ListResourceTelemetry

Source: src/AWS/ObservabilityAdmin/ListResourceTelemetry.ts

Runtime binding for observabilityadmin:ListResourceTelemetry — audits which AWS resources (VPCs, Lambda functions, …) have telemetry such as flow logs configured, and in what state. The account-level telemetry config data plane; requires the account to be onboarded (see ObservabilityAdmin.TelemetryConfig).

Provide AWS.ObservabilityAdmin.ListResourceTelemetryHttp on the hosting Lambda Function to satisfy the requirement.

Known platform quirk (observed 2026-07): the service’s authorization for this action can reject callers whose grant comes from an inline role policy (even observabilityadmin:* on Resource: "*") with a typed AccessDeniedException, while principals with managed policies succeed. Handle the typed tag until AWS fixes the action’s auth integration.

Auditing Resource Telemetry

// init — grants observabilityadmin:ListResourceTelemetry
const listResourceTelemetry = yield* AWS.ObservabilityAdmin.ListResourceTelemetry();

// runtime
const { TelemetryConfigurations } = yield* listResourceTelemetry({
  ResourceTypes: ["AWS::EC2::VPC"],
  TelemetryConfigurationState: { Logs: "NotEnabled" },
});