> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Events in use remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration of not using AWS CloudWatch Events, you can follow the below steps:

        1. Open the AWS Management Console and navigate to the CloudWatch service.
        2. Click on "Events" in the left-hand menu.
        3. Click on "Create rule" button.
        4. In the "Event Source" section, select the service that you want to monitor for events. You can choose from a list of pre-defined services or create a custom event pattern.
        5. In the "Targets" section, select the action that you want to take when the event occurs. You can choose from a list of pre-defined targets or create a custom target.
        6. Click on "Configure details" button.
        7. Give a name and description for the rule.
        8. Click on "Create rule" button to create the rule.

        Once the rule is created, it will start monitoring the selected service for events. If an event occurs, it will trigger the action that you specified in the "Targets" section. This will help you to remediate the misconfiguration of not using AWS CloudWatch Events.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration "AWS CloudWatch Events Should Be Used" for AWS using AWS CLI, follow the steps below:

        1. Open the AWS CLI on your local machine or terminal.

        2. Run the following command to create a new CloudWatch event rule:

           ```
           aws events put-rule --name "my-event-rule" --event-pattern "{\"source\":[\"aws.ec2\"]}"
           ```

           This command creates a new CloudWatch event rule named "my-event-rule" that will trigger for all EC2-related events.

        3. Run the following command to create a new target for the event rule:

           ```
           aws events put-targets --rule "my-event-rule" --targets "Id"="my-target","Arn"="arn:aws:sns:us-east-1:123456789012:my-sns-topic"
           ```

           This command creates a target for the event rule that sends the event information to an SNS topic named "my-sns-topic".

        4. Run the following command to enable the event rule:

           ```
           aws events enable-rule --name "my-event-rule"
           ```

           This command enables the event rule so that it can start processing events.

        After following these steps, your AWS CloudWatch events will be properly configured and you will be able to receive notifications for any events that match the event pattern you specified.
      </Accordion>

      <Accordion title="Using Python">
        If the misconfiguration is that AWS CloudWatch Events should be used, then the following steps can be taken to remediate it using Python:

        1. Import the necessary Python libraries: boto3 and json.

        ```
        import boto3
        import json
        ```

        2. Create a CloudWatch Events rule using the boto3 library.

        ```
        client = boto3.client('events')

        response = client.put_rule(
            Name='my-cwe-rule',
            EventPattern=json.dumps({
                "source": [
                    "aws.ec2"
                ],
                "detail-type": [
                    "EC2 Instance State-change Notification"
                ]
            })
        )
        ```

        This creates a CloudWatch Events rule that listens for EC2 instance state change notifications.

        3. Create a CloudWatch Events target using the boto3 library.

        ```
        response = client.put_targets(
            Rule='my-cwe-rule',
            Targets=[
                {
                    'Arn': 'arn:aws:lambda:us-east-1:123456789012:function:my-lambda-function',
                    'Id': 'my-target-id'
                }
            ]
        )
        ```

        This creates a CloudWatch Events target that sends the EC2 instance state change notification to a Lambda function.

        4. Enable the CloudWatch Events rule using the boto3 library.

        ```
        response = client.enable_rule(
            Name='my-cwe-rule'
        )
        ```

        This enables the CloudWatch Events rule so that it starts listening for EC2 instance state change notifications.

        By following these steps, the misconfiguration of not using AWS CloudWatch Events can be remediated in AWS using Python.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        # Example: enable CloudWatch Events (EventBridge) to react to EC2 state changes
        # Replace PLACEHOLDERS with your own names/ARNs.

        resource "aws_cloudwatch_event_rule" "ec2_state_change" {
          name        = "EC2StateChangeRule"
          description = "Capture EC2 instance state changes for operational response"
          event_pattern = jsonencode({
            "source" : ["aws.ec2"],
            "detail-type" : ["EC2 Instance State-change Notification"]
          })
        }

        resource "aws_iam_role" "events_invoke_lambda_role" {
          name = "CloudWatchEventsInvokeLambdaRole"

          assume_role_policy = jsonencode({
            Version = "2012-10-17"
            Statement = [
              {
                Effect = "Allow"
                Principal = {
                  Service = "events.amazonaws.com"
                }
                Action = "sts:AssumeRole"
              }
            ]
          })
        }

        resource "aws_iam_role_policy" "events_invoke_lambda_policy" {
          name = "CloudWatchEventsInvokeLambdaPolicy"
          role = aws_iam_role.events_invoke_lambda_role.id

          policy = jsonencode({
            Version = "2012-10-17"
            Statement = [
              {
                Effect = "Allow"
                Action = [
                  "lambda:InvokeFunction"
                ]
                Resource = "ARN_OF_TARGET_LAMBDA_FUNCTION" # replace with your Lambda ARN
              }
            ]
          })
        }

        resource "aws_cloudwatch_event_target" "ec2_state_change_to_lambda" {
          rule      = aws_cloudwatch_event_rule.ec2_state_change.name
          target_id = "EC2StateChangeTarget"
          arn       = "ARN_OF_TARGET_LAMBDA_FUNCTION" # replace with your Lambda ARN
          role_arn  = aws_iam_role.events_invoke_lambda_role.arn
        }
        ```

        This finding is not a setting on `aws-managementandgovernance-resourcemanager-organization-account`; remediation is to define one or more CloudWatch Events (EventBridge) rules like the above so that operational changes generate events and trigger handlers.

        This change does not force replacement of existing AWS accounts; it only creates new EventBridge and IAM resources.

        Verification: `terraform plan` should show the creation of one `aws_cloudwatch_event_rule`, one `aws_cloudwatch_event_target`, one `aws_iam_role`, and one `aws_iam_role_policy`, with no destructive changes to existing resources.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>