Merge pull request #599 from ministryofjustice/feature/exclude-getmac…

…iesession Exclude GetMacieSession from SecurityHub Alarm
ministryofjustice · Oct 1, 2024 · 9d62fce · 9d62fce
2 parents be632da + 1ac04e8
commit 9d62fce
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/modules/securityhub-alarms/main.tf b/modules/securityhub-alarms/main.tf
@@ -73,7 +73,7 @@ resource "aws_sns_topic" "securityhub-alarms" {
 # 3.1 - Ensure a log metric filter and alarm exist for unauthorized API calls
 resource "aws_cloudwatch_log_metric_filter" "unauthorised-api-calls" {
   name           = var.unauthorised_api_calls_log_metric_filter_name
-  pattern        = "{($.errorCode = \"*UnauthorizedOperation\") || ($.errorCode = \"AccessDenied*\" && $.eventName != \"ListDelegatedAdministrators\")}"
+  pattern        = "{($.errorCode = \"*UnauthorizedOperation\") || ($.errorCode = \"AccessDenied*\" && ($.eventName != \"ListDelegatedAdministrators\") && ($.eventName != \"GetMacieSession\"))}"
   log_group_name = "cloudtrail"
 
   metric_transformation {