1import type * as obs from "@distilled.cloud/aws/observabilityadmin";
2import type * as Effect from "effect/Effect";
3import * as Binding from "../../Binding.ts";
4
5/**
6 * Runtime binding for `observabilityadmin:ListResourceTelemetry` — audits
7 * which AWS resources (VPCs, Lambda functions, ...) have telemetry such as
8 * flow logs configured, and in what state. The account-level telemetry
9 * config data plane; requires the account to be onboarded (see
10 * `ObservabilityAdmin.TelemetryConfig`).
11 *
12 * Provide `AWS.ObservabilityAdmin.ListResourceTelemetryHttp` on the hosting
13 * Lambda Function to satisfy the requirement.
14 *
15 * Known platform quirk (observed 2026-07): the service's authorization for
16 * this action can reject callers whose grant comes from an inline role
17 * policy (even `observabilityadmin:*` on `Resource: "*"`) with a typed
18 * `AccessDeniedException`, while principals with managed policies succeed.
19 * Handle the typed tag until AWS fixes the action's auth integration.
20 * ### Auditing Resource Telemetry
21 * **Example:** Find VPCs without flow logs
22 * ```typescript
23 * // init — grants observabilityadmin:ListResourceTelemetry
24 * const listResourceTelemetry = yield* AWS.ObservabilityAdmin.ListResourceTelemetry();
25 *
26 * // runtime
27 * const { TelemetryConfigurations } = yield* listResourceTelemetry({
28 * ResourceTypes: ["AWS::EC2::VPC"],
29 * TelemetryConfigurationState: { Logs: "NotEnabled" },
30 * });
31 * ```
32 *
33 * @binding
34 */
35export interface ListResourceTelemetry extends Binding.Service<
36 ListResourceTelemetry,
37 "AWS.ObservabilityAdmin.ListResourceTelemetry",
38 () => Effect.Effect<
39 (
40 request?: obs.ListResourceTelemetryInput,
41 ) => Effect.Effect<
42 obs.ListResourceTelemetryOutput,
43 obs.ListResourceTelemetryError
44 >
45 >
46> {}
47
48export const ListResourceTelemetry = Binding.Service<ListResourceTelemetry>(
49 "AWS.ObservabilityAdmin.ListResourceTelemetry",
50);