Adds the synthetic hello event from the MVP onboarding flow, so the connection
can be verified end to end without changing any real resource. A dedicated rule
matches source prowler.simulation and detail-type test_connection, since no
CloudTrail event pattern would, and forwards it through the same connection,
API destination, API key and endpoint as a real event.
In CloudFormation a custom resource emits the event on create and update. Its
function only holds events:PutEvents on the default bus plus its own log group,
and always answers SUCCESS: a failed verification must never roll back the scan
role. Terraform documents the equivalent put-events command instead, because an
apply already runs from a shell with credentials.
The invoke role trust policy and the dead-letter queue policy now allow both
rule ARNs; scoped to a single rule, the hello event would have been dropped
with no explanation.
Adds an SQS dead-letter queue to the real-time detection target, in both the
CloudFormation and Terraform templates, so a delivery failure is auditable
instead of silent. EventBridge retries for up to 24 hours and then writes the
event to the queue with the error code and attempt count; responses that are
never retried land there on the first attempt.
EventBridge delivers to a DLQ as a service rather than through the target
invoke role, so the queue carries a resource policy granting sqs:SendMessage
to events.amazonaws.com, scoped to the rule ARN. The queue uses SQS-managed
encryption to avoid granting KMS permissions, and keeps messages for the
14-day maximum. Prowler is granted no access to it.
ProwlerWebhookUrl and prowler_webhook_url now default to
https://api.prowler.com/api/v1/realtime/events, matching the ingest path
defined in the MVP and the API base already used elsewhere in the repo.
Enabling real-time detection now only requires pasting the API key; the
endpoint is overridden only for self-hosted deployments or testing.
Adds an opt-in EventBridge integration to the CloudFormation and Terraform
onboarding templates. When enabled, the tracked CloudTrail management events
are forwarded to Prowler Cloud through an API destination, so a change is
scanned within minutes instead of waiting for the next scheduled scan.
The whole block is gated behind EnableRealtimeDetection / enable_realtime_detection,
both defaulting to false, so the existing onboarding is unchanged unless
explicitly opted in. No new read permissions are added to the ProwlerScan role.
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
César Arroba