-
Notifications
You must be signed in to change notification settings - Fork 4
/
main.tf
29 lines (25 loc) · 977 Bytes
/
main.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
resource "aws_cloudwatch_event_rule" "main" {
name = "guardduty-finding-events"
description = "AWS GuardDuty event findings"
event_pattern = file("${path.module}/event-pattern.json")
}
# More details about the response syntax can be found here:
# https://docs.aws.amazon.com/guardduty/latest/ug/get-findings.html#get-findings-response-syntax
resource "aws_cloudwatch_event_target" "mail" {
rule = aws_cloudwatch_event_rule.main.name
target_id = "send-to-sns"
arn = var.sns_topic.arn
input_transformer {
input_paths = {
title = "$.detail.title"
description = "$.detail.description"
eventTime = "$.detail.service.eventFirstSeen"
region = "$.detail.region"
severity = "$.detail.severity"
finding_type = "$.detail.type"
finding_id = "$.detail.id"
account_id = "$.detail.accountId"
}
input_template = file("${path.module}/input-template.txt")
}
}