Create, update, and manage event data stores with the AWS CLI
Note
AWS CloudTrail Lake will no longer be open to new customers starting May 31, 2026. If you would like to use CloudTrail Lake, sign up prior to that date. Existing customers can continue to use the service as normal. For more information, see CloudTrail Lake availability change.
This section describes the AWS CLI commands you can use to create, update, and manage your CloudTrail Lake event data stores.
When using the AWS CLI, remember that your commands run in the AWS Region configured for your profile. If you want to run the commands in a different Region, either change the default Region for your profile, or use the --region parameter with the command.
Available commands for event data stores
Commands for creating and updating event data stores in CloudTrail Lake include:
-
create-event-data-storeto create an event data store. -
get-event-data-storeto return information about the event data store including the advanced event selectors configured for the event data store. -
update-event-data-storeto change the configuration of an existing event data store. -
list-event-data-storesto list the event data stores. -
delete-event-data-storeto delete an event data store. -
restore-event-data-storeto restore an event data store that is pending deletion. -
start-importto start an import of trail events to an event data store, or retry a failed import. -
get-importto return information about a specific import. -
stop-importto stop an import of trail events to an event data store. -
list-importsto return information on all imports, or a select set of imports byImportStatusorDestination. -
list-import-failuresto list import failures for the specified import. -
stop-event-data-store-ingestionto stop event ingestion on an event data store. -
start-event-data-store-ingestionto restart event ingestion on an event data store. -
enable-federationto enable federation on an event data store to query the event data store in Amazon Athena. -
disable-federationto disable federation on an event data store. After you disable federation, you can no longer query against the event data store's data in Amazon Athena. You can continue to query in CloudTrail Lake. -
put-insight-selectorsto add or modify Insights event selectors for an existing event data store, and enable or disable Insights events. -
get-insight-selectorsto return information about Insights event selectors configured for an event data store. -
add-tagsto add one or more tags (key-value pairs) to an existing event data store. -
remove-tagsto remove one or more tags from a event data store. -
list-tagsto return a list of tags associated with a event data store. -
get-event-configuration to return any resource tag keys and IAM global conditions keys configured for the event data store. The command also returns whether the event data store is configured to collect
Standardsize events orLargesize events. -
put-event-configuration to expand the event size and add or remove resource tag keys and IAM global condition keys. For more information, see Enrich CloudTrail events by adding resource tag keys and IAM global condition keys.
-
put-resource-policyto attach a resource-based policy to an event data store. Resource-based polices allow you to control which principals can perform actions on your event data store. For example policies, see Resource-based policy examples for event data stores. -
get-resource-policyto get the resource-based policy attached to an event data store. -
delete-resource-policyto delete the resource-based policy attached to an event data store.
For a list of available commands for CloudTrail Lake queries, see Available commands for CloudTrail Lake queries.
For a list of available commands for CloudTrail Lake dashboards, see Available commands for dashboards.
For a list of available commands for CloudTrail Lake integrations, see Available commands for CloudTrail Lake integrations.
