Update root login filter pattern Closes #284 (#285)

turbot · Sep 23, 2021 · 721f6af · 721f6af
1 parent f46bd7a
commit 721f6af
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/query/cloudwatch/log_metric_filter_root_login.sql b/query/cloudwatch/log_metric_filter_root_login.sql
@@ -22,7 +22,7 @@ with filter_data as (
     and se ->> 'ReadWriteType' = 'All'
     and trail.log_group_arn is not null
     and filter.log_group_name = split_part(trail.log_group_arn, ':', 7)
-    and filter.filter_pattern ~ '\s*\$\.userIdentity.type\s*=\s*"Root"'
+    and filter.filter_pattern ~ '\s*\$\.userIdentity\.type\s*=\s*"Root".+\$\.userIdentity\.invokedBy NOT EXISTS.+\$\.eventType\s*!=\s*"AwsServiceEvent"'
     and alarm.metric_name = filter.metric_transformation_name
     and subscription.topic_arn = action_arn
 )