/*******************************************************************************
* Copyright 2010-2021 Amazon.com, Inc. or its affiliates. All Rights Reserved.
*
* Licensed under the Apache License, Version 2.0 (the "License").
* You may not use this file except in compliance with the License.
* A copy of the License is located at
*
* http://aws.amazon.com/apache2.0
*
* or in the "license" file accompanying this file. This file is distributed
* on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
* express or implied. See the License for the specific language governing
* permissions and limitations under the License.
*******************************************************************************/
package com.amazonaws.services.cloudtrail.processinglibrary.utils;
import com.amazonaws.services.cloudtrail.processinglibrary.model.internal.SourceType;
import java.util.regex.Pattern;
/**
* Identify the source type by checking the given source string and event name if applied. Specifically,
* the source
is usually the S3 object key and eventName
defined by Amazon S3.
* The following are valid source types: CloudTrailLog | Other
*/
public class SourceIdentifier {
private static final String CREATE_EVENT_PREFIX = "ObjectCreated:";
/**
* Regex for the name format of CloudTrail log file objects that deliver to AWS S3 bucket:
* AccountID_CloudTrail_RegionName_YYYYMMDDTHHmmZ_UniqueString.FileNameFormat
*
* We need this regex to filter out non-CloudTrail log files as it is possible that S3 send other object notifications
*/
private static final Pattern CT_LOGFILE_PATTERN = Pattern.compile(".+_CloudTrail_[\\w\\-]+_\\d{8}T\\d{4}Z_[\\w]+\\.json\\.gz");
/**
* Identify the source type.
* @param source the name of S3 object which is put to the bucket.
* @return {@link SourceType}
*/
public SourceType identify(String source) {
return getCloudTrailSourceType(source);
}
/**
* Identify the source type with event action.
* @param source the S3 object name
* @param eventName the event name defined by Amazon S3.
* @return {@link SourceType}
*/
public SourceType identifyWithEventName(String source, String eventName) {
if (eventName.startsWith(CREATE_EVENT_PREFIX)) {
return getCloudTrailSourceType(source);
}
return SourceType.Other;
}
private SourceType getCloudTrailSourceType(String source) {
if (CT_LOGFILE_PATTERN.matcher(source).matches()) {
return SourceType.CloudTrailLog;
}
return SourceType.Other;
}
}