From 811130be70ae4b9bc06643d360c76aa79b6e993c Mon Sep 17 00:00:00 2001
From: Correna Sprowls <correna.sprowls@joinroot.com>
Date: Tue, 10 Mar 2026 11:26:59 -0400
Subject: [PATCH] Adds Selection Criteria parameter to aws account level logs

---
 aws_account_level_logs/main.yaml          | 7 +++++++
 aws_account_level_logs/single-region.yaml | 7 ++++++-
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/aws_account_level_logs/main.yaml b/aws_account_level_logs/main.yaml
index 7170cbb8..ddf5d179 100644
--- a/aws_account_level_logs/main.yaml
+++ b/aws_account_level_logs/main.yaml
@@ -27,6 +27,11 @@ Parameters:
     Type: CommaDelimitedList
     ConstraintDescription: Regions is required
     Default: ''
+  SelectionCriteria:
+    Description: >-
+      Optional subscription selection criteria.
+    Type: String
+    Default: "LogGroupName NOT IN [\"MyLogGroup\", \"MyAnotherLogGroup\"]"
 Resources:
   DatadogAccountLevelLogsStackSetAdministrationRole:
     Type: AWS::IAM::Role
@@ -285,6 +290,8 @@ Resources:
           ParameterValue: !GetAtt CloudWatchLogsRole.Arn
         - ParameterKey: FirehoseLogsRoleArn
           ParameterValue: !GetAtt FirehoseLogsRole.Arn
+        - ParameterKey: SelectionCriteria
+          ParameterValue: !Ref SelectionCriteria
 Metadata:
   AWS::CloudFormation::Interface:
     ParameterGroups:
diff --git a/aws_account_level_logs/single-region.yaml b/aws_account_level_logs/single-region.yaml
index dce43c1f..32c44eb4 100644
--- a/aws_account_level_logs/single-region.yaml
+++ b/aws_account_level_logs/single-region.yaml
@@ -32,6 +32,11 @@ Parameters:
     Type: String
     AllowedPattern: .+
     ConstraintDescription: DatadogHttpEndpointUrl is required
+  SelectionCriteria:
+    Description: >-
+      Optional subscription selection criteria.
+    Type: String
+    Default: "LogGroupName NOT IN [\"MyLogGroup\", \"MyAnotherLogGroup\"]"
 
 Resources:
 
@@ -93,6 +98,6 @@ Resources:
           - "\", \"DestinationArn\":\""
           - Fn::GetAtt: "DatadogDeliveryStream.Arn"
           - "\", \"FilterPattern\": \"\", \"Distribution\": \"Random\"}"
-      SelectionCriteria: "LogGroupName NOT IN [\"MyLogGroup\", \"MyAnotherLogGroup\"]"
+      SelectionCriteria: !Ref SelectionCriteria
       PolicyType: "SUBSCRIPTION_FILTER_POLICY"
       Scope: "ALL"