @@ CreateLogStream
 
 [Command API Reference](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/clients/client-cloudwatch-logs/classes/createlogstreamcommand.html) / [Input](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/clients/client-cloudwatch-logs/interfaces/createlogstreamcommandinput.html) / [Output](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/clients/client-cloudwatch-logs/interfaces/createlogstreamcommandoutput.html)
 
+</details>
+<details>
+<summary>
+DeleteAccountPolicy
+</summary>
+
+[Command API Reference](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/clients/client-cloudwatch-logs/classes/deleteaccountpolicycommand.html) / [Input](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/clients/client-cloudwatch-logs/interfaces/deleteaccountpolicycommandinput.html) / [Output](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/clients/client-cloudwatch-logs/interfaces/deleteaccountpolicycommandoutput.html)
+
 </details>
 <details>
 <summary>
@@ -348,6 +356,14 @@ DeleteSubscriptionFilter
 
 [Command API Reference](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/clients/client-cloudwatch-logs/classes/deletesubscriptionfiltercommand.html) / [Input](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/clients/client-cloudwatch-logs/interfaces/deletesubscriptionfiltercommandinput.html) / [Output](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/clients/client-cloudwatch-logs/interfaces/deletesubscriptionfiltercommandoutput.html)
 
+</details>
+<details>
+<summary>
+DescribeAccountPolicies
+</summary>
+
+[Command API Reference](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/clients/client-cloudwatch-logs/classes/describeaccountpoliciescommand.html) / [Input](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/clients/client-cloudwatch-logs/interfaces/describeaccountpoliciescommandinput.html) / [Output](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/clients/client-cloudwatch-logs/interfaces/describeaccountpoliciescommandoutput.html)
+
 </details>
 <details>
 <summary>
@@ -492,6 +508,14 @@ ListTagsLogGroup
 
 [Command API Reference](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/clients/client-cloudwatch-logs/classes/listtagsloggroupcommand.html) / [Input](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/clients/client-cloudwatch-logs/interfaces/listtagsloggroupcommandinput.html) / [Output](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/clients/client-cloudwatch-logs/interfaces/listtagsloggroupcommandoutput.html)
 
+</details>
+<details>
+<summary>
+PutAccountPolicy
+</summary>
+
+[Command API Reference](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/clients/client-cloudwatch-logs/classes/putaccountpolicycommand.html) / [Input](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/clients/client-cloudwatch-logs/interfaces/putaccountpolicycommandinput.html) / [Output](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/clients/client-cloudwatch-logs/interfaces/putaccountpolicycommandoutput.html)
+
 </details>
 <details>
 <summary>

clients/client-cloudwatch-logs/src/CloudWatchLogs.ts

@@ -28,6 +28,11 @@ import {
   CreateLogStreamCommandInput,
   CreateLogStreamCommandOutput,
 } from "./commands/CreateLogStreamCommand";
+import {
+  DeleteAccountPolicyCommand,
+  DeleteAccountPolicyCommandInput,
+  DeleteAccountPolicyCommandOutput,
+} from "./commands/DeleteAccountPolicyCommand";
 import {
   DeleteDataProtectionPolicyCommand,
   DeleteDataProtectionPolicyCommandInput,
@@ -73,6 +78,11 @@ import {
   DeleteSubscriptionFilterCommandInput,
   DeleteSubscriptionFilterCommandOutput,
 } from "./commands/DeleteSubscriptionFilterCommand";
+import {
+  DescribeAccountPoliciesCommand,
+  DescribeAccountPoliciesCommandInput,
+  DescribeAccountPoliciesCommandOutput,
+} from "./commands/DescribeAccountPoliciesCommand";
 import {
   DescribeDestinationsCommand,
   DescribeDestinationsCommandInput,
@@ -163,6 +173,11 @@ import {
   ListTagsLogGroupCommandInput,
   ListTagsLogGroupCommandOutput,
 } from "./commands/ListTagsLogGroupCommand";
+import {
+  PutAccountPolicyCommand,
+  PutAccountPolicyCommandInput,
+  PutAccountPolicyCommandOutput,
+} from "./commands/PutAccountPolicyCommand";
 import {
   PutDataProtectionPolicyCommand,
   PutDataProtectionPolicyCommandInput,
@@ -234,6 +249,7 @@ const commands = {
   CreateExportTaskCommand,
   CreateLogGroupCommand,
   CreateLogStreamCommand,
+  DeleteAccountPolicyCommand,
   DeleteDataProtectionPolicyCommand,
   DeleteDestinationCommand,
   DeleteLogGroupCommand,
@@ -243,6 +259,7 @@ const commands = {
   DeleteResourcePolicyCommand,
   DeleteRetentionPolicyCommand,
   DeleteSubscriptionFilterCommand,
+  DescribeAccountPoliciesCommand,
   DescribeDestinationsCommand,
   DescribeExportTasksCommand,
   DescribeLogGroupsCommand,
@@ -261,6 +278,7 @@ const commands = {
   GetQueryResultsCommand,
   ListTagsForResourceCommand,
   ListTagsLogGroupCommand,
+  PutAccountPolicyCommand,
   PutDataProtectionPolicyCommand,
   PutDestinationCommand,
   PutDestinationPolicyCommand,
@@ -356,6 +374,23 @@ export interface CloudWatchLogs {
     cb: (err: any, data?: CreateLogStreamCommandOutput) => void
   ): void;
 
+  /**
+   * @see {@link DeleteAccountPolicyCommand}
+   */
+  deleteAccountPolicy(
+    args: DeleteAccountPolicyCommandInput,
+    options?: __HttpHandlerOptions
+  ): Promise<DeleteAccountPolicyCommandOutput>;
+  deleteAccountPolicy(
+    args: DeleteAccountPolicyCommandInput,
+    cb: (err: any, data?: DeleteAccountPolicyCommandOutput) => void
+  ): void;
+  deleteAccountPolicy(
+    args: DeleteAccountPolicyCommandInput,
+    options: __HttpHandlerOptions,
+    cb: (err: any, data?: DeleteAccountPolicyCommandOutput) => void
+  ): void;
+
   /**
    * @see {@link DeleteDataProtectionPolicyCommand}
    */
@@ -503,6 +538,23 @@ export interface CloudWatchLogs {
     cb: (err: any, data?: DeleteSubscriptionFilterCommandOutput) => void
   ): void;
 
+  /**
+   * @see {@link DescribeAccountPoliciesCommand}
+   */
+  describeAccountPolicies(
+    args: DescribeAccountPoliciesCommandInput,
+    options?: __HttpHandlerOptions
+  ): Promise<DescribeAccountPoliciesCommandOutput>;
+  describeAccountPolicies(
+    args: DescribeAccountPoliciesCommandInput,
+    cb: (err: any, data?: DescribeAccountPoliciesCommandOutput) => void
+  ): void;
+  describeAccountPolicies(
+    args: DescribeAccountPoliciesCommandInput,
+    options: __HttpHandlerOptions,
+    cb: (err: any, data?: DescribeAccountPoliciesCommandOutput) => void
+  ): void;
+
   /**
    * @see {@link DescribeDestinationsCommand}
    */
@@ -788,6 +840,23 @@ export interface CloudWatchLogs {
     cb: (err: any, data?: ListTagsLogGroupCommandOutput) => void
   ): void;
 
+  /**
+   * @see {@link PutAccountPolicyCommand}
+   */
+  putAccountPolicy(
+    args: PutAccountPolicyCommandInput,
+    options?: __HttpHandlerOptions
+  ): Promise<PutAccountPolicyCommandOutput>;
+  putAccountPolicy(
+    args: PutAccountPolicyCommandInput,
+    cb: (err: any, data?: PutAccountPolicyCommandOutput) => void
+  ): void;
+  putAccountPolicy(
+    args: PutAccountPolicyCommandInput,
+    options: __HttpHandlerOptions,
+    cb: (err: any, data?: PutAccountPolicyCommandOutput) => void
+  ): void;
+
   /**
    * @see {@link PutDataProtectionPolicyCommand}
    */

clients/client-cloudwatch-logs/src/CloudWatchLogsClient.ts

@@ -56,6 +56,10 @@ import { CancelExportTaskCommandInput, CancelExportTaskCommandOutput } from "./c
 import { CreateExportTaskCommandInput, CreateExportTaskCommandOutput } from "./commands/CreateExportTaskCommand";
 import { CreateLogGroupCommandInput, CreateLogGroupCommandOutput } from "./commands/CreateLogGroupCommand";
 import { CreateLogStreamCommandInput, CreateLogStreamCommandOutput } from "./commands/CreateLogStreamCommand";
+import {
+  DeleteAccountPolicyCommandInput,
+  DeleteAccountPolicyCommandOutput,
+} from "./commands/DeleteAccountPolicyCommand";
 import {
   DeleteDataProtectionPolicyCommandInput,
   DeleteDataProtectionPolicyCommandOutput,
@@ -80,6 +84,10 @@ import {
   DeleteSubscriptionFilterCommandInput,
   DeleteSubscriptionFilterCommandOutput,
 } from "./commands/DeleteSubscriptionFilterCommand";
+import {
+  DescribeAccountPoliciesCommandInput,
+  DescribeAccountPoliciesCommandOutput,
+} from "./commands/DescribeAccountPoliciesCommand";
 import {
   DescribeDestinationsCommandInput,
   DescribeDestinationsCommandOutput,
@@ -122,6 +130,7 @@ import {
   ListTagsForResourceCommandOutput,
 } from "./commands/ListTagsForResourceCommand";
 import { ListTagsLogGroupCommandInput, ListTagsLogGroupCommandOutput } from "./commands/ListTagsLogGroupCommand";
+import { PutAccountPolicyCommandInput, PutAccountPolicyCommandOutput } from "./commands/PutAccountPolicyCommand";
 import {
   PutDataProtectionPolicyCommandInput,
   PutDataProtectionPolicyCommandOutput,
@@ -166,6 +175,7 @@ export type ServiceInputTypes =
   | CreateExportTaskCommandInput
   | CreateLogGroupCommandInput
   | CreateLogStreamCommandInput
+  | DeleteAccountPolicyCommandInput
   | DeleteDataProtectionPolicyCommandInput
   | DeleteDestinationCommandInput
   | DeleteLogGroupCommandInput
@@ -175,6 +185,7 @@ export type ServiceInputTypes =
   | DeleteResourcePolicyCommandInput
   | DeleteRetentionPolicyCommandInput
   | DeleteSubscriptionFilterCommandInput
+  | DescribeAccountPoliciesCommandInput
   | DescribeDestinationsCommandInput
   | DescribeExportTasksCommandInput
   | DescribeLogGroupsCommandInput
@@ -193,6 +204,7 @@ export type ServiceInputTypes =
   | GetQueryResultsCommandInput
   | ListTagsForResourceCommandInput
   | ListTagsLogGroupCommandInput
+  | PutAccountPolicyCommandInput
   | PutDataProtectionPolicyCommandInput
   | PutDestinationCommandInput
   | PutDestinationPolicyCommandInput
@@ -219,6 +231,7 @@ export type ServiceOutputTypes =
   | CreateExportTaskCommandOutput
   | CreateLogGroupCommandOutput
   | CreateLogStreamCommandOutput
+  | DeleteAccountPolicyCommandOutput
   | DeleteDataProtectionPolicyCommandOutput
   | DeleteDestinationCommandOutput
   | DeleteLogGroupCommandOutput
@@ -228,6 +241,7 @@ export type ServiceOutputTypes =
   | DeleteResourcePolicyCommandOutput
   | DeleteRetentionPolicyCommandOutput
   | DeleteSubscriptionFilterCommandOutput
+  | DescribeAccountPoliciesCommandOutput
   | DescribeDestinationsCommandOutput
   | DescribeExportTasksCommandOutput
   | DescribeLogGroupsCommandOutput
@@ -246,6 +260,7 @@ export type ServiceOutputTypes =
   | GetQueryResultsCommandOutput
   | ListTagsForResourceCommandOutput
   | ListTagsLogGroupCommandOutput
+  | PutAccountPolicyCommandOutput
   | PutDataProtectionPolicyCommandOutput
   | PutDestinationCommandOutput
   | PutDestinationPolicyCommandOutput

clients/client-cloudwatch-logs/src/commands/CreateLogGroupCommand.ts

@@ -58,7 +58,7 @@ export interface CreateLogGroupCommandOutput extends __MetadataBearer {}
  *       encrypted using the KMS key. This association is stored as long as the data
  *       encrypted with the KMS key is still within CloudWatch Logs. This enables
  *         CloudWatch Logs to decrypt this data whenever it is requested.</p>
- *          <p>If you attempt to associate a KMS key with the log group but the KMS keydoes not exist or the KMS key is disabled, you receive an
+ *          <p>If you attempt to associate a KMS key with the log group but the KMS key does not exist or the KMS key is disabled, you receive an
  *         <code>InvalidParameterException</code> error. </p>
  *          <important>
  *             <p>CloudWatch Logs supports only symmetric KMS keys. Do not associate an