三歩あるけば物も忘れる

「ログメトリクスフィルターとアラームが存在すること」系をEventBridgeに置き換えられないか検討してみた。

EventsBridgeSampleTemplate

AWSTemplateFormatVersion: 2010-09-09

Security Hub のイベント取得

        {
          "source": ["aws.securityhub"],
          "detail-type": ["Security Hub Findings - Imported"],
          "detail": {
            "findings": {
              "Compliance": {
                "Status": [{
                    "anything-but": "PASSED"
                }]
              },
              "RecordState": ["ACTIVE"],
              "Resources": {
                "Type": [{
                    "anything-but": "AwsAccount"
                }]
              },
              "Workflow": {
                "Status": ["NEW"]
             }
            }
          }
        }

Access Analyzer のイベント取得

        {
          "source": [
            "aws.access-analyzer"
          ],
          "detail-type": [
            "Access Analyzer Finding","Access Preview State Change"
          ]
        }

GuardDuty のイベント取得

{
  "source": [
    "aws.guardduty"
  ],
  "detail": {
    "type": [
      "UnauthorizedAccess:EC2/MaliciousIPCaller.Custom"
     ]
  }
}

追加したConfigルールのチェック

        {
          "detail": {
            "eventSource": [
              "config.amazonaws.com"
            ],
            "eventName": [
              "PutEvaluations"
            ],
            "requestParameters": {
              "evaluations": {
                "complianceType": [
                  "NON_COMPLIANT"
                ]
              }
            },
            "additionalEventData": {
              "managedRuleIdentifier": ["LAMBDA_INSIDE_VPC","EIP_ATTACHED","CLOUD_TRAIL_ENABLED"]
            }
          }
        }