SessionLogger class

Resource for managing an AWS WorkSpaces Web Session Logger.

Example Usage

Basic Usage

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const exampleBucket = new aws.s3.Bucket("example", {bucket: "example-session-logs"});
const example = aws.iam.getPolicyDocumentOutput({
    statements: [{
        principals: [{
            type: "Service",
            identifiers: ["workspaces-web.amazonaws.com"],
        }],
        effect: "Allow",
        actions: ["s3:PutObject"],
        resources: [pulumi.interpolate`${exampleBucket.arn}/*`],
    }],
});
const exampleBucketPolicy = new aws.s3.BucketPolicy("example", {
    bucket: exampleBucket.id,
    policy: example.json,
});
const exampleSessionLogger = new aws.workspacesweb.SessionLogger("example", {
    eventFilter: {
        all: {},
    },
    logConfiguration: {
        s3: {
            bucket: exampleBucket.id,
            folderStructure: "Flat",
            logFileFormat: "Json",
        },
    },
    displayName: "example-session-logger",
}, {
    dependsOn: [exampleBucketPolicy],
});

import pulumi
import pulumi_aws as aws

example_bucket = aws.s3.Bucket("example", bucket="example-session-logs")
example = aws.iam.get_policy_document_output(statements=[{
    "principals": [{
        "type": "Service",
        "identifiers": ["workspaces-web.amazonaws.com"],
    }],
    "effect": "Allow",
    "actions": ["s3:PutObject"],
    "resources": [example_bucket.arn.apply(lambda arn: f"{arn}/*")],
}])
example_bucket_policy = aws.s3.BucketPolicy("example",
    bucket=example_bucket.id,
    policy=example.json)
example_session_logger = aws.workspacesweb.SessionLogger("example",
    event_filter={
        "all": {},
    },
    log_configuration={
        "s3": {
            "bucket": example_bucket.id,
            "folder_structure": "Flat",
            "log_file_format": "Json",
        },
    },
    display_name="example-session-logger",
    opts = pulumi.ResourceOptions(depends_on=[example_bucket_policy]))

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;

return await Deployment.RunAsync(() =>
{
    var exampleBucket = new Aws.S3.Bucket("example", new()
    {
        BucketName = "example-session-logs",
    });

    var example = Aws.Iam.GetPolicyDocument.Invoke(new()
    {
        Statements = new[]
        {
            new Aws.Iam.Inputs.GetPolicyDocumentStatementInputArgs
            {
                Principals = new[]
                {
                    new Aws.Iam.Inputs.GetPolicyDocumentStatementPrincipalInputArgs
                    {
                        Type = "Service",
                        Identifiers = new[]
                        {
                            "workspaces-web.amazonaws.com",
                        },
                    },
                },
                Effect = "Allow",
                Actions = new[]
                {
                    "s3:PutObject",
                },
                Resources = new[]
                {
                    $"{exampleBucket.Arn}/*",
                },
            },
        },
    });

    var exampleBucketPolicy = new Aws.S3.BucketPolicy("example", new()
    {
        Bucket = exampleBucket.Id,
        Policy = example.Apply(getPolicyDocumentResult => getPolicyDocumentResult.Json),
    });

    var exampleSessionLogger = new Aws.WorkSpacesWeb.SessionLogger("example", new()
    {
        EventFilter = new Aws.WorkSpacesWeb.Inputs.SessionLoggerEventFilterArgs
        {
            All = null,
        },
        LogConfiguration = new Aws.WorkSpacesWeb.Inputs.SessionLoggerLogConfigurationArgs
        {
            S3 = new Aws.WorkSpacesWeb.Inputs.SessionLoggerLogConfigurationS3Args
            {
                Bucket = exampleBucket.Id,
                FolderStructure = "Flat",
                LogFileFormat = "Json",
            },
        },
        DisplayName = "example-session-logger",
    }, new CustomResourceOptions
    {
        DependsOn =
        {
            exampleBucketPolicy,
        },
    });

});

package main

import (
	"fmt"

	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/iam"
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/s3"
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/workspacesweb"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		exampleBucket, err := s3.NewBucket(ctx, "example", &s3.BucketArgs{
			Bucket: pulumi.String("example-session-logs"),
		})
		if err != nil {
			return err
		}
		example := iam.GetPolicyDocumentOutput(ctx, iam.GetPolicyDocumentOutputArgs{
			Statements: iam.GetPolicyDocumentStatementArray{
				&iam.GetPolicyDocumentStatementArgs{
					Principals: iam.GetPolicyDocumentStatementPrincipalArray{
						&iam.GetPolicyDocumentStatementPrincipalArgs{
							Type: pulumi.String("Service"),
							Identifiers: pulumi.StringArray{
								pulumi.String("workspaces-web.amazonaws.com"),
							},
						},
					},
					Effect: pulumi.String("Allow"),
					Actions: pulumi.StringArray{
						pulumi.String("s3:PutObject"),
					},
					Resources: pulumi.StringArray{
						exampleBucket.Arn.ApplyT(func(arn string) (string, error) {
							return fmt.Sprintf("%v/*", arn), nil
						}).(pulumi.StringOutput),
					},
				},
			},
		}, nil)
		exampleBucketPolicy, err := s3.NewBucketPolicy(ctx, "example", &s3.BucketPolicyArgs{
			Bucket: exampleBucket.ID().ToIDOutput().ToStringOutput(),
			Policy: example.Json(),
		})
		if err != nil {
			return err
		}
		_, err = workspacesweb.NewSessionLogger(ctx, "example", &workspacesweb.SessionLoggerArgs{
			EventFilter: &workspacesweb.SessionLoggerEventFilterArgs{
				All: &workspacesweb.SessionLoggerEventFilterAllArgs{},
			},
			LogConfiguration: &workspacesweb.SessionLoggerLogConfigurationArgs{
				S3: &workspacesweb.SessionLoggerLogConfigurationS3Args{
					Bucket:          exampleBucket.ID().ToIDOutput().ToStringOutput(),
					FolderStructure: pulumi.String("Flat"),
					LogFileFormat:   pulumi.String("Json"),
				},
			},
			DisplayName: pulumi.String("example-session-logger"),
		}, pulumi.DependsOn([]pulumi.Resource{
			exampleBucketPolicy,
		}))
		if err != nil {
			return err
		}
		return nil
	})
}

pulumi {
  required_providers {
    aws = {
      source = "pulumi/aws"
    }
  }
}

data "aws_iam_getpolicydocument" "example" {
  statements {
    principals {
      type        = "Service"
      identifiers = ["workspaces-web.amazonaws.com"]
    }
    effect    = "Allow"
    actions   = ["s3:PutObject"]
    resources = ["${aws_s3_bucket.example.arn}/*"]
  }
}

resource "aws_s3_bucket" "example" {
  bucket = "example-session-logs"
}
resource "aws_s3_bucketpolicy" "example" {
  bucket = aws_s3_bucket.example.id
  policy = data.aws_iam_getpolicydocument.example.json
}
resource "aws_workspacesweb_sessionlogger" "example" {
  depends_on = [aws_s3_bucketpolicy.example]
  event_filter = {
    all = {}
  }
  log_configuration = {
    s3 = {
      bucket           = aws_s3_bucket.example.id
      folder_structure = "Flat"
      log_file_format  = "Json"
    }
  }
  display_name = "example-session-logger"
}

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.s3.Bucket;
import com.pulumi.aws.s3.BucketArgs;
import com.pulumi.aws.iam.IamFunctions;
import com.pulumi.aws.iam.inputs.GetPolicyDocumentArgs;
import com.pulumi.aws.iam.inputs.GetPolicyDocumentStatementArgs;
import com.pulumi.aws.iam.inputs.GetPolicyDocumentStatementPrincipalArgs;
import com.pulumi.aws.s3.BucketPolicy;
import com.pulumi.aws.s3.BucketPolicyArgs;
import com.pulumi.aws.workspacesweb.SessionLogger;
import com.pulumi.aws.workspacesweb.SessionLoggerArgs;
import com.pulumi.aws.workspacesweb.inputs.SessionLoggerEventFilterArgs;
import com.pulumi.aws.workspacesweb.inputs.SessionLoggerEventFilterAllArgs;
import com.pulumi.aws.workspacesweb.inputs.SessionLoggerLogConfigurationArgs;
import com.pulumi.aws.workspacesweb.inputs.SessionLoggerLogConfigurationS3Args;
import com.pulumi.resources.CustomResourceOptions;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var exampleBucket = new Bucket("exampleBucket", BucketArgs.builder()
            .bucket("example-session-logs")
            .build());

        final var example = IamFunctions.getPolicyDocument(GetPolicyDocumentArgs.builder()
            .statements(GetPolicyDocumentStatementArgs.builder()
                .principals(GetPolicyDocumentStatementPrincipalArgs.builder()
                    .type("Service")
                    .identifiers("workspaces-web.amazonaws.com")
                    .build())
                .effect("Allow")
                .actions("s3:PutObject")
                .resources(exampleBucket.arn().applyValue(_arn -> String.format("%s/*", _arn)))
                .build())
            .build());

        var exampleBucketPolicy = new BucketPolicy("exampleBucketPolicy", BucketPolicyArgs.builder()
            .bucket(exampleBucket.id())
            .policy(example.applyValue(_example -> _example.json()))
            .build());

        var exampleSessionLogger = new SessionLogger("exampleSessionLogger", SessionLoggerArgs.builder()
            .eventFilter(SessionLoggerEventFilterArgs.builder()
                .all(SessionLoggerEventFilterAllArgs.builder()
                    .build())
                .build())
            .logConfiguration(SessionLoggerLogConfigurationArgs.builder()
                .s3(SessionLoggerLogConfigurationS3Args.builder()
                    .bucket(exampleBucket.id())
                    .folderStructure("Flat")
                    .logFileFormat("Json")
                    .build())
                .build())
            .displayName("example-session-logger")
            .build(), CustomResourceOptions.builder()
                .dependsOn(exampleBucketPolicy)
                .build());

    }
}

resources:
  exampleBucket:
    type: aws:s3:Bucket
    name: example
    properties:
      bucket: example-session-logs
  exampleBucketPolicy:
    type: aws:s3:BucketPolicy
    name: example
    properties:
      bucket: ${exampleBucket.id}
      policy: ${example.json}
  exampleSessionLogger:
    type: aws:workspacesweb:SessionLogger
    name: example
    properties:
      eventFilter:
        all: {}
      logConfiguration:
        s3:
          bucket: ${exampleBucket.id}
          folderStructure: Flat
          logFileFormat: Json
      displayName: example-session-logger
    options:
      dependsOn:
        - ${exampleBucketPolicy}
variables:
  example:
    fn::invoke:
      function: aws:iam:getPolicyDocument
      arguments:
        statements:
          - principals:
              - type: Service
                identifiers:
                  - workspaces-web.amazonaws.com
            effect: Allow
            actions:
              - s3:PutObject
            resources:
              - ${exampleBucket.arn}/*

Complete Configuration with KMS Encryption

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const exampleBucket = new aws.s3.Bucket("example", {
    bucket: "example-session-logs",
    forceDestroy: true,
});
const example = aws.iam.getPolicyDocumentOutput({
    statements: [{
        principals: [{
            type: "Service",
            identifiers: ["workspaces-web.amazonaws.com"],
        }],
        effect: "Allow",
        actions: ["s3:PutObject"],
        resources: [
            exampleBucket.arn,
            pulumi.interpolate`${exampleBucket.arn}/*`,
        ],
    }],
});
const exampleBucketPolicy = new aws.s3.BucketPolicy("example", {
    bucket: exampleBucket.id,
    policy: example.json,
});
const current = aws.getPartition({});
const currentGetCallerIdentity = aws.getCallerIdentity({});
const kmsKeyPolicy = Promise.all([current, currentGetCallerIdentity]).then(([current, currentGetCallerIdentity]) => aws.iam.getPolicyDocument({
    statements: [
        {
            principals: [{
                type: "AWS",
                identifiers: [`arn:${current.partition}:iam::${currentGetCallerIdentity.accountId}:root`],
            }],
            actions: ["kms:*"],
            resources: ["*"],
        },
        {
            principals: [{
                type: "Service",
                identifiers: ["workspaces-web.amazonaws.com"],
            }],
            actions: [
                "kms:Encrypt",
                "kms:GenerateDataKey*",
                "kms:ReEncrypt*",
                "kms:Decrypt",
            ],
            resources: ["*"],
        },
    ],
}));
const exampleKey = new aws.kms.Key("example", {
    description: "KMS key for WorkSpaces Web Session Logger",
    policy: kmsKeyPolicy.then(kmsKeyPolicy => kmsKeyPolicy.json),
});
const exampleSessionLogger = new aws.workspacesweb.SessionLogger("example", {
    eventFilter: {
        includes: [
            "SessionStart",
            "SessionEnd",
        ],
    },
    logConfiguration: {
        s3: {
            bucket: exampleBucket.id,
            bucketOwner: currentGetCallerIdentity.then(currentGetCallerIdentity => currentGetCallerIdentity.accountId),
            folderStructure: "NestedByDate",
            keyPrefix: "workspaces-web-logs/",
            logFileFormat: "JsonLines",
        },
    },
    displayName: "example-session-logger",
    customerManagedKey: exampleKey.arn,
    additionalEncryptionContext: {
        Environment: "Production",
        Application: "WorkSpacesWeb",
    },
    tags: {
        Name: "example-session-logger",
        Environment: "Production",
    },
}, {
    dependsOn: [
        exampleBucketPolicy,
        exampleKey,
    ],
});

import pulumi
import pulumi_aws as aws

example_bucket = aws.s3.Bucket("example",
    bucket="example-session-logs",
    force_destroy=True)
example = aws.iam.get_policy_document_output(statements=[{
    "principals": [{
        "type": "Service",
        "identifiers": ["workspaces-web.amazonaws.com"],
    }],
    "effect": "Allow",
    "actions": ["s3:PutObject"],
    "resources": [
        example_bucket.arn,
        example_bucket.arn.apply(lambda arn: f"{arn}/*"),
    ],
}])
example_bucket_policy = aws.s3.BucketPolicy("example",
    bucket=example_bucket.id,
    policy=example.json)
current = aws.get_partition()
current_get_caller_identity = aws.get_caller_identity()
kms_key_policy = aws.iam.get_policy_document(statements=[
    {
        "principals": [{
            "type": "AWS",
            "identifiers": [f"arn:{current.partition}:iam::{current_get_caller_identity.account_id}:root"],
        }],
        "actions": ["kms:*"],
        "resources": ["*"],
    },
    {
        "principals": [{
            "type": "Service",
            "identifiers": ["workspaces-web.amazonaws.com"],
        }],
        "actions": [
            "kms:Encrypt",
            "kms:GenerateDataKey*",
            "kms:ReEncrypt*",
            "kms:Decrypt",
        ],
        "resources": ["*"],
    },
])
example_key = aws.kms.Key("example",
    description="KMS key for WorkSpaces Web Session Logger",
    policy=kms_key_policy.json)
example_session_logger = aws.workspacesweb.SessionLogger("example",
    event_filter={
        "includes": [
            "SessionStart",
            "SessionEnd",
        ],
    },
    log_configuration={
        "s3": {
            "bucket": example_bucket.id,
            "bucket_owner": current_get_caller_identity.account_id,
            "folder_structure": "NestedByDate",
            "key_prefix": "workspaces-web-logs/",
            "log_file_format": "JsonLines",
        },
    },
    display_name="example-session-logger",
    customer_managed_key=example_key.arn,
    additional_encryption_context={
        "Environment": "Production",
        "Application": "WorkSpacesWeb",
    },
    tags={
        "Name": "example-session-logger",
        "Environment": "Production",
    },
    opts = pulumi.ResourceOptions(depends_on=[
            example_bucket_policy,
            example_key,
        ]))

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;

return await Deployment.RunAsync(() =>
{
    var exampleBucket = new Aws.S3.Bucket("example", new()
    {
        BucketName = "example-session-logs",
        ForceDestroy = true,
    });

    var example = Aws.Iam.GetPolicyDocument.Invoke(new()
    {
        Statements = new[]
        {
            new Aws.Iam.Inputs.GetPolicyDocumentStatementInputArgs
            {
                Principals = new[]
                {
                    new Aws.Iam.Inputs.GetPolicyDocumentStatementPrincipalInputArgs
                    {
                        Type = "Service",
                        Identifiers = new[]
                        {
                            "workspaces-web.amazonaws.com",
                        },
                    },
                },
                Effect = "Allow",
                Actions = new[]
                {
                    "s3:PutObject",
                },
                Resources = new[]
                {
                    exampleBucket.Arn,
                    $"{exampleBucket.Arn}/*",
                },
            },
        },
    });

    var exampleBucketPolicy = new Aws.S3.BucketPolicy("example", new()
    {
        Bucket = exampleBucket.Id,
        Policy = example.Apply(getPolicyDocumentResult => getPolicyDocumentResult.Json),
    });

    var current = Aws.GetPartition.Invoke();

    var currentGetCallerIdentity = Aws.GetCallerIdentity.Invoke();

    var kmsKeyPolicy = Aws.Iam.GetPolicyDocument.Invoke(new()
    {
        Statements = new[]
        {
            new Aws.Iam.Inputs.GetPolicyDocumentStatementInputArgs
            {
                Principals = new[]
                {
                    new Aws.Iam.Inputs.GetPolicyDocumentStatementPrincipalInputArgs
                    {
                        Type = "AWS",
                        Identifiers = new[]
                        {
                            $"arn:{current.Apply(getPartitionResult => getPartitionResult.Partition)}:iam::{currentGetCallerIdentity.Apply(getCallerIdentityResult => getCallerIdentityResult.AccountId)}:root",
                        },
                    },
                },
                Actions = new[]
                {
                    "kms:*",
                },
                Resources = new[]
                {
                    "*",
                },
            },
            new Aws.Iam.Inputs.GetPolicyDocumentStatementInputArgs
            {
                Principals = new[]
                {
                    new Aws.Iam.Inputs.GetPolicyDocumentStatementPrincipalInputArgs
                    {
                        Type = "Service",
                        Identifiers = new[]
                        {
                            "workspaces-web.amazonaws.com",
                        },
                    },
                },
                Actions = new[]
                {
                    "kms:Encrypt",
                    "kms:GenerateDataKey*",
                    "kms:ReEncrypt*",
                    "kms:Decrypt",
                },
                Resources = new[]
                {
                    "*",
                },
            },
        },
    });

    var exampleKey = new Aws.Kms.Key("example", new()
    {
        Description = "KMS key for WorkSpaces Web Session Logger",
        Policy = kmsKeyPolicy.Apply(getPolicyDocumentResult => getPolicyDocumentResult.Json),
    });

    var exampleSessionLogger = new Aws.WorkSpacesWeb.SessionLogger("example", new()
    {
        EventFilter = new Aws.WorkSpacesWeb.Inputs.SessionLoggerEventFilterArgs
        {
            Includes = new[]
            {
                "SessionStart",
                "SessionEnd",
            },
        },
        LogConfiguration = new Aws.WorkSpacesWeb.Inputs.SessionLoggerLogConfigurationArgs
        {
            S3 = new Aws.WorkSpacesWeb.Inputs.SessionLoggerLogConfigurationS3Args
            {
                Bucket = exampleBucket.Id,
                BucketOwner = currentGetCallerIdentity.Apply(getCallerIdentityResult => getCallerIdentityResult.AccountId),
                FolderStructure = "NestedByDate",
                KeyPrefix = "workspaces-web-logs/",
                LogFileFormat = "JsonLines",
            },
        },
        DisplayName = "example-session-logger",
        CustomerManagedKey = exampleKey.Arn,
        AdditionalEncryptionContext =
        {
            { "Environment", "Production" },
            { "Application", "WorkSpacesWeb" },
        },
        Tags =
        {
            { "Name", "example-session-logger" },
            { "Environment", "Production" },
        },
    }, new CustomResourceOptions
    {
        DependsOn =
        {
            exampleBucketPolicy,
            exampleKey,
        },
    });

});

package main

import (
	"fmt"

	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws"
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/iam"
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/kms"
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/s3"
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/workspacesweb"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		exampleBucket, err := s3.NewBucket(ctx, "example", &s3.BucketArgs{
			Bucket:       pulumi.String("example-session-logs"),
			ForceDestroy: pulumi.Bool(true),
		})
		if err != nil {
			return err
		}
		example := iam.GetPolicyDocumentOutput(ctx, iam.GetPolicyDocumentOutputArgs{
			Statements: iam.GetPolicyDocumentStatementArray{
				&iam.GetPolicyDocumentStatementArgs{
					Principals: iam.GetPolicyDocumentStatementPrincipalArray{
						&iam.GetPolicyDocumentStatementPrincipalArgs{
							Type: pulumi.String("Service"),
							Identifiers: pulumi.StringArray{
								pulumi.String("workspaces-web.amazonaws.com"),
							},
						},
					},
					Effect: pulumi.String("Allow"),
					Actions: pulumi.StringArray{
						pulumi.String("s3:PutObject"),
					},
					Resources: pulumi.StringArray{
						exampleBucket.Arn,
						exampleBucket.Arn.ApplyT(func(arn string) (string, error) {
							return fmt.Sprintf("%v/*", arn), nil
						}).(pulumi.StringOutput),
					},
				},
			},
		}, nil)
		exampleBucketPolicy, err := s3.NewBucketPolicy(ctx, "example", &s3.BucketPolicyArgs{
			Bucket: exampleBucket.ID().ToIDOutput().ToStringOutput(),
			Policy: example.Json(),
		})
		if err != nil {
			return err
		}
		current, err := aws.GetPartition(ctx, &aws.GetPartitionArgs{}, nil)
		if err != nil {
			return err
		}
		currentGetCallerIdentity, err := aws.GetCallerIdentity(ctx, &aws.GetCallerIdentityArgs{}, nil)
		if err != nil {
			return err
		}
		kmsKeyPolicy, err := iam.GetPolicyDocument(ctx, &iam.GetPolicyDocumentArgs{
			Statements: []iam.GetPolicyDocumentStatement{
				{
					Principals: []iam.GetPolicyDocumentStatementPrincipal{
						{
							Type: "AWS",
							Identifiers: []string{
								fmt.Sprintf("arn:%v:iam::%v:root", current.Partition, currentGetCallerIdentity.AccountId),
							},
						},
					},
					Actions: []string{
						"kms:*",
					},
					Resources: []string{
						"*",
					},
				},
				{
					Principals: []iam.GetPolicyDocumentStatementPrincipal{
						{
							Type: "Service",
							Identifiers: []string{
								"workspaces-web.amazonaws.com",
							},
						},
					},
					Actions: []string{
						"kms:Encrypt",
						"kms:GenerateDataKey*",
						"kms:ReEncrypt*",
						"kms:Decrypt",
					},
					Resources: []string{
						"*",
					},
				},
			},
		}, nil)
		if err != nil {
			return err
		}
		exampleKey, err := kms.NewKey(ctx, "example", &kms.KeyArgs{
			Description: pulumi.String("KMS key for WorkSpaces Web Session Logger"),
			Policy:      pulumi.String(kmsKeyPolicy.Json),
		})
		if err != nil {
			return err
		}
		_, err = workspacesweb.NewSessionLogger(ctx, "example", &workspacesweb.SessionLoggerArgs{
			EventFilter: &workspacesweb.SessionLoggerEventFilterArgs{
				Includes: pulumi.StringArray{
					pulumi.String("SessionStart"),
					pulumi.String("SessionEnd"),
				},
			},
			LogConfiguration: &workspacesweb.SessionLoggerLogConfigurationArgs{
				S3: &workspacesweb.SessionLoggerLogConfigurationS3Args{
					Bucket:          exampleBucket.ID().ToIDOutput().ToStringOutput(),
					BucketOwner:     pulumi.String(currentGetCallerIdentity.AccountId),
					FolderStructure: pulumi.String("NestedByDate"),
					KeyPrefix:       pulumi.String("workspaces-web-logs/"),
					LogFileFormat:   pulumi.String("JsonLines"),
				},
			},
			DisplayName:        pulumi.String("example-session-logger"),
			CustomerManagedKey: exampleKey.Arn,
			AdditionalEncryptionContext: pulumi.StringMap{
				"Environment": pulumi.String("Production"),
				"Application": pulumi.String("WorkSpacesWeb"),
			},
			Tags: pulumi.StringMap{
				"Name":        pulumi.String("example-session-logger"),
				"Environment": pulumi.String("Production"),
			},
		}, pulumi.DependsOn([]pulumi.Resource{
			exampleBucketPolicy,
			exampleKey,
		}))
		if err != nil {
			return err
		}
		return nil
	})
}

pulumi {
  required_providers {
    aws = {
      source = "pulumi/aws"
    }
  }
}

data "aws_iam_getpolicydocument" "example" {
  statements {
    principals {
      type        = "Service"
      identifiers = ["workspaces-web.amazonaws.com"]
    }
    effect    = "Allow"
    actions   = ["s3:PutObject"]
    resources = [aws_s3_bucket.example.arn, "${aws_s3_bucket.example.arn}/*"]
  }
}
data "aws_getpartition" "current" {
}
data "aws_getcalleridentity" "currentGetCallerIdentity" {
}
data "aws_iam_getpolicydocument" "kmsKeyPolicy" {
  statements {
    principals {
      type        = "AWS"
      identifiers = ["arn:${data.aws_getpartition.current.partition}:iam::${data.aws_getcalleridentity.currentGetCallerIdentity.account_id}:root"]
    }
    actions   = ["kms:*"]
    resources = ["*"]
  }
  statements {
    principals {
      type        = "Service"
      identifiers = ["workspaces-web.amazonaws.com"]
    }
    actions   = ["kms:Encrypt", "kms:GenerateDataKey*", "kms:ReEncrypt*", "kms:Decrypt"]
    resources = ["*"]
  }
}

resource "aws_s3_bucket" "example" {
  bucket        = "example-session-logs"
  force_destroy = true
}
resource "aws_s3_bucketpolicy" "example" {
  bucket = aws_s3_bucket.example.id
  policy = data.aws_iam_getpolicydocument.example.json
}
resource "aws_kms_key" "example" {
  description = "KMS key for WorkSpaces Web Session Logger"
  policy      = data.aws_iam_getpolicydocument.kmsKeyPolicy.json
}
resource "aws_workspacesweb_sessionlogger" "example" {
  depends_on = [aws_s3_bucketpolicy.example, aws_kms_key.example]
  event_filter = {
    includes = ["SessionStart", "SessionEnd"]
  }
  log_configuration = {
    s3 = {
      bucket           = aws_s3_bucket.example.id
      bucket_owner     = data.aws_getcalleridentity.currentGetCallerIdentity.account_id
      folder_structure = "NestedByDate"
      key_prefix       = "workspaces-web-logs/"
      log_file_format  = "JsonLines"
    }
  }
  display_name         = "example-session-logger"
  customer_managed_key = aws_kms_key.example.arn
  additional_encryption_context = {
    "Environment" = "Production"
    "Application" = "WorkSpacesWeb"
  }
  tags = {
    "Name"        = "example-session-logger"
    "Environment" = "Production"
  }
}

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.s3.Bucket;
import com.pulumi.aws.s3.BucketArgs;
import com.pulumi.aws.iam.IamFunctions;
import com.pulumi.aws.iam.inputs.GetPolicyDocumentArgs;
import com.pulumi.aws.iam.inputs.GetPolicyDocumentStatementArgs;
import com.pulumi.aws.iam.inputs.GetPolicyDocumentStatementPrincipalArgs;
import com.pulumi.aws.s3.BucketPolicy;
import com.pulumi.aws.s3.BucketPolicyArgs;
import com.pulumi.aws.AwsFunctions;
import com.pulumi.aws.inputs.GetPartitionArgs;
import com.pulumi.aws.inputs.GetCallerIdentityArgs;
import com.pulumi.aws.kms.Key;
import com.pulumi.aws.kms.KeyArgs;
import com.pulumi.aws.workspacesweb.SessionLogger;
import com.pulumi.aws.workspacesweb.SessionLoggerArgs;
import com.pulumi.aws.workspacesweb.inputs.SessionLoggerEventFilterArgs;
import com.pulumi.aws.workspacesweb.inputs.SessionLoggerLogConfigurationArgs;
import com.pulumi.aws.workspacesweb.inputs.SessionLoggerLogConfigurationS3Args;
import com.pulumi.resources.CustomResourceOptions;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var exampleBucket = new Bucket("exampleBucket", BucketArgs.builder()
            .bucket("example-session-logs")
            .forceDestroy(true)
            .build());

        final var example = IamFunctions.getPolicyDocument(GetPolicyDocumentArgs.builder()
            .statements(GetPolicyDocumentStatementArgs.builder()
                .principals(GetPolicyDocumentStatementPrincipalArgs.builder()
                    .type("Service")
                    .identifiers("workspaces-web.amazonaws.com")
                    .build())
                .effect("Allow")
                .actions("s3:PutObject")
                .resources(
                    exampleBucket.arn(),
                    exampleBucket.arn().applyValue(_arn -> String.format("%s/*", _arn)))
                .build())
            .build());

        var exampleBucketPolicy = new BucketPolicy("exampleBucketPolicy", BucketPolicyArgs.builder()
            .bucket(exampleBucket.id())
            .policy(example.applyValue(_example -> _example.json()))
            .build());

        final var current = AwsFunctions.getPartition(GetPartitionArgs.builder()
            .build());

        final var currentGetCallerIdentity = AwsFunctions.getCallerIdentity(GetCallerIdentityArgs.builder()
            .build());

        final var kmsKeyPolicy = IamFunctions.getPolicyDocument(GetPolicyDocumentArgs.builder()
            .statements(
                GetPolicyDocumentStatementArgs.builder()
                    .principals(GetPolicyDocumentStatementPrincipalArgs.builder()
                        .type("AWS")
                        .identifiers(String.format("arn:%s:iam::%s:root", current.partition(),currentGetCallerIdentity.accountId()))
                        .build())
                    .actions("kms:*")
                    .resources("*")
                    .build(),
                GetPolicyDocumentStatementArgs.builder()
                    .principals(GetPolicyDocumentStatementPrincipalArgs.builder()
                        .type("Service")
                        .identifiers("workspaces-web.amazonaws.com")
                        .build())
                    .actions(
                        "kms:Encrypt",
                        "kms:GenerateDataKey*",
                        "kms:ReEncrypt*",
                        "kms:Decrypt")
                    .resources("*")
                    .build())
            .build());

        var exampleKey = new Key("exampleKey", KeyArgs.builder()
            .description("KMS key for WorkSpaces Web Session Logger")
            .policy(kmsKeyPolicy.json())
            .build());

        var exampleSessionLogger = new SessionLogger("exampleSessionLogger", SessionLoggerArgs.builder()
            .eventFilter(SessionLoggerEventFilterArgs.builder()
                .includes(
                    "SessionStart",
                    "SessionEnd")
                .build())
            .logConfiguration(SessionLoggerLogConfigurationArgs.builder()
                .s3(SessionLoggerLogConfigurationS3Args.builder()
                    .bucket(exampleBucket.id())
                    .bucketOwner(currentGetCallerIdentity.accountId())
                    .folderStructure("NestedByDate")
                    .keyPrefix("workspaces-web-logs/")
                    .logFileFormat("JsonLines")
                    .build())
                .build())
            .displayName("example-session-logger")
            .customerManagedKey(exampleKey.arn())
            .additionalEncryptionContext(Map.ofEntries(
                Map.entry("Environment", "Production"),
                Map.entry("Application", "WorkSpacesWeb")
            ))
            .tags(Map.ofEntries(
                Map.entry("Name", "example-session-logger"),
                Map.entry("Environment", "Production")
            ))
            .build(), CustomResourceOptions.builder()
                .dependsOn(
                    exampleBucketPolicy,
                    exampleKey)
                .build());

    }
}

resources:
  exampleBucket:
    type: aws:s3:Bucket
    name: example
    properties:
      bucket: example-session-logs
      forceDestroy: true
  exampleBucketPolicy:
    type: aws:s3:BucketPolicy
    name: example
    properties:
      bucket: ${exampleBucket.id}
      policy: ${example.json}
  exampleKey:
    type: aws:kms:Key
    name: example
    properties:
      description: KMS key for WorkSpaces Web Session Logger
      policy: ${kmsKeyPolicy.json}
  exampleSessionLogger:
    type: aws:workspacesweb:SessionLogger
    name: example
    properties:
      eventFilter:
        includes:
          - SessionStart
          - SessionEnd
      logConfiguration:
        s3:
          bucket: ${exampleBucket.id}
          bucketOwner: ${currentGetCallerIdentity.accountId}
          folderStructure: NestedByDate
          keyPrefix: workspaces-web-logs/
          logFileFormat: JsonLines
      displayName: example-session-logger
      customerManagedKey: ${exampleKey.arn}
      additionalEncryptionContext:
        Environment: Production
        Application: WorkSpacesWeb
      tags:
        Name: example-session-logger
        Environment: Production
    options:
      dependsOn:
        - ${exampleBucketPolicy}
        - ${exampleKey}
variables:
  example:
    fn::invoke:
      function: aws:iam:getPolicyDocument
      arguments:
        statements:
          - principals:
              - type: Service
                identifiers:
                  - workspaces-web.amazonaws.com
            effect: Allow
            actions:
              - s3:PutObject
            resources:
              - ${exampleBucket.arn}
              - ${exampleBucket.arn}/*
  current:
    fn::invoke:
      function: aws:getPartition
      arguments: {}
  currentGetCallerIdentity:
    fn::invoke:
      function: aws:getCallerIdentity
      arguments: {}
  kmsKeyPolicy:
    fn::invoke:
      function: aws:iam:getPolicyDocument
      arguments:
        statements:
          - principals:
              - type: AWS
                identifiers:
                  - arn:${current.partition}:iam::${currentGetCallerIdentity.accountId}:root
            actions:
              - kms:*
            resources:
              - '*'
          - principals:
              - type: Service
                identifiers:
                  - workspaces-web.amazonaws.com
            actions:
              - kms:Encrypt
              - kms:GenerateDataKey*
              - kms:ReEncrypt*
              - kms:Decrypt
            resources:
              - '*'

Import

Using pulumi import, import WorkSpaces Web Session Logger using the sessionLoggerArn. For example:

$ pulumi import aws:workspacesweb/sessionLogger:SessionLogger example arn:aws:workspaces-web:us-west-2:123456789012:sessionLogger/session_logger-id-12345678