in athena_glue_service_logs/cloudtrail.py [0:0]
def _build_storage_descriptor(self, partition_values=None):
if partition_values is None:
partition_values = []
return {
"Columns": [
{
"Type": "string",
"Name": "eventversion"
},
{
"Type": "struct<type:string,principalId:string,arn:string,accountId:string,accessKeyId:string,sessionContext:struct<attributes:struct<mfaAuthenticated:string,creationDate:string>,sessionIssuer:struct<type:string,principalId:string,arn:string,accountId:string,userName:string>>,invokedBy:string,userName:string>", # noqa pylint: disable=line-too-long
"Name": "useridentity"
},
{
"Type": "string",
"Name": "eventtime"
},
{
"Type": "string",
"Name": "eventsource"
},
{
"Type": "string",
"Name": "eventname"
},
{
"Type": "string",
"Name": "awsregion"
},
{
"Type": "string",
"Name": "sourceipaddress"
},
{
"Type": "string",
"Name": "useragent"
},
{
"Type": "struct<maxResults:int,instancesSet:string,filterSet:struct<items:array<struct<name:string,valueSet:struct<items:array<struct<value:string>>>>>>,bucketName:string,location:array<string>,policy:array<string>,acl:array<string>,logging:array<string>,maxRecords:int,securityGroupSet:string,securityGroupIdSet:string,spotInstanceRequestIdSet:string,volumeSet:string,trailNameList:array<string>,includeShadowTrails:boolean,CreateBucketConfiguration:struct<LocationConstraint:string,xmlns:string>,AccessControlPolicy:struct<AccessControlList:struct<Grant:array<struct<Grantee:struct<xsi\\:type:string,DisplayName:string,xmlns\\:xsi:string,ID:string,URI:string>,Permission:string>>>,xmlns:string,Owner:struct<DisplayName:string,ID:string>>,limit:int>", # noqa pylint: disable=line-too-long
"Name": "requestparameters"
},
{
"Type": "struct<clusters:array<string>,snapshots:array<string>>",
"Name": "responseelements"
},
{
"Type": "string",
"Name": "requestid"
},
{
"Type": "string",
"Name": "eventid"
},
{
"Type": "string",
"Name": "eventtype"
},
{
"Type": "string",
"Name": "recipientaccountid"
},
{
"Type": "string",
"Name": "errorcode"
},
{
"Type": "string",
"Name": "errormessage"
},
{
"Type": "string",
"Name": "apiversion"
},
{
"Type": "struct<vpcEndpointId:string>",
"Name": "additionaleventdata"
},
{
"Type": "string",
"Name": "vpcendpointid"
},
{
"Type": "boolean",
"Name": "readonly"
},
{
"Type": "array<string>",
"Name": "resources"
}
],
"Location": self.partitioner.build_partitioned_path(partition_values),
"SerdeInfo": {
"Parameters": {}
},
"BucketColumns": [], # Required or SHOW CREATE TABLE fails
"Parameters": {
"classification": "cloudtrail",
"compressionType": "gzip",
"jsonPath": "$.Records[*]",
}
}