Add data events detection to AWSID infra (#331)

thinkst · Jan 12, 2024 · 105ee0a · 105ee0a
1 parent ca1e028
commit 105ee0a
Showing 1 changed file with 14 additions and 0 deletions.
diff --git a/aws-token-infra/awsid.tf b/aws-token-infra/awsid.tf
@@ -248,6 +248,20 @@ resource "aws_cloudtrail" "canarytoken_logs" {
   s3_key_prefix                 = ""
   cloud_watch_logs_group_arn    = "${aws_cloudwatch_log_group.process_user_api_tokens_logs.arn}:*"
   cloud_watch_logs_role_arn     = aws_iam_role.process_user_api_tokens_logs_cloudtrail.arn
+  event_selector {
+    read_write_type           = "All"
+    include_management_events = true
+
+    data_resource {
+      type   = "AWS::S3::Object"
+      values = ["arn:aws:s3:::"]
+    }
+
+    data_resource {
+      type   = "AWS::Lambda::Function"
+      values = ["arn:aws:lambda"]
+    }
+  }
 }
 
 # ProcessUserAPITokensLogs