feat(permissions): default the real-time detection endpoint to Prowler Cloud

ProwlerWebhookUrl and prowler_webhook_url now default to
https://api.prowler.com/api/v1/realtime/events, matching the ingest path
defined in the MVP and the API base already used elsewhere in the repo.
Enabling real-time detection now only requires pasting the API key; the
endpoint is overridden only for self-hosted deployments or testing.

permissions/templates/cloudformation/prowler-scan-role.yml

@@ -80,10 +80,10 @@ Parameters:
 
   ProwlerWebhookUrl:
     Description: |
-      Prowler Cloud endpoint that receives the events. Provided during Prowler Cloud onboarding.
-      Required if EnableRealtimeDetection is true.
+      Prowler Cloud endpoint that receives the events. Defaults to the Prowler Cloud ingest endpoint;
+      change it only for a self-hosted deployment or for testing. Required if EnableRealtimeDetection is true.
     Type: String
-    Default: ""
+    Default: "https://api.prowler.com/api/v1/realtime/events"
     AllowedPattern: '^(https://.+)?$'
     ConstraintDescription: "ProwlerWebhookUrl must be an HTTPS URL."
 
@@ -768,7 +768,7 @@ Metadata:
           - S3IntegrationBucketName
           - S3IntegrationBucketAccountId
       - Label:
-          default: Optional Real-Time Detection (Required if EnableRealtimeDetection is true)
+          default: Optional Real-Time Detection (ProwlerApiKey required if EnableRealtimeDetection is true)
         Parameters:
           - ProwlerWebhookUrl
           - ProwlerApiKey

permissions/templates/terraform/README.md

@@ -26,7 +26,7 @@ This Terraform configuration creates the necessary IAM role and policies to allo
 - `s3_integration_bucket_name` (conditional): S3 bucket name for reports (required if `enable_s3_integration` is true)
 - `s3_integration_bucket_account_id` (conditional): S3 bucket owner account ID (required if `enable_s3_integration` is true)
 - `enable_realtime_detection` (optional): Forward the tracked CloudTrail management events to Prowler Cloud through an EventBridge API destination (default: false)
-- `prowler_webhook_url` (conditional): Prowler Cloud endpoint that receives the events (required if `enable_realtime_detection` is true)
+- `prowler_webhook_url` (optional): Prowler Cloud endpoint that receives the events (defaults to Prowler Cloud: `https://api.prowler.com/api/v1/realtime/events`; change it only for a self-hosted deployment or for testing)
 - `prowler_api_key` (conditional): Prowler Cloud API key used to authenticate the events (required if `enable_realtime_detection` is true)
 
 ### Usage Examples
@@ -50,10 +50,11 @@ terraform apply \
 terraform apply \
   -var="external_id=your-external-id-here" \
   -var="enable_realtime_detection=true" \
-  -var="prowler_webhook_url=https://api.prowler.com/api/v1/realtime/events" \
   -var="prowler_api_key=your-prowler-api-key-here"
 ```
 
+`prowler_webhook_url` already defaults to the Prowler Cloud ingest endpoint, so only the API key is needed. Override it for a self-hosted deployment or for testing.
+
 > **Note:** the EventBridge rule is regional. It forwards only the events delivered to the default event bus of the region Terraform deploys to (`us-east-1` by default, see `versions.tf`). IAM events are global and always land in `us-east-1`, but regional services (EC2 security groups, RDS, per-region Config and GuardDuty) are only covered in that region. Deploy the module in every region you want covered.
 
 #### Using terraform.tfvars file (Recommended)

permissions/templates/terraform/terraform.tfvars.example

@@ -40,7 +40,8 @@ external_id = "your-unique-external-id-here"
 # Enable real-time detection
 # enable_realtime_detection = true
 
-# Prowler Cloud endpoint that receives the events (provided during onboarding)
+# Prowler Cloud endpoint that receives the events (leave default unless
+# self-hosted or testing against another endpoint)
 # prowler_webhook_url = "https://api.prowler.com/api/v1/realtime/events"
 
 # Prowler Cloud API key used to authenticate the events (shown once during onboarding)

permissions/templates/terraform/variables.tf

@@ -69,8 +69,8 @@ variable "enable_realtime_detection" {
 
 variable "prowler_webhook_url" {
   type        = string
-  description = "Prowler Cloud endpoint that receives the events. Provided during Prowler Cloud onboarding. Required if enable_realtime_detection is true."
-  default     = ""
+  description = "Prowler Cloud endpoint that receives the events. Defaults to the Prowler Cloud ingest endpoint; change it only for a self-hosted deployment or for testing."
+  default     = "https://api.prowler.com/api/v1/realtime/events"
 
   validation {
     condition     = var.prowler_webhook_url == "" || can(regex("^https://", var.prowler_webhook_url))