1. Packages
  2. AWS
  3. API Docs
  4. observabilityadmin
  5. CentralizationRuleForOrganization
AWS v7.13.0 published on Tuesday, Dec 9, 2025 by Pulumi
Schema (JSON)
pulumi/pulumi-aws

aws.observabilityadmin.CentralizationRuleForOrganization

aws logo
AWS v7.13.0 published on Tuesday, Dec 9, 2025 by Pulumi
Schema (JSON)
pulumi/pulumi-aws

    Manages an AWS CloudWatch Observability Admin Centralization Rule For Organization.

    Centralization rules enable you to centralize log data from multiple AWS accounts and regions within your organization to a single destination account and region. This helps with log management, compliance, and cost optimization by consolidating logs in a central location.

    This requires an AWS account within an organization with at least delegated administrator permissions.

    Example Usage

    Basic Centralization Rule

    import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const current = aws.getCallerIdentity({});
const currentGetOrganization = aws.organizations.getOrganization({});
const example = new aws.observabilityadmin.CentralizationRuleForOrganization("example", {
    ruleName: "example-centralization-rule",
    rule: {
        destination: {
            region: "eu-west-1",
            account: current.then(current => current.accountId),
        },
        source: {
            regions: ["ap-southeast-1"],
            scope: currentGetOrganization.then(currentGetOrganization => `OrganizationId = '${currentGetOrganization.id}'`),
            sourceLogsConfiguration: {
                encryptedLogGroupStrategy: "SKIP",
                logGroupSelectionCriteria: "*",
            },
        },
    },
    tags: {
        Name: "example-centralization-rule",
        Environment: "production",
    },
});

    import pulumi
import pulumi_aws as aws

current = aws.get_caller_identity()
current_get_organization = aws.organizations.get_organization()
example = aws.observabilityadmin.CentralizationRuleForOrganization("example",
    rule_name="example-centralization-rule",
    rule={
        "destination": {
            "region": "eu-west-1",
            "account": current.account_id,
        },
        "source": {
            "regions": ["ap-southeast-1"],
            "scope": f"OrganizationId = '{current_get_organization.id}'",
            "source_logs_configuration": {
                "encrypted_log_group_strategy": "SKIP",
                "log_group_selection_criteria": "*",
            },
        },
    },
    tags={
        "Name": "example-centralization-rule",
        "Environment": "production",
    })

    package main

import (
	"fmt"

	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws"
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/observabilityadmin"
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/organizations"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		current, err := aws.GetCallerIdentity(ctx, &aws.GetCallerIdentityArgs{}, nil)
		if err != nil {
			return err
		}
		currentGetOrganization, err := organizations.LookupOrganization(ctx, map[string]interface{}{}, nil)
		if err != nil {
			return err
		}
		_, err = observabilityadmin.NewCentralizationRuleForOrganization(ctx, "example", &observabilityadmin.CentralizationRuleForOrganizationArgs{
			RuleName: pulumi.String("example-centralization-rule"),
			Rule: &observabilityadmin.CentralizationRuleForOrganizationRuleArgs{
				Destination: &observabilityadmin.CentralizationRuleForOrganizationRuleDestinationArgs{
					Region:  pulumi.String("eu-west-1"),
					Account: pulumi.String(current.AccountId),
				},
				Source: &observabilityadmin.CentralizationRuleForOrganizationRuleSourceArgs{
					Regions: pulumi.StringArray{
						pulumi.String("ap-southeast-1"),
					},
					Scope: pulumi.Sprintf("OrganizationId = '%v'", currentGetOrganization.Id),
					SourceLogsConfiguration: &observabilityadmin.CentralizationRuleForOrganizationRuleSourceSourceLogsConfigurationArgs{
						EncryptedLogGroupStrategy: pulumi.String("SKIP"),
						LogGroupSelectionCriteria: pulumi.String("*"),
					},
				},
			},
			Tags: pulumi.StringMap{
				"Name":        pulumi.String("example-centralization-rule"),
				"Environment": pulumi.String("production"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;

return await Deployment.RunAsync(() => 
{
    var current = Aws.GetCallerIdentity.Invoke();

    var currentGetOrganization = Aws.Organizations.GetOrganization.Invoke();

    var example = new Aws.Observabilityadmin.CentralizationRuleForOrganization("example", new()
    {
        RuleName = "example-centralization-rule",
        Rule = new Aws.Observabilityadmin.Inputs.CentralizationRuleForOrganizationRuleArgs
        {
            Destination = new Aws.Observabilityadmin.Inputs.CentralizationRuleForOrganizationRuleDestinationArgs
            {
                Region = "eu-west-1",
                Account = current.Apply(getCallerIdentityResult => getCallerIdentityResult.AccountId),
            },
            Source = new Aws.Observabilityadmin.Inputs.CentralizationRuleForOrganizationRuleSourceArgs
            {
                Regions = new[]
                {
                    "ap-southeast-1",
                },
                Scope = $"OrganizationId = '{currentGetOrganization.Apply(getOrganizationResult => getOrganizationResult.Id)}'",
                SourceLogsConfiguration = new Aws.Observabilityadmin.Inputs.CentralizationRuleForOrganizationRuleSourceSourceLogsConfigurationArgs
                {
                    EncryptedLogGroupStrategy = "SKIP",
                    LogGroupSelectionCriteria = "*",
                },
            },
        },
        Tags = 
        {
            { "Name", "example-centralization-rule" },
            { "Environment", "production" },
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.AwsFunctions;
import com.pulumi.aws.inputs.GetCallerIdentityArgs;
import com.pulumi.aws.organizations.OrganizationsFunctions;
import com.pulumi.aws.observabilityadmin.CentralizationRuleForOrganization;
import com.pulumi.aws.observabilityadmin.CentralizationRuleForOrganizationArgs;
import com.pulumi.aws.observabilityadmin.inputs.CentralizationRuleForOrganizationRuleArgs;
import com.pulumi.aws.observabilityadmin.inputs.CentralizationRuleForOrganizationRuleDestinationArgs;
import com.pulumi.aws.observabilityadmin.inputs.CentralizationRuleForOrganizationRuleSourceArgs;
import com.pulumi.aws.observabilityadmin.inputs.CentralizationRuleForOrganizationRuleSourceSourceLogsConfigurationArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var current = AwsFunctions.getCallerIdentity(GetCallerIdentityArgs.builder()
            .build());

        final var currentGetOrganization = OrganizationsFunctions.getOrganization(%!v(PANIC=Format method: runtime error: invalid memory address or nil pointer dereference);

        var example = new CentralizationRuleForOrganization("example", CentralizationRuleForOrganizationArgs.builder()
            .ruleName("example-centralization-rule")
            .rule(CentralizationRuleForOrganizationRuleArgs.builder()
                .destination(CentralizationRuleForOrganizationRuleDestinationArgs.builder()
                    .region("eu-west-1")
                    .account(current.accountId())
                    .build())
                .source(CentralizationRuleForOrganizationRuleSourceArgs.builder()
                    .regions("ap-southeast-1")
                    .scope(String.format("OrganizationId = '%s'", currentGetOrganization.id()))
                    .sourceLogsConfiguration(CentralizationRuleForOrganizationRuleSourceSourceLogsConfigurationArgs.builder()
                        .encryptedLogGroupStrategy("SKIP")
                        .logGroupSelectionCriteria("*")
                        .build())
                    .build())
                .build())
            .tags(Map.ofEntries(
                Map.entry("Name", "example-centralization-rule"),
                Map.entry("Environment", "production")
            ))
            .build());

    }
}

    resources:
  example:
    type: aws:observabilityadmin:CentralizationRuleForOrganization
    properties:
      ruleName: example-centralization-rule
      rule:
        destination:
          region: eu-west-1
          account: ${current.accountId}
        source:
          regions:
            - ap-southeast-1
          scope: OrganizationId = '${currentGetOrganization.id}'
          sourceLogsConfiguration:
            encryptedLogGroupStrategy: SKIP
            logGroupSelectionCriteria: '*'
      tags:
        Name: example-centralization-rule
        Environment: production
variables:
  current:
    fn::invoke:
      function: aws:getCallerIdentity
      arguments: {}
  currentGetOrganization:
    fn::invoke:
      function: aws:organizations:getOrganization
      arguments: {}

    Advanced Configuration with Encryption and Backup

    import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const current = aws.getCallerIdentity({});
const currentGetOrganization = aws.organizations.getOrganization({});
const advanced = new aws.observabilityadmin.CentralizationRuleForOrganization("advanced", {
    ruleName: "advanced-centralization-rule",
    rule: {
        destination: {
            region: "eu-west-1",
            account: current.then(current => current.accountId),
            destinationLogsConfiguration: {
                logsEncryptionConfiguration: {
                    encryptionStrategy: "AWS_OWNED",
                },
                backupConfiguration: {
                    region: "us-west-1",
                },
            },
        },
        source: {
            regions: [
                "ap-southeast-1",
                "us-east-1",
            ],
            scope: currentGetOrganization.then(currentGetOrganization => `OrganizationId = '${currentGetOrganization.id}'`),
            sourceLogsConfiguration: {
                encryptedLogGroupStrategy: "ALLOW",
                logGroupSelectionCriteria: "*",
            },
        },
    },
    tags: {
        Name: "advanced-centralization-rule",
        Environment: "production",
        Team: "observability",
    },
});

    import pulumi
import pulumi_aws as aws

current = aws.get_caller_identity()
current_get_organization = aws.organizations.get_organization()
advanced = aws.observabilityadmin.CentralizationRuleForOrganization("advanced",
    rule_name="advanced-centralization-rule",
    rule={
        "destination": {
            "region": "eu-west-1",
            "account": current.account_id,
            "destination_logs_configuration": {
                "logs_encryption_configuration": {
                    "encryption_strategy": "AWS_OWNED",
                },
                "backup_configuration": {
                    "region": "us-west-1",
                },
            },
        },
        "source": {
            "regions": [
                "ap-southeast-1",
                "us-east-1",
            ],
            "scope": f"OrganizationId = '{current_get_organization.id}'",
            "source_logs_configuration": {
                "encrypted_log_group_strategy": "ALLOW",
                "log_group_selection_criteria": "*",
            },
        },
    },
    tags={
        "Name": "advanced-centralization-rule",
        "Environment": "production",
        "Team": "observability",
    })

    package main

import (
	"fmt"

	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws"
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/observabilityadmin"
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/organizations"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		current, err := aws.GetCallerIdentity(ctx, &aws.GetCallerIdentityArgs{}, nil)
		if err != nil {
			return err
		}
		currentGetOrganization, err := organizations.LookupOrganization(ctx, map[string]interface{}{}, nil)
		if err != nil {
			return err
		}
		_, err = observabilityadmin.NewCentralizationRuleForOrganization(ctx, "advanced", &observabilityadmin.CentralizationRuleForOrganizationArgs{
			RuleName: pulumi.String("advanced-centralization-rule"),
			Rule: &observabilityadmin.CentralizationRuleForOrganizationRuleArgs{
				Destination: &observabilityadmin.CentralizationRuleForOrganizationRuleDestinationArgs{
					Region:  pulumi.String("eu-west-1"),
					Account: pulumi.String(current.AccountId),
					DestinationLogsConfiguration: &observabilityadmin.CentralizationRuleForOrganizationRuleDestinationDestinationLogsConfigurationArgs{
						LogsEncryptionConfiguration: &observabilityadmin.CentralizationRuleForOrganizationRuleDestinationDestinationLogsConfigurationLogsEncryptionConfigurationArgs{
							EncryptionStrategy: pulumi.String("AWS_OWNED"),
						},
						BackupConfiguration: &observabilityadmin.CentralizationRuleForOrganizationRuleDestinationDestinationLogsConfigurationBackupConfigurationArgs{
							Region: pulumi.String("us-west-1"),
						},
					},
				},
				Source: &observabilityadmin.CentralizationRuleForOrganizationRuleSourceArgs{
					Regions: pulumi.StringArray{
						pulumi.String("ap-southeast-1"),
						pulumi.String("us-east-1"),
					},
					Scope: pulumi.Sprintf("OrganizationId = '%v'", currentGetOrganization.Id),
					SourceLogsConfiguration: &observabilityadmin.CentralizationRuleForOrganizationRuleSourceSourceLogsConfigurationArgs{
						EncryptedLogGroupStrategy: pulumi.String("ALLOW"),
						LogGroupSelectionCriteria: pulumi.String("*"),
					},
				},
			},
			Tags: pulumi.StringMap{
				"Name":        pulumi.String("advanced-centralization-rule"),
				"Environment": pulumi.String("production"),
				"Team":        pulumi.String("observability"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;

return await Deployment.RunAsync(() => 
{
    var current = Aws.GetCallerIdentity.Invoke();

    var currentGetOrganization = Aws.Organizations.GetOrganization.Invoke();

    var advanced = new Aws.Observabilityadmin.CentralizationRuleForOrganization("advanced", new()
    {
        RuleName = "advanced-centralization-rule",
        Rule = new Aws.Observabilityadmin.Inputs.CentralizationRuleForOrganizationRuleArgs
        {
            Destination = new Aws.Observabilityadmin.Inputs.CentralizationRuleForOrganizationRuleDestinationArgs
            {
                Region = "eu-west-1",
                Account = current.Apply(getCallerIdentityResult => getCallerIdentityResult.AccountId),
                DestinationLogsConfiguration = new Aws.Observabilityadmin.Inputs.CentralizationRuleForOrganizationRuleDestinationDestinationLogsConfigurationArgs
                {
                    LogsEncryptionConfiguration = new Aws.Observabilityadmin.Inputs.CentralizationRuleForOrganizationRuleDestinationDestinationLogsConfigurationLogsEncryptionConfigurationArgs
                    {
                        EncryptionStrategy = "AWS_OWNED",
                    },
                    BackupConfiguration = new Aws.Observabilityadmin.Inputs.CentralizationRuleForOrganizationRuleDestinationDestinationLogsConfigurationBackupConfigurationArgs
                    {
                        Region = "us-west-1",
                    },
                },
            },
            Source = new Aws.Observabilityadmin.Inputs.CentralizationRuleForOrganizationRuleSourceArgs
            {
                Regions = new[]
                {
                    "ap-southeast-1",
                    "us-east-1",
                },
                Scope = $"OrganizationId = '{currentGetOrganization.Apply(getOrganizationResult => getOrganizationResult.Id)}'",
                SourceLogsConfiguration = new Aws.Observabilityadmin.Inputs.CentralizationRuleForOrganizationRuleSourceSourceLogsConfigurationArgs
                {
                    EncryptedLogGroupStrategy = "ALLOW",
                    LogGroupSelectionCriteria = "*",
                },
            },
        },
        Tags = 
        {
            { "Name", "advanced-centralization-rule" },
            { "Environment", "production" },
            { "Team", "observability" },
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.AwsFunctions;
import com.pulumi.aws.inputs.GetCallerIdentityArgs;
import com.pulumi.aws.organizations.OrganizationsFunctions;
import com.pulumi.aws.observabilityadmin.CentralizationRuleForOrganization;
import com.pulumi.aws.observabilityadmin.CentralizationRuleForOrganizationArgs;
import com.pulumi.aws.observabilityadmin.inputs.CentralizationRuleForOrganizationRuleArgs;
import com.pulumi.aws.observabilityadmin.inputs.CentralizationRuleForOrganizationRuleDestinationArgs;
import com.pulumi.aws.observabilityadmin.inputs.CentralizationRuleForOrganizationRuleDestinationDestinationLogsConfigurationArgs;
import com.pulumi.aws.observabilityadmin.inputs.CentralizationRuleForOrganizationRuleDestinationDestinationLogsConfigurationLogsEncryptionConfigurationArgs;
import com.pulumi.aws.observabilityadmin.inputs.CentralizationRuleForOrganizationRuleDestinationDestinationLogsConfigurationBackupConfigurationArgs;
import com.pulumi.aws.observabilityadmin.inputs.CentralizationRuleForOrganizationRuleSourceArgs;
import com.pulumi.aws.observabilityadmin.inputs.CentralizationRuleForOrganizationRuleSourceSourceLogsConfigurationArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var current = AwsFunctions.getCallerIdentity(GetCallerIdentityArgs.builder()
            .build());

        final var currentGetOrganization = OrganizationsFunctions.getOrganization(%!v(PANIC=Format method: runtime error: invalid memory address or nil pointer dereference);

        var advanced = new CentralizationRuleForOrganization("advanced", CentralizationRuleForOrganizationArgs.builder()
            .ruleName("advanced-centralization-rule")
            .rule(CentralizationRuleForOrganizationRuleArgs.builder()
                .destination(CentralizationRuleForOrganizationRuleDestinationArgs.builder()
                    .region("eu-west-1")
                    .account(current.accountId())
                    .destinationLogsConfiguration(CentralizationRuleForOrganizationRuleDestinationDestinationLogsConfigurationArgs.builder()
                        .logsEncryptionConfiguration(CentralizationRuleForOrganizationRuleDestinationDestinationLogsConfigurationLogsEncryptionConfigurationArgs.builder()
                            .encryptionStrategy("AWS_OWNED")
                            .build())
                        .backupConfiguration(CentralizationRuleForOrganizationRuleDestinationDestinationLogsConfigurationBackupConfigurationArgs.builder()
                            .region("us-west-1")
                            .build())
                        .build())
                    .build())
                .source(CentralizationRuleForOrganizationRuleSourceArgs.builder()
                    .regions(                    
                        "ap-southeast-1",
                        "us-east-1")
                    .scope(String.format("OrganizationId = '%s'", currentGetOrganization.id()))
                    .sourceLogsConfiguration(CentralizationRuleForOrganizationRuleSourceSourceLogsConfigurationArgs.builder()
                        .encryptedLogGroupStrategy("ALLOW")
                        .logGroupSelectionCriteria("*")
                        .build())
                    .build())
                .build())
            .tags(Map.ofEntries(
                Map.entry("Name", "advanced-centralization-rule"),
                Map.entry("Environment", "production"),
                Map.entry("Team", "observability")
            ))
            .build());

    }
}

    resources:
  advanced:
    type: aws:observabilityadmin:CentralizationRuleForOrganization
    properties:
      ruleName: advanced-centralization-rule
      rule:
        destination:
          region: eu-west-1
          account: ${current.accountId}
          destinationLogsConfiguration:
            logsEncryptionConfiguration:
              encryptionStrategy: AWS_OWNED
            backupConfiguration:
              region: us-west-1
        source:
          regions:
            - ap-southeast-1
            - us-east-1
          scope: OrganizationId = '${currentGetOrganization.id}'
          sourceLogsConfiguration:
            encryptedLogGroupStrategy: ALLOW
            logGroupSelectionCriteria: '*'
      tags:
        Name: advanced-centralization-rule
        Environment: production
        Team: observability
variables:
  current:
    fn::invoke:
      function: aws:getCallerIdentity
      arguments: {}
  currentGetOrganization:
    fn::invoke:
      function: aws:organizations:getOrganization
      arguments: {}

    Selective Log Group Filtering

    import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const current = aws.getCallerIdentity({});
const currentGetOrganization = aws.organizations.getOrganization({});
const filtered = new aws.observabilityadmin.CentralizationRuleForOrganization("filtered", {
    ruleName: "filtered-centralization-rule",
    rule: {
        destination: {
            region: "eu-west-1",
            account: current.then(current => current.accountId),
        },
        source: {
            regions: [
                "ap-southeast-1",
                "us-east-1",
            ],
            scope: currentGetOrganization.then(currentGetOrganization => `OrganizationId = '${currentGetOrganization.id}'`),
            sourceLogsConfiguration: {
                encryptedLogGroupStrategy: "ALLOW",
                logGroupSelectionCriteria: "LogGroupName LIKE '/aws/lambda%'",
            },
        },
    },
    tags: {
        Name: "filtered-centralization-rule",
        Filter: "lambda-logs",
    },
});

    import pulumi
import pulumi_aws as aws

current = aws.get_caller_identity()
current_get_organization = aws.organizations.get_organization()
filtered = aws.observabilityadmin.CentralizationRuleForOrganization("filtered",
    rule_name="filtered-centralization-rule",
    rule={
        "destination": {
            "region": "eu-west-1",
            "account": current.account_id,
        },
        "source": {
            "regions": [
                "ap-southeast-1",
                "us-east-1",
            ],
            "scope": f"OrganizationId = '{current_get_organization.id}'",
            "source_logs_configuration": {
                "encrypted_log_group_strategy": "ALLOW",
                "log_group_selection_criteria": "LogGroupName LIKE '/aws/lambda%'",
            },
        },
    },
    tags={
        "Name": "filtered-centralization-rule",
        "Filter": "lambda-logs",
    })

    package main

import (
	"fmt"

	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws"
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/observabilityadmin"
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/organizations"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		current, err := aws.GetCallerIdentity(ctx, &aws.GetCallerIdentityArgs{}, nil)
		if err != nil {
			return err
		}
		currentGetOrganization, err := organizations.LookupOrganization(ctx, map[string]interface{}{}, nil)
		if err != nil {
			return err
		}
		_, err = observabilityadmin.NewCentralizationRuleForOrganization(ctx, "filtered", &observabilityadmin.CentralizationRuleForOrganizationArgs{
			RuleName: pulumi.String("filtered-centralization-rule"),
			Rule: &observabilityadmin.CentralizationRuleForOrganizationRuleArgs{
				Destination: &observabilityadmin.CentralizationRuleForOrganizationRuleDestinationArgs{
					Region:  pulumi.String("eu-west-1"),
					Account: pulumi.String(current.AccountId),
				},
				Source: &observabilityadmin.CentralizationRuleForOrganizationRuleSourceArgs{
					Regions: pulumi.StringArray{
						pulumi.String("ap-southeast-1"),
						pulumi.String("us-east-1"),
					},
					Scope: pulumi.Sprintf("OrganizationId = '%v'", currentGetOrganization.Id),
					SourceLogsConfiguration: &observabilityadmin.CentralizationRuleForOrganizationRuleSourceSourceLogsConfigurationArgs{
						EncryptedLogGroupStrategy: pulumi.String("ALLOW"),
						LogGroupSelectionCriteria: pulumi.String("LogGroupName LIKE '/aws/lambda%'"),
					},
				},
			},
			Tags: pulumi.StringMap{
				"Name":   pulumi.String("filtered-centralization-rule"),
				"Filter": pulumi.String("lambda-logs"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;

return await Deployment.RunAsync(() => 
{
    var current = Aws.GetCallerIdentity.Invoke();

    var currentGetOrganization = Aws.Organizations.GetOrganization.Invoke();

    var filtered = new Aws.Observabilityadmin.CentralizationRuleForOrganization("filtered", new()
    {
        RuleName = "filtered-centralization-rule",
        Rule = new Aws.Observabilityadmin.Inputs.CentralizationRuleForOrganizationRuleArgs
        {
            Destination = new Aws.Observabilityadmin.Inputs.CentralizationRuleForOrganizationRuleDestinationArgs
            {
                Region = "eu-west-1",
                Account = current.Apply(getCallerIdentityResult => getCallerIdentityResult.AccountId),
            },
            Source = new Aws.Observabilityadmin.Inputs.CentralizationRuleForOrganizationRuleSourceArgs
            {
                Regions = new[]
                {
                    "ap-southeast-1",
                    "us-east-1",
                },
                Scope = $"OrganizationId = '{currentGetOrganization.Apply(getOrganizationResult => getOrganizationResult.Id)}'",
                SourceLogsConfiguration = new Aws.Observabilityadmin.Inputs.CentralizationRuleForOrganizationRuleSourceSourceLogsConfigurationArgs
                {
                    EncryptedLogGroupStrategy = "ALLOW",
                    LogGroupSelectionCriteria = "LogGroupName LIKE '/aws/lambda%'",
                },
            },
        },
        Tags = 
        {
            { "Name", "filtered-centralization-rule" },
            { "Filter", "lambda-logs" },
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.AwsFunctions;
import com.pulumi.aws.inputs.GetCallerIdentityArgs;
import com.pulumi.aws.organizations.OrganizationsFunctions;
import com.pulumi.aws.observabilityadmin.CentralizationRuleForOrganization;
import com.pulumi.aws.observabilityadmin.CentralizationRuleForOrganizationArgs;
import com.pulumi.aws.observabilityadmin.inputs.CentralizationRuleForOrganizationRuleArgs;
import com.pulumi.aws.observabilityadmin.inputs.CentralizationRuleForOrganizationRuleDestinationArgs;
import com.pulumi.aws.observabilityadmin.inputs.CentralizationRuleForOrganizationRuleSourceArgs;
import com.pulumi.aws.observabilityadmin.inputs.CentralizationRuleForOrganizationRuleSourceSourceLogsConfigurationArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var current = AwsFunctions.getCallerIdentity(GetCallerIdentityArgs.builder()
            .build());

        final var currentGetOrganization = OrganizationsFunctions.getOrganization(%!v(PANIC=Format method: runtime error: invalid memory address or nil pointer dereference);

        var filtered = new CentralizationRuleForOrganization("filtered", CentralizationRuleForOrganizationArgs.builder()
            .ruleName("filtered-centralization-rule")
            .rule(CentralizationRuleForOrganizationRuleArgs.builder()
                .destination(CentralizationRuleForOrganizationRuleDestinationArgs.builder()
                    .region("eu-west-1")
                    .account(current.accountId())
                    .build())
                .source(CentralizationRuleForOrganizationRuleSourceArgs.builder()
                    .regions(                    
                        "ap-southeast-1",
                        "us-east-1")
                    .scope(String.format("OrganizationId = '%s'", currentGetOrganization.id()))
                    .sourceLogsConfiguration(CentralizationRuleForOrganizationRuleSourceSourceLogsConfigurationArgs.builder()
                        .encryptedLogGroupStrategy("ALLOW")
                        .logGroupSelectionCriteria("LogGroupName LIKE '/aws/lambda%'")
                        .build())
                    .build())
                .build())
            .tags(Map.ofEntries(
                Map.entry("Name", "filtered-centralization-rule"),
                Map.entry("Filter", "lambda-logs")
            ))
            .build());

    }
}

    resources:
  filtered:
    type: aws:observabilityadmin:CentralizationRuleForOrganization
    properties:
      ruleName: filtered-centralization-rule
      rule:
        destination:
          region: eu-west-1
          account: ${current.accountId}
        source:
          regions:
            - ap-southeast-1
            - us-east-1
          scope: OrganizationId = '${currentGetOrganization.id}'
          sourceLogsConfiguration:
            encryptedLogGroupStrategy: ALLOW
            logGroupSelectionCriteria: LogGroupName LIKE '/aws/lambda%'
      tags:
        Name: filtered-centralization-rule
        Filter: lambda-logs
variables:
  current:
    fn::invoke:
      function: aws:getCallerIdentity
      arguments: {}
  currentGetOrganization:
    fn::invoke:
      function: aws:organizations:getOrganization
      arguments: {}

    Create CentralizationRuleForOrganization Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new CentralizationRuleForOrganization(name: string, args: CentralizationRuleForOrganizationArgs, opts?: CustomResourceOptions);
    @overload
def CentralizationRuleForOrganization(resource_name: str,
                                      args: CentralizationRuleForOrganizationArgs,
                                      opts: Optional[ResourceOptions] = None)

@overload
def CentralizationRuleForOrganization(resource_name: str,
                                      opts: Optional[ResourceOptions] = None,
                                      rule_name: Optional[str] = None,
                                      region: Optional[str] = None,
                                      rule: Optional[CentralizationRuleForOrganizationRuleArgs] = None,
                                      tags: Optional[Mapping[str, str]] = None,
                                      timeouts: Optional[CentralizationRuleForOrganizationTimeoutsArgs] = None)
    func NewCentralizationRuleForOrganization(ctx *Context, name string, args CentralizationRuleForOrganizationArgs, opts ...ResourceOption) (*CentralizationRuleForOrganization, error)
    public CentralizationRuleForOrganization(string name, CentralizationRuleForOrganizationArgs args, CustomResourceOptions? opts = null)
    public CentralizationRuleForOrganization(String name, CentralizationRuleForOrganizationArgs args)
public CentralizationRuleForOrganization(String name, CentralizationRuleForOrganizationArgs args, CustomResourceOptions options)

    type: aws:observabilityadmin:CentralizationRuleForOrganization
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

    Parameters

    name string
    The unique name of the resource.
    args CentralizationRuleForOrganizationArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args CentralizationRuleForOrganizationArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args CentralizationRuleForOrganizationArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args CentralizationRuleForOrganizationArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args CentralizationRuleForOrganizationArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var centralizationRuleForOrganizationResource = new Aws.Observabilityadmin.CentralizationRuleForOrganization("centralizationRuleForOrganizationResource", new()
{
    RuleName = "string",
    Region = "string",
    Rule = new Aws.Observabilityadmin.Inputs.CentralizationRuleForOrganizationRuleArgs
    {
        Destination = new Aws.Observabilityadmin.Inputs.CentralizationRuleForOrganizationRuleDestinationArgs
        {
            Account = "string",
            Region = "string",
            DestinationLogsConfiguration = new Aws.Observabilityadmin.Inputs.CentralizationRuleForOrganizationRuleDestinationDestinationLogsConfigurationArgs
            {
                BackupConfiguration = new Aws.Observabilityadmin.Inputs.CentralizationRuleForOrganizationRuleDestinationDestinationLogsConfigurationBackupConfigurationArgs
                {
                    KmsKeyArn = "string",
                    Region = "string",
                },
                LogsEncryptionConfiguration = new Aws.Observabilityadmin.Inputs.CentralizationRuleForOrganizationRuleDestinationDestinationLogsConfigurationLogsEncryptionConfigurationArgs
                {
                    EncryptionStrategy = "string",
                    EncryptionConflictResolutionStrategy = "string",
                    KmsKeyArn = "string",
                },
            },
        },
        Source = new Aws.Observabilityadmin.Inputs.CentralizationRuleForOrganizationRuleSourceArgs
        {
            Regions = new[]
            {
                "string",
            },
            Scope = "string",
            SourceLogsConfiguration = new Aws.Observabilityadmin.Inputs.CentralizationRuleForOrganizationRuleSourceSourceLogsConfigurationArgs
            {
                EncryptedLogGroupStrategy = "string",
                LogGroupSelectionCriteria = "string",
            },
        },
    },
    Tags = 
    {
        { "string", "string" },
    },
    Timeouts = new Aws.Observabilityadmin.Inputs.CentralizationRuleForOrganizationTimeoutsArgs
    {
        Create = "string",
        Update = "string",
    },
});

    example, err := observabilityadmin.NewCentralizationRuleForOrganization(ctx, "centralizationRuleForOrganizationResource", &observabilityadmin.CentralizationRuleForOrganizationArgs{
	RuleName: pulumi.String("string"),
	Region:   pulumi.String("string"),
	Rule: &observabilityadmin.CentralizationRuleForOrganizationRuleArgs{
		Destination: &observabilityadmin.CentralizationRuleForOrganizationRuleDestinationArgs{
			Account: pulumi.String("string"),
			Region:  pulumi.String("string"),
			DestinationLogsConfiguration: &observabilityadmin.CentralizationRuleForOrganizationRuleDestinationDestinationLogsConfigurationArgs{
				BackupConfiguration: &observabilityadmin.CentralizationRuleForOrganizationRuleDestinationDestinationLogsConfigurationBackupConfigurationArgs{
					KmsKeyArn: pulumi.String("string"),
					Region:    pulumi.String("string"),
				},
				LogsEncryptionConfiguration: &observabilityadmin.CentralizationRuleForOrganizationRuleDestinationDestinationLogsConfigurationLogsEncryptionConfigurationArgs{
					EncryptionStrategy:                   pulumi.String("string"),
					EncryptionConflictResolutionStrategy: pulumi.String("string"),
					KmsKeyArn:                            pulumi.String("string"),
				},
			},
		},
		Source: &observabilityadmin.CentralizationRuleForOrganizationRuleSourceArgs{
			Regions: pulumi.StringArray{
				pulumi.String("string"),
			},
			Scope: pulumi.String("string"),
			SourceLogsConfiguration: &observabilityadmin.CentralizationRuleForOrganizationRuleSourceSourceLogsConfigurationArgs{
				EncryptedLogGroupStrategy: pulumi.String("string"),
				LogGroupSelectionCriteria: pulumi.String("string"),
			},
		},
	},
	Tags: pulumi.StringMap{
		"string": pulumi.String("string"),
	},
	Timeouts: &observabilityadmin.CentralizationRuleForOrganizationTimeoutsArgs{
		Create: pulumi.String("string"),
		Update: pulumi.String("string"),
	},
})

    var centralizationRuleForOrganizationResource = new CentralizationRuleForOrganization("centralizationRuleForOrganizationResource", CentralizationRuleForOrganizationArgs.builder()
    .ruleName("string")
    .region("string")
    .rule(CentralizationRuleForOrganizationRuleArgs.builder()
        .destination(CentralizationRuleForOrganizationRuleDestinationArgs.builder()
            .account("string")
            .region("string")
            .destinationLogsConfiguration(CentralizationRuleForOrganizationRuleDestinationDestinationLogsConfigurationArgs.builder()
                .backupConfiguration(CentralizationRuleForOrganizationRuleDestinationDestinationLogsConfigurationBackupConfigurationArgs.builder()
                    .kmsKeyArn("string")
                    .region("string")
                    .build())
                .logsEncryptionConfiguration(CentralizationRuleForOrganizationRuleDestinationDestinationLogsConfigurationLogsEncryptionConfigurationArgs.builder()
                    .encryptionStrategy("string")
                    .encryptionConflictResolutionStrategy("string")
                    .kmsKeyArn("string")
                    .build())
                .build())
            .build())
        .source(CentralizationRuleForOrganizationRuleSourceArgs.builder()
            .regions("string")
            .scope("string")
            .sourceLogsConfiguration(CentralizationRuleForOrganizationRuleSourceSourceLogsConfigurationArgs.builder()
                .encryptedLogGroupStrategy("string")
                .logGroupSelectionCriteria("string")
                .build())
            .build())
        .build())
    .tags(Map.of("string", "string"))
    .timeouts(CentralizationRuleForOrganizationTimeoutsArgs.builder()
        .create("string")
        .update("string")
        .build())
    .build());

    centralization_rule_for_organization_resource = aws.observabilityadmin.CentralizationRuleForOrganization("centralizationRuleForOrganizationResource",
    rule_name="string",
    region="string",
    rule={
        "destination": {
            "account": "string",
            "region": "string",
            "destination_logs_configuration": {
                "backup_configuration": {
                    "kms_key_arn": "string",
                    "region": "string",
                },
                "logs_encryption_configuration": {
                    "encryption_strategy": "string",
                    "encryption_conflict_resolution_strategy": "string",
                    "kms_key_arn": "string",
                },
            },
        },
        "source": {
            "regions": ["string"],
            "scope": "string",
            "source_logs_configuration": {
                "encrypted_log_group_strategy": "string",
                "log_group_selection_criteria": "string",
            },
        },
    },
    tags={
        "string": "string",
    },
    timeouts={
        "create": "string",
        "update": "string",
    })

    const centralizationRuleForOrganizationResource = new aws.observabilityadmin.CentralizationRuleForOrganization("centralizationRuleForOrganizationResource", {
    ruleName: "string",
    region: "string",
    rule: {
        destination: {
            account: "string",
            region: "string",
            destinationLogsConfiguration: {
                backupConfiguration: {
                    kmsKeyArn: "string",
                    region: "string",
                },
                logsEncryptionConfiguration: {
                    encryptionStrategy: "string",
                    encryptionConflictResolutionStrategy: "string",
                    kmsKeyArn: "string",
                },
            },
        },
        source: {
            regions: ["string"],
            scope: "string",
            sourceLogsConfiguration: {
                encryptedLogGroupStrategy: "string",
                logGroupSelectionCriteria: "string",
            },
        },
    },
    tags: {
        string: "string",
    },
    timeouts: {
        create: "string",
        update: "string",
    },
});

    type: aws:observabilityadmin:CentralizationRuleForOrganization
properties:
    region: string
    rule:
        destination:
            account: string
            destinationLogsConfiguration:
                backupConfiguration:
                    kmsKeyArn: string
                    region: string
                logsEncryptionConfiguration:
                    encryptionConflictResolutionStrategy: string
                    encryptionStrategy: string
                    kmsKeyArn: string
            region: string
        source:
            regions:
                - string
            scope: string
            sourceLogsConfiguration:
                encryptedLogGroupStrategy: string
                logGroupSelectionCriteria: string
    ruleName: string
    tags:
        string: string
    timeouts:
        create: string
        update: string

    CentralizationRuleForOrganization Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The CentralizationRuleForOrganization resource accepts the following input properties:

    RuleName string
    Name of the centralization rule. Must be unique within the organization.
    Region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    Rule CentralizationRuleForOrganizationRule

    Configuration block for the centralization rule. See rule below.

    The following arguments are optional:

    Tags Dictionary<string, string>
    Key-value map of resource tags. If configured with a provider default_tags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
    Timeouts CentralizationRuleForOrganizationTimeouts
    RuleName string
    Name of the centralization rule. Must be unique within the organization.
    Region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    Rule CentralizationRuleForOrganizationRuleArgs

    Configuration block for the centralization rule. See rule below.

    The following arguments are optional:

    Tags map[string]string
    Key-value map of resource tags. If configured with a provider default_tags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
    Timeouts CentralizationRuleForOrganizationTimeoutsArgs
    ruleName String
    Name of the centralization rule. Must be unique within the organization.
    region String
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    rule CentralizationRuleForOrganizationRule

    Configuration block for the centralization rule. See rule below.

    The following arguments are optional:

    tags Map<String,String>
    Key-value map of resource tags. If configured with a provider default_tags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
    timeouts CentralizationRuleForOrganizationTimeouts
    ruleName string
    Name of the centralization rule. Must be unique within the organization.
    region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    rule CentralizationRuleForOrganizationRule

    Configuration block for the centralization rule. See rule below.

    The following arguments are optional:

    tags {[key: string]: string}
    Key-value map of resource tags. If configured with a provider default_tags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
    timeouts CentralizationRuleForOrganizationTimeouts
    rule_name str
    Name of the centralization rule. Must be unique within the organization.
    region str
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    rule CentralizationRuleForOrganizationRuleArgs

    Configuration block for the centralization rule. See rule below.

    The following arguments are optional:

    tags Mapping[str, str]
    Key-value map of resource tags. If configured with a provider default_tags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
    timeouts CentralizationRuleForOrganizationTimeoutsArgs
    ruleName String
    Name of the centralization rule. Must be unique within the organization.
    region String
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    rule Property Map

    Configuration block for the centralization rule. See rule below.

    The following arguments are optional:

    tags Map<String>
    Key-value map of resource tags. If configured with a provider default_tags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
    timeouts Property Map

    Outputs

    All input properties are implicitly available as output properties. Additionally, the CentralizationRuleForOrganization resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    RuleArn string
    ARN of the centralization rule.
    TagsAll Dictionary<string, string>
    Map of tags assigned to the resource, including those inherited from the provider default_tags configuration block.
    Id string
    The provider-assigned unique ID for this managed resource.
    RuleArn string
    ARN of the centralization rule.
    TagsAll map[string]string
    Map of tags assigned to the resource, including those inherited from the provider default_tags configuration block.
    id String
    The provider-assigned unique ID for this managed resource.
    ruleArn String
    ARN of the centralization rule.
    tagsAll Map<String,String>
    Map of tags assigned to the resource, including those inherited from the provider default_tags configuration block.
    id string
    The provider-assigned unique ID for this managed resource.
    ruleArn string
    ARN of the centralization rule.
    tagsAll {[key: string]: string}
    Map of tags assigned to the resource, including those inherited from the provider default_tags configuration block.
    id str
    The provider-assigned unique ID for this managed resource.
    rule_arn str
    ARN of the centralization rule.
    tags_all Mapping[str, str]
    Map of tags assigned to the resource, including those inherited from the provider default_tags configuration block.
    id String
    The provider-assigned unique ID for this managed resource.
    ruleArn String
    ARN of the centralization rule.
    tagsAll Map<String>
    Map of tags assigned to the resource, including those inherited from the provider default_tags configuration block.

    Look up Existing CentralizationRuleForOrganization Resource

    Get an existing CentralizationRuleForOrganization resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: CentralizationRuleForOrganizationState, opts?: CustomResourceOptions): CentralizationRuleForOrganization
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        region: Optional[str] = None,
        rule: Optional[CentralizationRuleForOrganizationRuleArgs] = None,
        rule_arn: Optional[str] = None,
        rule_name: Optional[str] = None,
        tags: Optional[Mapping[str, str]] = None,
        tags_all: Optional[Mapping[str, str]] = None,
        timeouts: Optional[CentralizationRuleForOrganizationTimeoutsArgs] = None) -> CentralizationRuleForOrganization
    func GetCentralizationRuleForOrganization(ctx *Context, name string, id IDInput, state *CentralizationRuleForOrganizationState, opts ...ResourceOption) (*CentralizationRuleForOrganization, error)
    public static CentralizationRuleForOrganization Get(string name, Input<string> id, CentralizationRuleForOrganizationState? state, CustomResourceOptions? opts = null)
    public static CentralizationRuleForOrganization get(String name, Output<String> id, CentralizationRuleForOrganizationState state, CustomResourceOptions options)
    resources:  _:    type: aws:observabilityadmin:CentralizationRuleForOrganization    get:      id: ${id}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    Region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    Rule CentralizationRuleForOrganizationRule

    Configuration block for the centralization rule. See rule below.

    The following arguments are optional:

    RuleArn string
    ARN of the centralization rule.
    RuleName string
    Name of the centralization rule. Must be unique within the organization.
    Tags Dictionary<string, string>
    Key-value map of resource tags. If configured with a provider default_tags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
    TagsAll Dictionary<string, string>
    Map of tags assigned to the resource, including those inherited from the provider default_tags configuration block.
    Timeouts CentralizationRuleForOrganizationTimeouts
    Region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    Rule CentralizationRuleForOrganizationRuleArgs

    Configuration block for the centralization rule. See rule below.

    The following arguments are optional:

    RuleArn string
    ARN of the centralization rule.
    RuleName string
    Name of the centralization rule. Must be unique within the organization.
    Tags map[string]string
    Key-value map of resource tags. If configured with a provider default_tags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
    TagsAll map[string]string
    Map of tags assigned to the resource, including those inherited from the provider default_tags configuration block.
    Timeouts CentralizationRuleForOrganizationTimeoutsArgs
    region String
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    rule CentralizationRuleForOrganizationRule

    Configuration block for the centralization rule. See rule below.

    The following arguments are optional:

    ruleArn String
    ARN of the centralization rule.
    ruleName String
    Name of the centralization rule. Must be unique within the organization.
    tags Map<String,String>
    Key-value map of resource tags. If configured with a provider default_tags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
    tagsAll Map<String,String>
    Map of tags assigned to the resource, including those inherited from the provider default_tags configuration block.
    timeouts CentralizationRuleForOrganizationTimeouts
    region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    rule CentralizationRuleForOrganizationRule

    Configuration block for the centralization rule. See rule below.

    The following arguments are optional:

    ruleArn string
    ARN of the centralization rule.
    ruleName string
    Name of the centralization rule. Must be unique within the organization.
    tags {[key: string]: string}
    Key-value map of resource tags. If configured with a provider default_tags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
    tagsAll {[key: string]: string}
    Map of tags assigned to the resource, including those inherited from the provider default_tags configuration block.
    timeouts CentralizationRuleForOrganizationTimeouts
    region str
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    rule CentralizationRuleForOrganizationRuleArgs

    Configuration block for the centralization rule. See rule below.

    The following arguments are optional:

    rule_arn str
    ARN of the centralization rule.
    rule_name str
    Name of the centralization rule. Must be unique within the organization.
    tags Mapping[str, str]
    Key-value map of resource tags. If configured with a provider default_tags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
    tags_all Mapping[str, str]
    Map of tags assigned to the resource, including those inherited from the provider default_tags configuration block.
    timeouts CentralizationRuleForOrganizationTimeoutsArgs
    region String
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    rule Property Map

    Configuration block for the centralization rule. See rule below.

    The following arguments are optional:

    ruleArn String
    ARN of the centralization rule.
    ruleName String
    Name of the centralization rule. Must be unique within the organization.
    tags Map<String>
    Key-value map of resource tags. If configured with a provider default_tags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
    tagsAll Map<String>
    Map of tags assigned to the resource, including those inherited from the provider default_tags configuration block.
    timeouts Property Map

    Supporting Types

    CentralizationRuleForOrganizationRule, CentralizationRuleForOrganizationRuleArgs

    Destination CentralizationRuleForOrganizationRuleDestination
    Configuration block for the destination where logs will be centralized. See destination below.
    Source CentralizationRuleForOrganizationRuleSource
    Configuration block for the source of logs to be centralized. See source below.
    Destination CentralizationRuleForOrganizationRuleDestination
    Configuration block for the destination where logs will be centralized. See destination below.
    Source CentralizationRuleForOrganizationRuleSource
    Configuration block for the source of logs to be centralized. See source below.
    destination CentralizationRuleForOrganizationRuleDestination
    Configuration block for the destination where logs will be centralized. See destination below.
    source CentralizationRuleForOrganizationRuleSource
    Configuration block for the source of logs to be centralized. See source below.
    destination CentralizationRuleForOrganizationRuleDestination
    Configuration block for the destination where logs will be centralized. See destination below.
    source CentralizationRuleForOrganizationRuleSource
    Configuration block for the source of logs to be centralized. See source below.
    destination CentralizationRuleForOrganizationRuleDestination
    Configuration block for the destination where logs will be centralized. See destination below.
    source CentralizationRuleForOrganizationRuleSource
    Configuration block for the source of logs to be centralized. See source below.
    destination Property Map
    Configuration block for the destination where logs will be centralized. See destination below.
    source Property Map
    Configuration block for the source of logs to be centralized. See source below.

    CentralizationRuleForOrganizationRuleDestination, CentralizationRuleForOrganizationRuleDestinationArgs

    Account string
    AWS account ID where logs will be centralized.
    Region string
    AWS region where logs will be centralized.
    DestinationLogsConfiguration CentralizationRuleForOrganizationRuleDestinationDestinationLogsConfiguration
    Configuration block for destination logs settings. See destination_logs_configuration below.
    Account string
    AWS account ID where logs will be centralized.
    Region string
    AWS region where logs will be centralized.
    DestinationLogsConfiguration CentralizationRuleForOrganizationRuleDestinationDestinationLogsConfiguration
    Configuration block for destination logs settings. See destination_logs_configuration below.
    account String
    AWS account ID where logs will be centralized.
    region String
    AWS region where logs will be centralized.
    destinationLogsConfiguration CentralizationRuleForOrganizationRuleDestinationDestinationLogsConfiguration
    Configuration block for destination logs settings. See destination_logs_configuration below.
    account string
    AWS account ID where logs will be centralized.
    region string
    AWS region where logs will be centralized.
    destinationLogsConfiguration CentralizationRuleForOrganizationRuleDestinationDestinationLogsConfiguration
    Configuration block for destination logs settings. See destination_logs_configuration below.
    account str
    AWS account ID where logs will be centralized.
    region str
    AWS region where logs will be centralized.
    destination_logs_configuration CentralizationRuleForOrganizationRuleDestinationDestinationLogsConfiguration
    Configuration block for destination logs settings. See destination_logs_configuration below.
    account String
    AWS account ID where logs will be centralized.
    region String
    AWS region where logs will be centralized.
    destinationLogsConfiguration Property Map
    Configuration block for destination logs settings. See destination_logs_configuration below.

    CentralizationRuleForOrganizationRuleDestinationDestinationLogsConfiguration, CentralizationRuleForOrganizationRuleDestinationDestinationLogsConfigurationArgs

    BackupConfiguration CentralizationRuleForOrganizationRuleDestinationDestinationLogsConfigurationBackupConfiguration
    Configuration block for backup settings. See backup_configuration below.
    LogsEncryptionConfiguration CentralizationRuleForOrganizationRuleDestinationDestinationLogsConfigurationLogsEncryptionConfiguration
    Configuration block for logs encryption settings. See logs_encryption_configuration below.
    BackupConfiguration CentralizationRuleForOrganizationRuleDestinationDestinationLogsConfigurationBackupConfiguration
    Configuration block for backup settings. See backup_configuration below.
    LogsEncryptionConfiguration CentralizationRuleForOrganizationRuleDestinationDestinationLogsConfigurationLogsEncryptionConfiguration
    Configuration block for logs encryption settings. See logs_encryption_configuration below.
    backupConfiguration CentralizationRuleForOrganizationRuleDestinationDestinationLogsConfigurationBackupConfiguration
    Configuration block for backup settings. See backup_configuration below.
    logsEncryptionConfiguration CentralizationRuleForOrganizationRuleDestinationDestinationLogsConfigurationLogsEncryptionConfiguration
    Configuration block for logs encryption settings. See logs_encryption_configuration below.
    backupConfiguration CentralizationRuleForOrganizationRuleDestinationDestinationLogsConfigurationBackupConfiguration
    Configuration block for backup settings. See backup_configuration below.
    logsEncryptionConfiguration CentralizationRuleForOrganizationRuleDestinationDestinationLogsConfigurationLogsEncryptionConfiguration
    Configuration block for logs encryption settings. See logs_encryption_configuration below.
    backupConfiguration Property Map
    Configuration block for backup settings. See backup_configuration below.
    logsEncryptionConfiguration Property Map
    Configuration block for logs encryption settings. See logs_encryption_configuration below.

    CentralizationRuleForOrganizationRuleDestinationDestinationLogsConfigurationBackupConfiguration, CentralizationRuleForOrganizationRuleDestinationDestinationLogsConfigurationBackupConfigurationArgs

    KmsKeyArn string
    ARN of the KMS key to use for backup encryption.
    Region string
    AWS region for backup storage.
    KmsKeyArn string
    ARN of the KMS key to use for backup encryption.
    Region string
    AWS region for backup storage.
    kmsKeyArn String
    ARN of the KMS key to use for backup encryption.
    region String
    AWS region for backup storage.
    kmsKeyArn string
    ARN of the KMS key to use for backup encryption.
    region string
    AWS region for backup storage.
    kms_key_arn str
    ARN of the KMS key to use for backup encryption.
    region str
    AWS region for backup storage.
    kmsKeyArn String
    ARN of the KMS key to use for backup encryption.
    region String
    AWS region for backup storage.

    CentralizationRuleForOrganizationRuleDestinationDestinationLogsConfigurationLogsEncryptionConfiguration, CentralizationRuleForOrganizationRuleDestinationDestinationLogsConfigurationLogsEncryptionConfigurationArgs

    EncryptionStrategy string
    Encryption strategy for logs. Valid values: AWS_OWNED, CUSTOMER_MANAGED.
    EncryptionConflictResolutionStrategy string
    Strategy for resolving encryption conflicts. Valid values: ALLOW, SKIP.
    KmsKeyArn string
    ARN of the KMS key to use for encryption when encryption_strategy is CUSTOMER_MANAGED.
    EncryptionStrategy string
    Encryption strategy for logs. Valid values: AWS_OWNED, CUSTOMER_MANAGED.
    EncryptionConflictResolutionStrategy string
    Strategy for resolving encryption conflicts. Valid values: ALLOW, SKIP.
    KmsKeyArn string
    ARN of the KMS key to use for encryption when encryption_strategy is CUSTOMER_MANAGED.
    encryptionStrategy String
    Encryption strategy for logs. Valid values: AWS_OWNED, CUSTOMER_MANAGED.
    encryptionConflictResolutionStrategy String
    Strategy for resolving encryption conflicts. Valid values: ALLOW, SKIP.
    kmsKeyArn String
    ARN of the KMS key to use for encryption when encryption_strategy is CUSTOMER_MANAGED.
    encryptionStrategy string
    Encryption strategy for logs. Valid values: AWS_OWNED, CUSTOMER_MANAGED.
    encryptionConflictResolutionStrategy string
    Strategy for resolving encryption conflicts. Valid values: ALLOW, SKIP.
    kmsKeyArn string
    ARN of the KMS key to use for encryption when encryption_strategy is CUSTOMER_MANAGED.
    encryption_strategy str
    Encryption strategy for logs. Valid values: AWS_OWNED, CUSTOMER_MANAGED.
    encryption_conflict_resolution_strategy str
    Strategy for resolving encryption conflicts. Valid values: ALLOW, SKIP.
    kms_key_arn str
    ARN of the KMS key to use for encryption when encryption_strategy is CUSTOMER_MANAGED.
    encryptionStrategy String
    Encryption strategy for logs. Valid values: AWS_OWNED, CUSTOMER_MANAGED.
    encryptionConflictResolutionStrategy String
    Strategy for resolving encryption conflicts. Valid values: ALLOW, SKIP.
    kmsKeyArn String
    ARN of the KMS key to use for encryption when encryption_strategy is CUSTOMER_MANAGED.

    CentralizationRuleForOrganizationRuleSource, CentralizationRuleForOrganizationRuleSourceArgs

    Regions List<string>
    Set of AWS regions from which to centralize logs. Must contain at least one region.
    Scope string
    Scope defining which resources to include. Use organization ID format: OrganizationId = 'o-example123456'.
    SourceLogsConfiguration CentralizationRuleForOrganizationRuleSourceSourceLogsConfiguration
    Configuration block for source logs settings. See source_logs_configuration below.
    Regions []string
    Set of AWS regions from which to centralize logs. Must contain at least one region.
    Scope string
    Scope defining which resources to include. Use organization ID format: OrganizationId = 'o-example123456'.
    SourceLogsConfiguration CentralizationRuleForOrganizationRuleSourceSourceLogsConfiguration
    Configuration block for source logs settings. See source_logs_configuration below.
    regions List<String>
    Set of AWS regions from which to centralize logs. Must contain at least one region.
    scope String
    Scope defining which resources to include. Use organization ID format: OrganizationId = 'o-example123456'.
    sourceLogsConfiguration CentralizationRuleForOrganizationRuleSourceSourceLogsConfiguration
    Configuration block for source logs settings. See source_logs_configuration below.
    regions string[]
    Set of AWS regions from which to centralize logs. Must contain at least one region.
    scope string
    Scope defining which resources to include. Use organization ID format: OrganizationId = 'o-example123456'.
    sourceLogsConfiguration CentralizationRuleForOrganizationRuleSourceSourceLogsConfiguration
    Configuration block for source logs settings. See source_logs_configuration below.
    regions Sequence[str]
    Set of AWS regions from which to centralize logs. Must contain at least one region.
    scope str
    Scope defining which resources to include. Use organization ID format: OrganizationId = 'o-example123456'.
    source_logs_configuration CentralizationRuleForOrganizationRuleSourceSourceLogsConfiguration
    Configuration block for source logs settings. See source_logs_configuration below.
    regions List<String>
    Set of AWS regions from which to centralize logs. Must contain at least one region.
    scope String
    Scope defining which resources to include. Use organization ID format: OrganizationId = 'o-example123456'.
    sourceLogsConfiguration Property Map
    Configuration block for source logs settings. See source_logs_configuration below.

    CentralizationRuleForOrganizationRuleSourceSourceLogsConfiguration, CentralizationRuleForOrganizationRuleSourceSourceLogsConfigurationArgs

    EncryptedLogGroupStrategy string
    Strategy for handling encrypted log groups. Valid values: ALLOW, SKIP.
    LogGroupSelectionCriteria string
    Criteria for selecting log groups. Use * for all log groups or OAM filter syntax like LogGroupName LIKE '/aws/lambda%'. Must be between 1 and 2000 characters.
    EncryptedLogGroupStrategy string
    Strategy for handling encrypted log groups. Valid values: ALLOW, SKIP.
    LogGroupSelectionCriteria string
    Criteria for selecting log groups. Use * for all log groups or OAM filter syntax like LogGroupName LIKE '/aws/lambda%'. Must be between 1 and 2000 characters.
    encryptedLogGroupStrategy String
    Strategy for handling encrypted log groups. Valid values: ALLOW, SKIP.
    logGroupSelectionCriteria String
    Criteria for selecting log groups. Use * for all log groups or OAM filter syntax like LogGroupName LIKE '/aws/lambda%'. Must be between 1 and 2000 characters.
    encryptedLogGroupStrategy string
    Strategy for handling encrypted log groups. Valid values: ALLOW, SKIP.
    logGroupSelectionCriteria string
    Criteria for selecting log groups. Use * for all log groups or OAM filter syntax like LogGroupName LIKE '/aws/lambda%'. Must be between 1 and 2000 characters.
    encrypted_log_group_strategy str
    Strategy for handling encrypted log groups. Valid values: ALLOW, SKIP.
    log_group_selection_criteria str
    Criteria for selecting log groups. Use * for all log groups or OAM filter syntax like LogGroupName LIKE '/aws/lambda%'. Must be between 1 and 2000 characters.
    encryptedLogGroupStrategy String
    Strategy for handling encrypted log groups. Valid values: ALLOW, SKIP.
    logGroupSelectionCriteria String
    Criteria for selecting log groups. Use * for all log groups or OAM filter syntax like LogGroupName LIKE '/aws/lambda%'. Must be between 1 and 2000 characters.

    CentralizationRuleForOrganizationTimeouts, CentralizationRuleForOrganizationTimeoutsArgs

    Create string
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
    Update string
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
    Create string
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
    Update string
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
    create String
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
    update String
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
    create string
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
    update string
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
    create str
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
    update str
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
    create String
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
    update String
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).

    Import

    Using pulumi import, import CloudWatch Observability Admin Centralization Rule For Organization using the rule_name. For example:

    $ pulumi import aws:observabilityadmin/centralizationRuleForOrganization:CentralizationRuleForOrganization example example-centralization-rule

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    AWS Classic pulumi/pulumi-aws
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the aws Terraform Provider.
    aws logo
    AWS v7.13.0 published on Tuesday, Dec 9, 2025 by Pulumi
    Schema (JSON)
    pulumi/pulumi-aws
      Meet Neo: Your AI Platform Teammate