CentralizationRuleForOrganization class

Manages an AWS CloudWatch Observability Admin Centralization Rule For Organization.

Centralization rules enable you to centralize log data from multiple AWS accounts and regions within your organization to a single destination account and region. This helps with log management, compliance, and cost optimization by consolidating logs in a central location.

This requires an AWS account within an organization with at least delegated administrator permissions.

Example Usage

Basic Centralization Rule

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const current = aws.getCallerIdentity({});
const currentGetOrganization = aws.organizations.getOrganization({});
const example = new aws.observabilityadmin.CentralizationRuleForOrganization("example", {
    rule: {
        destination: {
            region: "eu-west-1",
            account: current.then(current => current.accountId),
        },
        source: {
            sourceLogsConfiguration: {
                encryptedLogGroupStrategy: "SKIP",
                logGroupSelectionCriteria: "*",
            },
            regions: ["ap-southeast-1"],
            scope: currentGetOrganization.then(currentGetOrganization => `OrganizationId = '${currentGetOrganization.id}'`),
        },
    },
    ruleName: "example-centralization-rule",
    tags: {
        Name: "example-centralization-rule",
        Environment: "production",
    },
});

import pulumi
import pulumi_aws as aws

current = aws.get_caller_identity()
current_get_organization = aws.organizations.get_organization()
example = aws.observabilityadmin.CentralizationRuleForOrganization("example",
    rule={
        "destination": {
            "region": "eu-west-1",
            "account": current.account_id,
        },
        "source": {
            "source_logs_configuration": {
                "encrypted_log_group_strategy": "SKIP",
                "log_group_selection_criteria": "*",
            },
            "regions": ["ap-southeast-1"],
            "scope": f"OrganizationId = '{current_get_organization.id}'",
        },
    },
    rule_name="example-centralization-rule",
    tags={
        "Name": "example-centralization-rule",
        "Environment": "production",
    })

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;

return await Deployment.RunAsync(() =>
{
    var current = Aws.GetCallerIdentity.Invoke();

    var currentGetOrganization = Aws.Organizations.GetOrganization.Invoke();

    var example = new Aws.Observabilityadmin.CentralizationRuleForOrganization("example", new()
    {
        Rule = new Aws.Observabilityadmin.Inputs.CentralizationRuleForOrganizationRuleArgs
        {
            Destination = new Aws.Observabilityadmin.Inputs.CentralizationRuleForOrganizationRuleDestinationArgs
            {
                Region = "eu-west-1",
                Account = current.Apply(getCallerIdentityResult => getCallerIdentityResult.AccountId),
            },
            Source = new Aws.Observabilityadmin.Inputs.CentralizationRuleForOrganizationRuleSourceArgs
            {
                SourceLogsConfiguration = new Aws.Observabilityadmin.Inputs.CentralizationRuleForOrganizationRuleSourceSourceLogsConfigurationArgs
                {
                    EncryptedLogGroupStrategy = "SKIP",
                    LogGroupSelectionCriteria = "*",
                },
                Regions = new[]
                {
                    "ap-southeast-1",
                },
                Scope = $"OrganizationId = '{currentGetOrganization.Apply(getOrganizationResult => getOrganizationResult.Id)}'",
            },
        },
        RuleName = "example-centralization-rule",
        Tags =
        {
            { "Name", "example-centralization-rule" },
            { "Environment", "production" },
        },
    });

});

package main

import (
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws"
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/observabilityadmin"
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/organizations"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		current, err := aws.GetCallerIdentity(ctx, &aws.GetCallerIdentityArgs{}, nil)
		if err != nil {
			return err
		}
		currentGetOrganization, err := organizations.LookupOrganization(ctx, &organizations.LookupOrganizationArgs{}, nil)
		if err != nil {
			return err
		}
		_, err = observabilityadmin.NewCentralizationRuleForOrganization(ctx, "example", &observabilityadmin.CentralizationRuleForOrganizationArgs{
			Rule: &observabilityadmin.CentralizationRuleForOrganizationRuleArgs{
				Destination: &observabilityadmin.CentralizationRuleForOrganizationRuleDestinationArgs{
					Region:  pulumi.String("eu-west-1"),
					Account: pulumi.String(current.AccountId),
				},
				Source: &observabilityadmin.CentralizationRuleForOrganizationRuleSourceArgs{
					SourceLogsConfiguration: &observabilityadmin.CentralizationRuleForOrganizationRuleSourceSourceLogsConfigurationArgs{
						EncryptedLogGroupStrategy: pulumi.String("SKIP"),
						LogGroupSelectionCriteria: pulumi.String("*"),
					},
					Regions: pulumi.StringArray{
						pulumi.String("ap-southeast-1"),
					},
					Scope: pulumi.Sprintf("OrganizationId = '%v'", currentGetOrganization.Id),
				},
			},
			RuleName: pulumi.String("example-centralization-rule"),
			Tags: pulumi.StringMap{
				"Name":        pulumi.String("example-centralization-rule"),
				"Environment": pulumi.String("production"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

pulumi {
  required_providers {
    aws = {
      source = "pulumi/aws"
    }
  }
}

data "aws_getcalleridentity" "current" {
}
data "aws_organizations_getorganization" "currentGetOrganization" {
}

resource "aws_observabilityadmin_centralizationrulefororganization" "example" {
  rule = {
    destination = {
      region  = "eu-west-1"
      account = data.aws_getcalleridentity.current.account_id
    }
    source = {
      source_logs_configuration = {
        encrypted_log_group_strategy = "SKIP"
        log_group_selection_criteria = "*"
      }
      regions = ["ap-southeast-1"]
      scope   ="OrganizationId = '${data.aws_organizations_getorganization.currentGetOrganization.id}'"
    }
  }
  rule_name = "example-centralization-rule"
  tags = {
    "Name"        = "example-centralization-rule"
    "Environment" = "production"
  }
}

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.AwsFunctions;
import com.pulumi.aws.inputs.GetCallerIdentityArgs;
import com.pulumi.aws.organizations.OrganizationsFunctions;
import com.pulumi.aws.organizations.inputs.GetOrganizationArgs;
import com.pulumi.aws.observabilityadmin.CentralizationRuleForOrganization;
import com.pulumi.aws.observabilityadmin.CentralizationRuleForOrganizationArgs;
import com.pulumi.aws.observabilityadmin.inputs.CentralizationRuleForOrganizationRuleArgs;
import com.pulumi.aws.observabilityadmin.inputs.CentralizationRuleForOrganizationRuleDestinationArgs;
import com.pulumi.aws.observabilityadmin.inputs.CentralizationRuleForOrganizationRuleSourceArgs;
import com.pulumi.aws.observabilityadmin.inputs.CentralizationRuleForOrganizationRuleSourceSourceLogsConfigurationArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var current = AwsFunctions.getCallerIdentity(GetCallerIdentityArgs.builder()
            .build());

        final var currentGetOrganization = OrganizationsFunctions.getOrganization(GetOrganizationArgs.builder()
            .build());

        var example = new CentralizationRuleForOrganization("example", CentralizationRuleForOrganizationArgs.builder()
            .rule(CentralizationRuleForOrganizationRuleArgs.builder()
                .destination(CentralizationRuleForOrganizationRuleDestinationArgs.builder()
                    .region("eu-west-1")
                    .account(current.accountId())
                    .build())
                .source(CentralizationRuleForOrganizationRuleSourceArgs.builder()
                    .sourceLogsConfiguration(CentralizationRuleForOrganizationRuleSourceSourceLogsConfigurationArgs.builder()
                        .encryptedLogGroupStrategy("SKIP")
                        .logGroupSelectionCriteria("*")
                        .build())
                    .regions("ap-southeast-1")
                    .scope(String.format("OrganizationId = '%s'", currentGetOrganization.id()))
                    .build())
                .build())
            .ruleName("example-centralization-rule")
            .tags(Map.ofEntries(
                Map.entry("Name", "example-centralization-rule"),
                Map.entry("Environment", "production")
            ))
            .build());

    }
}

resources:
  example:
    type: aws:observabilityadmin:CentralizationRuleForOrganization
    properties:
      rule:
        destination:
          region: eu-west-1
          account: ${current.accountId}
        source:
          sourceLogsConfiguration:
            encryptedLogGroupStrategy: SKIP
            logGroupSelectionCriteria: '*'
          regions:
            - ap-southeast-1
          scope: OrganizationId = '${currentGetOrganization.id}'
      ruleName: example-centralization-rule
      tags:
        Name: example-centralization-rule
        Environment: production
variables:
  current:
    fn::invoke:
      function: aws:getCallerIdentity
      arguments: {}
  currentGetOrganization:
    fn::invoke:
      function: aws:organizations:getOrganization
      arguments: {}

Advanced Configuration with Encryption, Backup and Log Group Name Configuration

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const current = aws.getCallerIdentity({});
const currentGetOrganization = aws.organizations.getOrganization({});
const advanced = new aws.observabilityadmin.CentralizationRuleForOrganization("advanced", {
    rule: {
        destination: {
            destinationLogsConfiguration: {
                logsEncryptionConfiguration: {
                    encryptionStrategy: "AWS_OWNED",
                },
                backupConfiguration: {
                    region: "us-west-1",
                },
                logGroupNameConfiguration: {
                    logGroupNamePattern: "/centralized-logs/${source.accountId}/${source.region}/${source.logGroup}",
                },
            },
            region: "eu-west-1",
            account: current.then(current => current.accountId),
        },
        source: {
            sourceLogsConfiguration: {
                encryptedLogGroupStrategy: "ALLOW",
                logGroupSelectionCriteria: "*",
            },
            regions: [
                "ap-southeast-1",
                "us-east-1",
            ],
            scope: currentGetOrganization.then(currentGetOrganization => `OrganizationId = '${currentGetOrganization.id}'`),
        },
    },
    ruleName: "advanced-centralization-rule",
    tags: {
        Name: "advanced-centralization-rule",
        Environment: "production",
        Team: "observability",
    },
});

import pulumi
import pulumi_aws as aws

current = aws.get_caller_identity()
current_get_organization = aws.organizations.get_organization()
advanced = aws.observabilityadmin.CentralizationRuleForOrganization("advanced",
    rule={
        "destination": {
            "destination_logs_configuration": {
                "logs_encryption_configuration": {
                    "encryption_strategy": "AWS_OWNED",
                },
                "backup_configuration": {
                    "region": "us-west-1",
                },
                "log_group_name_configuration": {
                    "log_group_name_pattern": "/centralized-logs/${source.accountId}/${source.region}/${source.logGroup}",
                },
            },
            "region": "eu-west-1",
            "account": current.account_id,
        },
        "source": {
            "source_logs_configuration": {
                "encrypted_log_group_strategy": "ALLOW",
                "log_group_selection_criteria": "*",
            },
            "regions": [
                "ap-southeast-1",
                "us-east-1",
            ],
            "scope": f"OrganizationId = '{current_get_organization.id}'",
        },
    },
    rule_name="advanced-centralization-rule",
    tags={
        "Name": "advanced-centralization-rule",
        "Environment": "production",
        "Team": "observability",
    })

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;

return await Deployment.RunAsync(() =>
{
    var current = Aws.GetCallerIdentity.Invoke();

    var currentGetOrganization = Aws.Organizations.GetOrganization.Invoke();

    var advanced = new Aws.Observabilityadmin.CentralizationRuleForOrganization("advanced", new()
    {
        Rule = new Aws.Observabilityadmin.Inputs.CentralizationRuleForOrganizationRuleArgs
        {
            Destination = new Aws.Observabilityadmin.Inputs.CentralizationRuleForOrganizationRuleDestinationArgs
            {
                DestinationLogsConfiguration = new Aws.Observabilityadmin.Inputs.CentralizationRuleForOrganizationRuleDestinationDestinationLogsConfigurationArgs
                {
                    LogsEncryptionConfiguration = new Aws.Observabilityadmin.Inputs.CentralizationRuleForOrganizationRuleDestinationDestinationLogsConfigurationLogsEncryptionConfigurationArgs
                    {
                        EncryptionStrategy = "AWS_OWNED",
                    },
                    BackupConfiguration = new Aws.Observabilityadmin.Inputs.CentralizationRuleForOrganizationRuleDestinationDestinationLogsConfigurationBackupConfigurationArgs
                    {
                        Region = "us-west-1",
                    },
                    LogGroupNameConfiguration = new Aws.Observabilityadmin.Inputs.CentralizationRuleForOrganizationRuleDestinationDestinationLogsConfigurationLogGroupNameConfigurationArgs
                    {
                        LogGroupNamePattern = "/centralized-logs/${source.accountId}/${source.region}/${source.logGroup}",
                    },
                },
                Region = "eu-west-1",
                Account = current.Apply(getCallerIdentityResult => getCallerIdentityResult.AccountId),
            },
            Source = new Aws.Observabilityadmin.Inputs.CentralizationRuleForOrganizationRuleSourceArgs
            {
                SourceLogsConfiguration = new Aws.Observabilityadmin.Inputs.CentralizationRuleForOrganizationRuleSourceSourceLogsConfigurationArgs
                {
                    EncryptedLogGroupStrategy = "ALLOW",
                    LogGroupSelectionCriteria = "*",
                },
                Regions = new[]
                {
                    "ap-southeast-1",
                    "us-east-1",
                },
                Scope = $"OrganizationId = '{currentGetOrganization.Apply(getOrganizationResult => getOrganizationResult.Id)}'",
            },
        },
        RuleName = "advanced-centralization-rule",
        Tags =
        {
            { "Name", "advanced-centralization-rule" },
            { "Environment", "production" },
            { "Team", "observability" },
        },
    });

});

package main

import (
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws"
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/observabilityadmin"
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/organizations"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		current, err := aws.GetCallerIdentity(ctx, &aws.GetCallerIdentityArgs{}, nil)
		if err != nil {
			return err
		}
		currentGetOrganization, err := organizations.LookupOrganization(ctx, &organizations.LookupOrganizationArgs{}, nil)
		if err != nil {
			return err
		}
		_, err = observabilityadmin.NewCentralizationRuleForOrganization(ctx, "advanced", &observabilityadmin.CentralizationRuleForOrganizationArgs{
			Rule: &observabilityadmin.CentralizationRuleForOrganizationRuleArgs{
				Destination: &observabilityadmin.CentralizationRuleForOrganizationRuleDestinationArgs{
					DestinationLogsConfiguration: &observabilityadmin.CentralizationRuleForOrganizationRuleDestinationDestinationLogsConfigurationArgs{
						LogsEncryptionConfiguration: &observabilityadmin.CentralizationRuleForOrganizationRuleDestinationDestinationLogsConfigurationLogsEncryptionConfigurationArgs{
							EncryptionStrategy: pulumi.String("AWS_OWNED"),
						},
						BackupConfiguration: &observabilityadmin.CentralizationRuleForOrganizationRuleDestinationDestinationLogsConfigurationBackupConfigurationArgs{
							Region: pulumi.String("us-west-1"),
						},
						LogGroupNameConfiguration: &observabilityadmin.CentralizationRuleForOrganizationRuleDestinationDestinationLogsConfigurationLogGroupNameConfigurationArgs{
							LogGroupNamePattern: pulumi.String("/centralized-logs/${source.accountId}/${source.region}/${source.logGroup}"),
						},
					},
					Region:  pulumi.String("eu-west-1"),
					Account: pulumi.String(current.AccountId),
				},
				Source: &observabilityadmin.CentralizationRuleForOrganizationRuleSourceArgs{
					SourceLogsConfiguration: &observabilityadmin.CentralizationRuleForOrganizationRuleSourceSourceLogsConfigurationArgs{
						EncryptedLogGroupStrategy: pulumi.String("ALLOW"),
						LogGroupSelectionCriteria: pulumi.String("*"),
					},
					Regions: pulumi.StringArray{
						pulumi.String("ap-southeast-1"),
						pulumi.String("us-east-1"),
					},
					Scope: pulumi.Sprintf("OrganizationId = '%v'", currentGetOrganization.Id),
				},
			},
			RuleName: pulumi.String("advanced-centralization-rule"),
			Tags: pulumi.StringMap{
				"Name":        pulumi.String("advanced-centralization-rule"),
				"Environment": pulumi.String("production"),
				"Team":        pulumi.String("observability"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

pulumi {
  required_providers {
    aws = {
      source = "pulumi/aws"
    }
  }
}

data "aws_getcalleridentity" "current" {
}
data "aws_organizations_getorganization" "currentGetOrganization" {
}

resource "aws_observabilityadmin_centralizationrulefororganization" "advanced" {
  rule = {
    destination = {
      destination_logs_configuration = {
        logs_encryption_configuration = {
          encryption_strategy = "AWS_OWNED"
        }
        backup_configuration = {
          region = "us-west-1"
        }
        log_group_name_configuration = {
          log_group_name_pattern = "/centralized-logs/$${source.accountId}/$${source.region}/$${source.logGroup}"
        }
      }
      region  = "eu-west-1"
      account = data.aws_getcalleridentity.current.account_id
    }
    source = {
      source_logs_configuration = {
        encrypted_log_group_strategy = "ALLOW"
        log_group_selection_criteria = "*"
      }
      regions = ["ap-southeast-1", "us-east-1"]
      scope   ="OrganizationId = '${data.aws_organizations_getorganization.currentGetOrganization.id}'"
    }
  }
  rule_name = "advanced-centralization-rule"
  tags = {
    "Name"        = "advanced-centralization-rule"
    "Environment" = "production"
    "Team"        = "observability"
  }
}

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.AwsFunctions;
import com.pulumi.aws.inputs.GetCallerIdentityArgs;
import com.pulumi.aws.organizations.OrganizationsFunctions;
import com.pulumi.aws.organizations.inputs.GetOrganizationArgs;
import com.pulumi.aws.observabilityadmin.CentralizationRuleForOrganization;
import com.pulumi.aws.observabilityadmin.CentralizationRuleForOrganizationArgs;
import com.pulumi.aws.observabilityadmin.inputs.CentralizationRuleForOrganizationRuleArgs;
import com.pulumi.aws.observabilityadmin.inputs.CentralizationRuleForOrganizationRuleDestinationArgs;
import com.pulumi.aws.observabilityadmin.inputs.CentralizationRuleForOrganizationRuleDestinationDestinationLogsConfigurationArgs;
import com.pulumi.aws.observabilityadmin.inputs.CentralizationRuleForOrganizationRuleDestinationDestinationLogsConfigurationLogsEncryptionConfigurationArgs;
import com.pulumi.aws.observabilityadmin.inputs.CentralizationRuleForOrganizationRuleDestinationDestinationLogsConfigurationBackupConfigurationArgs;
import com.pulumi.aws.observabilityadmin.inputs.CentralizationRuleForOrganizationRuleDestinationDestinationLogsConfigurationLogGroupNameConfigurationArgs;
import com.pulumi.aws.observabilityadmin.inputs.CentralizationRuleForOrganizationRuleSourceArgs;
import com.pulumi.aws.observabilityadmin.inputs.CentralizationRuleForOrganizationRuleSourceSourceLogsConfigurationArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var current = AwsFunctions.getCallerIdentity(GetCallerIdentityArgs.builder()
            .build());

        final var currentGetOrganization = OrganizationsFunctions.getOrganization(GetOrganizationArgs.builder()
            .build());

        var advanced = new CentralizationRuleForOrganization("advanced", CentralizationRuleForOrganizationArgs.builder()
            .rule(CentralizationRuleForOrganizationRuleArgs.builder()
                .destination(CentralizationRuleForOrganizationRuleDestinationArgs.builder()
                    .destinationLogsConfiguration(CentralizationRuleForOrganizationRuleDestinationDestinationLogsConfigurationArgs.builder()
                        .logsEncryptionConfiguration(CentralizationRuleForOrganizationRuleDestinationDestinationLogsConfigurationLogsEncryptionConfigurationArgs.builder()
                            .encryptionStrategy("AWS_OWNED")
                            .build())
                        .backupConfiguration(CentralizationRuleForOrganizationRuleDestinationDestinationLogsConfigurationBackupConfigurationArgs.builder()
                            .region("us-west-1")
                            .build())
                        .logGroupNameConfiguration(CentralizationRuleForOrganizationRuleDestinationDestinationLogsConfigurationLogGroupNameConfigurationArgs.builder()
                            .logGroupNamePattern("/centralized-logs/${source.accountId}/${source.region}/${source.logGroup}")
                            .build())
                        .build())
                    .region("eu-west-1")
                    .account(current.accountId())
                    .build())
                .source(CentralizationRuleForOrganizationRuleSourceArgs.builder()
                    .sourceLogsConfiguration(CentralizationRuleForOrganizationRuleSourceSourceLogsConfigurationArgs.builder()
                        .encryptedLogGroupStrategy("ALLOW")
                        .logGroupSelectionCriteria("*")
                        .build())
                    .regions(
                        "ap-southeast-1",
                        "us-east-1")
                    .scope(String.format("OrganizationId = '%s'", currentGetOrganization.id()))
                    .build())
                .build())
            .ruleName("advanced-centralization-rule")
            .tags(Map.ofEntries(
                Map.entry("Name", "advanced-centralization-rule"),
                Map.entry("Environment", "production"),
                Map.entry("Team", "observability")
            ))
            .build());

    }
}

resources:
  advanced:
    type: aws:observabilityadmin:CentralizationRuleForOrganization
    properties:
      rule:
        destination:
          destinationLogsConfiguration:
            logsEncryptionConfiguration:
              encryptionStrategy: AWS_OWNED
            backupConfiguration:
              region: us-west-1
            logGroupNameConfiguration:
              logGroupNamePattern: /centralized-logs/$${source.accountId}/$${source.region}/$${source.logGroup}
          region: eu-west-1
          account: ${current.accountId}
        source:
          sourceLogsConfiguration:
            encryptedLogGroupStrategy: ALLOW
            logGroupSelectionCriteria: '*'
          regions:
            - ap-southeast-1
            - us-east-1
          scope: OrganizationId = '${currentGetOrganization.id}'
      ruleName: advanced-centralization-rule
      tags:
        Name: advanced-centralization-rule
        Environment: production
        Team: observability
variables:
  current:
    fn::invoke:
      function: aws:getCallerIdentity
      arguments: {}
  currentGetOrganization:
    fn::invoke:
      function: aws:organizations:getOrganization
      arguments: {}

Selective Log Group Filtering

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const current = aws.getCallerIdentity({});
const currentGetOrganization = aws.organizations.getOrganization({});
const filtered = new aws.observabilityadmin.CentralizationRuleForOrganization("filtered", {
    rule: {
        destination: {
            region: "eu-west-1",
            account: current.then(current => current.accountId),
        },
        source: {
            sourceLogsConfiguration: {
                encryptedLogGroupStrategy: "ALLOW",
                logGroupSelectionCriteria: "LogGroupName LIKE '/aws/lambda%'",
            },
            regions: [
                "ap-southeast-1",
                "us-east-1",
            ],
            scope: currentGetOrganization.then(currentGetOrganization => `OrganizationId = '${currentGetOrganization.id}'`),
        },
    },
    ruleName: "filtered-centralization-rule",
    tags: {
        Name: "filtered-centralization-rule",
        Filter: "lambda-logs",
    },
});

import pulumi
import pulumi_aws as aws

current = aws.get_caller_identity()
current_get_organization = aws.organizations.get_organization()
filtered = aws.observabilityadmin.CentralizationRuleForOrganization("filtered",
    rule={
        "destination": {
            "region": "eu-west-1",
            "account": current.account_id,
        },
        "source": {
            "source_logs_configuration": {
                "encrypted_log_group_strategy": "ALLOW",
                "log_group_selection_criteria": "LogGroupName LIKE '/aws/lambda%'",
            },
            "regions": [
                "ap-southeast-1",
                "us-east-1",
            ],
            "scope": f"OrganizationId = '{current_get_organization.id}'",
        },
    },
    rule_name="filtered-centralization-rule",
    tags={
        "Name": "filtered-centralization-rule",
        "Filter": "lambda-logs",
    })

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;

return await Deployment.RunAsync(() =>
{
    var current = Aws.GetCallerIdentity.Invoke();

    var currentGetOrganization = Aws.Organizations.GetOrganization.Invoke();

    var filtered = new Aws.Observabilityadmin.CentralizationRuleForOrganization("filtered", new()
    {
        Rule = new Aws.Observabilityadmin.Inputs.CentralizationRuleForOrganizationRuleArgs
        {
            Destination = new Aws.Observabilityadmin.Inputs.CentralizationRuleForOrganizationRuleDestinationArgs
            {
                Region = "eu-west-1",
                Account = current.Apply(getCallerIdentityResult => getCallerIdentityResult.AccountId),
            },
            Source = new Aws.Observabilityadmin.Inputs.CentralizationRuleForOrganizationRuleSourceArgs
            {
                SourceLogsConfiguration = new Aws.Observabilityadmin.Inputs.CentralizationRuleForOrganizationRuleSourceSourceLogsConfigurationArgs
                {
                    EncryptedLogGroupStrategy = "ALLOW",
                    LogGroupSelectionCriteria = "LogGroupName LIKE '/aws/lambda%'",
                },
                Regions = new[]
                {
                    "ap-southeast-1",
                    "us-east-1",
                },
                Scope = $"OrganizationId = '{currentGetOrganization.Apply(getOrganizationResult => getOrganizationResult.Id)}'",
            },
        },
        RuleName = "filtered-centralization-rule",
        Tags =
        {
            { "Name", "filtered-centralization-rule" },
            { "Filter", "lambda-logs" },
        },
    });

});

package main

import (
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws"
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/observabilityadmin"
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/organizations"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		current, err := aws.GetCallerIdentity(ctx, &aws.GetCallerIdentityArgs{}, nil)
		if err != nil {
			return err
		}
		currentGetOrganization, err := organizations.LookupOrganization(ctx, &organizations.LookupOrganizationArgs{}, nil)
		if err != nil {
			return err
		}
		_, err = observabilityadmin.NewCentralizationRuleForOrganization(ctx, "filtered", &observabilityadmin.CentralizationRuleForOrganizationArgs{
			Rule: &observabilityadmin.CentralizationRuleForOrganizationRuleArgs{
				Destination: &observabilityadmin.CentralizationRuleForOrganizationRuleDestinationArgs{
					Region:  pulumi.String("eu-west-1"),
					Account: pulumi.String(current.AccountId),
				},
				Source: &observabilityadmin.CentralizationRuleForOrganizationRuleSourceArgs{
					SourceLogsConfiguration: &observabilityadmin.CentralizationRuleForOrganizationRuleSourceSourceLogsConfigurationArgs{
						EncryptedLogGroupStrategy: pulumi.String("ALLOW"),
						LogGroupSelectionCriteria: pulumi.String("LogGroupName LIKE '/aws/lambda%'"),
					},
					Regions: pulumi.StringArray{
						pulumi.String("ap-southeast-1"),
						pulumi.String("us-east-1"),
					},
					Scope: pulumi.Sprintf("OrganizationId = '%v'", currentGetOrganization.Id),
				},
			},
			RuleName: pulumi.String("filtered-centralization-rule"),
			Tags: pulumi.StringMap{
				"Name":   pulumi.String("filtered-centralization-rule"),
				"Filter": pulumi.String("lambda-logs"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

pulumi {
  required_providers {
    aws = {
      source = "pulumi/aws"
    }
  }
}

data "aws_getcalleridentity" "current" {
}
data "aws_organizations_getorganization" "currentGetOrganization" {
}

resource "aws_observabilityadmin_centralizationrulefororganization" "filtered" {
  rule = {
    destination = {
      region  = "eu-west-1"
      account = data.aws_getcalleridentity.current.account_id
    }
    source = {
      source_logs_configuration = {
        encrypted_log_group_strategy = "ALLOW"
        log_group_selection_criteria = "LogGroupName LIKE '/aws/lambda%'"
      }
      regions = ["ap-southeast-1", "us-east-1"]
      scope   ="OrganizationId = '${data.aws_organizations_getorganization.currentGetOrganization.id}'"
    }
  }
  rule_name = "filtered-centralization-rule"
  tags = {
    "Name"   = "filtered-centralization-rule"
    "Filter" = "lambda-logs"
  }
}

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.AwsFunctions;
import com.pulumi.aws.inputs.GetCallerIdentityArgs;
import com.pulumi.aws.organizations.OrganizationsFunctions;
import com.pulumi.aws.organizations.inputs.GetOrganizationArgs;
import com.pulumi.aws.observabilityadmin.CentralizationRuleForOrganization;
import com.pulumi.aws.observabilityadmin.CentralizationRuleForOrganizationArgs;
import com.pulumi.aws.observabilityadmin.inputs.CentralizationRuleForOrganizationRuleArgs;
import com.pulumi.aws.observabilityadmin.inputs.CentralizationRuleForOrganizationRuleDestinationArgs;
import com.pulumi.aws.observabilityadmin.inputs.CentralizationRuleForOrganizationRuleSourceArgs;
import com.pulumi.aws.observabilityadmin.inputs.CentralizationRuleForOrganizationRuleSourceSourceLogsConfigurationArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var current = AwsFunctions.getCallerIdentity(GetCallerIdentityArgs.builder()
            .build());

        final var currentGetOrganization = OrganizationsFunctions.getOrganization(GetOrganizationArgs.builder()
            .build());

        var filtered = new CentralizationRuleForOrganization("filtered", CentralizationRuleForOrganizationArgs.builder()
            .rule(CentralizationRuleForOrganizationRuleArgs.builder()
                .destination(CentralizationRuleForOrganizationRuleDestinationArgs.builder()
                    .region("eu-west-1")
                    .account(current.accountId())
                    .build())
                .source(CentralizationRuleForOrganizationRuleSourceArgs.builder()
                    .sourceLogsConfiguration(CentralizationRuleForOrganizationRuleSourceSourceLogsConfigurationArgs.builder()
                        .encryptedLogGroupStrategy("ALLOW")
                        .logGroupSelectionCriteria("LogGroupName LIKE '/aws/lambda%'")
                        .build())
                    .regions(
                        "ap-southeast-1",
                        "us-east-1")
                    .scope(String.format("OrganizationId = '%s'", currentGetOrganization.id()))
                    .build())
                .build())
            .ruleName("filtered-centralization-rule")
            .tags(Map.ofEntries(
                Map.entry("Name", "filtered-centralization-rule"),
                Map.entry("Filter", "lambda-logs")
            ))
            .build());

    }
}

resources:
  filtered:
    type: aws:observabilityadmin:CentralizationRuleForOrganization
    properties:
      rule:
        destination:
          region: eu-west-1
          account: ${current.accountId}
        source:
          sourceLogsConfiguration:
            encryptedLogGroupStrategy: ALLOW
            logGroupSelectionCriteria: LogGroupName LIKE '/aws/lambda%'
          regions:
            - ap-southeast-1
            - us-east-1
          scope: OrganizationId = '${currentGetOrganization.id}'
      ruleName: filtered-centralization-rule
      tags:
        Name: filtered-centralization-rule
        Filter: lambda-logs
variables:
  current:
    fn::invoke:
      function: aws:getCallerIdentity
      arguments: {}
  currentGetOrganization:
    fn::invoke:
      function: aws:organizations:getOrganization
      arguments: {}

Metrics Centralization with Backup

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const current = aws.getCallerIdentity({});
const currentGetOrganization = aws.organizations.getOrganization({});
const metrics = new aws.observabilityadmin.CentralizationRuleForOrganization("metrics", {
    rule: {
        destination: {
            destinationMetricsConfiguration: {
                backupConfiguration: {
                    region: "us-west-1",
                },
            },
            region: "eu-west-1",
            account: current.then(current => current.accountId),
        },
        source: {
            sourceMetricsConfiguration: {
                metricsSelectionCriteria: "*",
            },
            regions: [
                "ap-southeast-1",
                "us-east-1",
            ],
            scope: currentGetOrganization.then(currentGetOrganization => `OrganizationId = '${currentGetOrganization.id}'`),
        },
    },
    ruleName: "metrics-centralization-rule",
});

import pulumi
import pulumi_aws as aws

current = aws.get_caller_identity()
current_get_organization = aws.organizations.get_organization()
metrics = aws.observabilityadmin.CentralizationRuleForOrganization("metrics",
    rule={
        "destination": {
            "destination_metrics_configuration": {
                "backup_configuration": {
                    "region": "us-west-1",
                },
            },
            "region": "eu-west-1",
            "account": current.account_id,
        },
        "source": {
            "source_metrics_configuration": {
                "metrics_selection_criteria": "*",
            },
            "regions": [
                "ap-southeast-1",
                "us-east-1",
            ],
            "scope": f"OrganizationId = '{current_get_organization.id}'",
        },
    },
    rule_name="metrics-centralization-rule")

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;

return await Deployment.RunAsync(() =>
{
    var current = Aws.GetCallerIdentity.Invoke();

    var currentGetOrganization = Aws.Organizations.GetOrganization.Invoke();

    var metrics = new Aws.Observabilityadmin.CentralizationRuleForOrganization("metrics", new()
    {
        Rule = new Aws.Observabilityadmin.Inputs.CentralizationRuleForOrganizationRuleArgs
        {
            Destination = new Aws.Observabilityadmin.Inputs.CentralizationRuleForOrganizationRuleDestinationArgs
            {
                DestinationMetricsConfiguration = new Aws.Observabilityadmin.Inputs.CentralizationRuleForOrganizationRuleDestinationDestinationMetricsConfigurationArgs
                {
                    BackupConfiguration = new Aws.Observabilityadmin.Inputs.CentralizationRuleForOrganizationRuleDestinationDestinationMetricsConfigurationBackupConfigurationArgs
                    {
                        Region = "us-west-1",
                    },
                },
                Region = "eu-west-1",
                Account = current.Apply(getCallerIdentityResult => getCallerIdentityResult.AccountId),
            },
            Source = new Aws.Observabilityadmin.Inputs.CentralizationRuleForOrganizationRuleSourceArgs
            {
                SourceMetricsConfiguration = new Aws.Observabilityadmin.Inputs.CentralizationRuleForOrganizationRuleSourceSourceMetricsConfigurationArgs
                {
                    MetricsSelectionCriteria = "*",
                },
                Regions = new[]
                {
                    "ap-southeast-1",
                    "us-east-1",
                },
                Scope = $"OrganizationId = '{currentGetOrganization.Apply(getOrganizationResult => getOrganizationResult.Id)}'",
            },
        },
        RuleName = "metrics-centralization-rule",
    });

});

package main

import (
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws"
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/observabilityadmin"
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/organizations"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		current, err := aws.GetCallerIdentity(ctx, &aws.GetCallerIdentityArgs{}, nil)
		if err != nil {
			return err
		}
		currentGetOrganization, err := organizations.LookupOrganization(ctx, &organizations.LookupOrganizationArgs{}, nil)
		if err != nil {
			return err
		}
		_, err = observabilityadmin.NewCentralizationRuleForOrganization(ctx, "metrics", &observabilityadmin.CentralizationRuleForOrganizationArgs{
			Rule: &observabilityadmin.CentralizationRuleForOrganizationRuleArgs{
				Destination: &observabilityadmin.CentralizationRuleForOrganizationRuleDestinationArgs{
					DestinationMetricsConfiguration: &observabilityadmin.CentralizationRuleForOrganizationRuleDestinationDestinationMetricsConfigurationArgs{
						BackupConfiguration: &observabilityadmin.CentralizationRuleForOrganizationRuleDestinationDestinationMetricsConfigurationBackupConfigurationArgs{
							Region: pulumi.String("us-west-1"),
						},
					},
					Region:  pulumi.String("eu-west-1"),
					Account: pulumi.String(current.AccountId),
				},
				Source: &observabilityadmin.CentralizationRuleForOrganizationRuleSourceArgs{
					SourceMetricsConfiguration: &observabilityadmin.CentralizationRuleForOrganizationRuleSourceSourceMetricsConfigurationArgs{
						MetricsSelectionCriteria: pulumi.String("*"),
					},
					Regions: pulumi.StringArray{
						pulumi.String("ap-southeast-1"),
						pulumi.String("us-east-1"),
					},
					Scope: pulumi.Sprintf("OrganizationId = '%v'", currentGetOrganization.Id),
				},
			},
			RuleName: pulumi.String("metrics-centralization-rule"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

pulumi {
  required_providers {
    aws = {
      source = "pulumi/aws"
    }
  }
}

data "aws_getcalleridentity" "current" {
}
data "aws_organizations_getorganization" "currentGetOrganization" {
}

resource "aws_observabilityadmin_centralizationrulefororganization" "metrics" {
  rule = {
    destination = {
      destination_metrics_configuration = {
        backup_configuration = {
          region = "us-west-1"
        }
      }
      region  = "eu-west-1"
      account = data.aws_getcalleridentity.current.account_id
    }
    source = {
      source_metrics_configuration = {
        metrics_selection_criteria = "*"
      }
      regions = ["ap-southeast-1", "us-east-1"]
      scope   ="OrganizationId = '${data.aws_organizations_getorganization.currentGetOrganization.id}'"
    }
  }
  rule_name = "metrics-centralization-rule"
}

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.AwsFunctions;
import com.pulumi.aws.inputs.GetCallerIdentityArgs;
import com.pulumi.aws.organizations.OrganizationsFunctions;
import com.pulumi.aws.organizations.inputs.GetOrganizationArgs;
import com.pulumi.aws.observabilityadmin.CentralizationRuleForOrganization;
import com.pulumi.aws.observabilityadmin.CentralizationRuleForOrganizationArgs;
import com.pulumi.aws.observabilityadmin.inputs.CentralizationRuleForOrganizationRuleArgs;
import com.pulumi.aws.observabilityadmin.inputs.CentralizationRuleForOrganizationRuleDestinationArgs;
import com.pulumi.aws.observabilityadmin.inputs.CentralizationRuleForOrganizationRuleDestinationDestinationMetricsConfigurationArgs;
import com.pulumi.aws.observabilityadmin.inputs.CentralizationRuleForOrganizationRuleDestinationDestinationMetricsConfigurationBackupConfigurationArgs;
import com.pulumi.aws.observabilityadmin.inputs.CentralizationRuleForOrganizationRuleSourceArgs;
import com.pulumi.aws.observabilityadmin.inputs.CentralizationRuleForOrganizationRuleSourceSourceMetricsConfigurationArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var current = AwsFunctions.getCallerIdentity(GetCallerIdentityArgs.builder()
            .build());

        final var currentGetOrganization = OrganizationsFunctions.getOrganization(GetOrganizationArgs.builder()
            .build());

        var metrics = new CentralizationRuleForOrganization("metrics", CentralizationRuleForOrganizationArgs.builder()
            .rule(CentralizationRuleForOrganizationRuleArgs.builder()
                .destination(CentralizationRuleForOrganizationRuleDestinationArgs.builder()
                    .destinationMetricsConfiguration(CentralizationRuleForOrganizationRuleDestinationDestinationMetricsConfigurationArgs.builder()
                        .backupConfiguration(CentralizationRuleForOrganizationRuleDestinationDestinationMetricsConfigurationBackupConfigurationArgs.builder()
                            .region("us-west-1")
                            .build())
                        .build())
                    .region("eu-west-1")
                    .account(current.accountId())
                    .build())
                .source(CentralizationRuleForOrganizationRuleSourceArgs.builder()
                    .sourceMetricsConfiguration(CentralizationRuleForOrganizationRuleSourceSourceMetricsConfigurationArgs.builder()
                        .metricsSelectionCriteria("*")
                        .build())
                    .regions(
                        "ap-southeast-1",
                        "us-east-1")
                    .scope(String.format("OrganizationId = '%s'", currentGetOrganization.id()))
                    .build())
                .build())
            .ruleName("metrics-centralization-rule")
            .build());

    }
}

resources:
  metrics:
    type: aws:observabilityadmin:CentralizationRuleForOrganization
    properties:
      rule:
        destination:
          destinationMetricsConfiguration:
            backupConfiguration:
              region: us-west-1
          region: eu-west-1
          account: ${current.accountId}
        source:
          sourceMetricsConfiguration:
            metricsSelectionCriteria: '*'
          regions:
            - ap-southeast-1
            - us-east-1
          scope: OrganizationId = '${currentGetOrganization.id}'
      ruleName: metrics-centralization-rule
variables:
  current:
    fn::invoke:
      function: aws:getCallerIdentity
      arguments: {}
  currentGetOrganization:
    fn::invoke:
      function: aws:organizations:getOrganization
      arguments: {}

Import

Using pulumi import, import CloudWatch Observability Admin Centralization Rule For Organization using the ruleName. For example:

$ pulumi import aws:observabilityadmin/centralizationRuleForOrganization:CentralizationRuleForOrganization example example-centralization-rule