Constrains the catalog rule to genuine AWS service events with a source prefix,
which PutEvents cannot forge, so a caller inside the account can no longer inject
a CloudTrail-shaped event into the Prowler pipeline.
Makes the Terraform deploy region an input instead of a hardcoded us-east-1,
which contradicted a README that told users to deploy once per region, and adds
the region to the manual put-events command so it reaches the right bus.
Renames the hello event status to Published and reworks the wording around it:
EventBridge accepting an event is not the endpoint receiving it, and Prowler
Cloud is what confirms the connection. Documents that Terraform writes the API
key to state, so the key belongs in a secret manager and the state in an
encrypted remote backend.
Adds the hello event emitter to the Terraform path, so both onboarding
templates verify the connection by themselves and leave the same footprint in
the account: a function whose only permissions are events:PutEvents on the
default bus and its own log group, invoked once on apply and again whenever the
endpoint changes.
The apply reports the outcome through the prowler_realtime_hello_status output,
and the function never raises, so a failed verification cannot fail the apply
that created the scan role.
Adds the synthetic hello event from the MVP onboarding flow, so the connection
can be verified end to end without changing any real resource. A dedicated rule
matches source prowler.simulation and detail-type test_connection, since no
CloudTrail event pattern would, and forwards it through the same connection,
API destination, API key and endpoint as a real event.
In CloudFormation a custom resource emits the event on create and update. Its
function only holds events:PutEvents on the default bus plus its own log group,
and always answers SUCCESS: a failed verification must never roll back the scan
role. Terraform documents the equivalent put-events command instead, because an
apply already runs from a shell with credentials.
The invoke role trust policy and the dead-letter queue policy now allow both
rule ARNs; scoped to a single rule, the hello event would have been dropped
with no explanation.
Adds an SQS dead-letter queue to the real-time detection target, in both the
CloudFormation and Terraform templates, so a delivery failure is auditable
instead of silent. EventBridge retries for up to 24 hours and then writes the
event to the queue with the error code and attempt count; responses that are
never retried land there on the first attempt.
EventBridge delivers to a DLQ as a service rather than through the target
invoke role, so the queue carries a resource policy granting sqs:SendMessage
to events.amazonaws.com, scoped to the rule ARN. The queue uses SQS-managed
encryption to avoid granting KMS permissions, and keeps messages for the
14-day maximum. Prowler is granted no access to it.
ProwlerWebhookUrl and prowler_webhook_url now default to
https://api.prowler.com/api/v1/realtime/events, matching the ingest path
defined in the MVP and the API base already used elsewhere in the repo.
Enabling real-time detection now only requires pasting the API key; the
endpoint is overridden only for self-hosted deployments or testing.
Adds an opt-in EventBridge integration to the CloudFormation and Terraform
onboarding templates. When enabled, the tracked CloudTrail management events
are forwarded to Prowler Cloud through an API destination, so a change is
scanned within minutes instead of waiting for the next scheduled scan.
The whole block is gated behind EnableRealtimeDetection / enable_realtime_detection,
both defaulting to false, so the existing onboarding is unchanged unless
explicitly opted in. No new read permissions are added to the ProwlerScan role.
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
César Arroba