IAM-ALARM

{
  "source": [
    "aws.iam"
  ],
  "detail-type": [
    "AWS API Call via CloudTrail"
  ],
  "detail": {
    "eventSource": [
      "iam.amazonaws.com"
    ],
    "eventName": [
      "AddClientIDToOpenIDConnectProvider",
      "AddRoleToInstanceProfile",
      "AddUserToGroup",
      "AttachGroupPolicy",
      "AttachRolePolicy",
      "AttachUserPolicy",
      "ChangePassword",
      "CreateAccessKey",
      "CreateAccountAlias",
      "CreateGroup",
      "CreateInstanceProfile",
      "CreateLoginProfile",
      "CreateOpenIDConnectProvider",
      "CreatePolicy",
      "CreatePolicyVersion",
      "CreateRole",
      "CreateServiceLinkedRole",
      "CreateServiceSpecificCredential",
      "CreateUser",
      "CreateVirtualMFADevice",
      "DeactivateMFADevice",
      "DeleteAccessKey",
      "DeleteAccountAlias",
      "DeleteAccountPasswordPolicy",
      "DeleteGroup",
      "DeleteGroupPolicy",
      "DeleteInstanceProfile",
      "DeleteLoginProfile",
      "DeleteOpenIDConnectProvider",
      "DeletePolicy",
      "DeletePolicyVersion",
      "DeleteRole",
      "DeleteRolePolicy",
      "DeleteSAMLProvider",
      "DeleteServerCertificate",
      "DeleteServiceSpecificCredential",
      "DeleteSigningCertificate",
      "DeleteSSHPublicKey",
      "DeleteUser",
      "DeleteUserPolicy",
      "DeleteVirtualMFADevice",
      "DetachGroupPolicy",
      "DetachRolePolicy",
      "DetachUserPolicy",
      "PutGroupPolicy",
      "PutRolePolicy",
      "PutUserPolicy",
      "RemoveClientIDFromOpenIDConnectProvider",
      "RemoveRoleFromInstanceProfile",
      "RemoveUserFromGroup",
      "ResetServiceSpecificCredential",
      "ResyncMFADevice",
      "SetDefaultPolicyVersion",
      "SimulateCustomPolicy",
      "SimulatePrincipalPolicy",
      "UpdateAccessKey",
      "UpdateAccountPasswordPolicy",
      "UpdateAssumeRolePolicy",
      "UpdateGroup",
      "UpdateLoginProfile",
      "UpdateOpenIDConnectProviderThumbprint",
      "UpdateRoleDescription",
      "UpdateSAMLProvider",
      "UpdateServerCertificate",
      "UpdateServiceSpecificCredential",
      "UpdateSigningCertificate",
      "UpdateSSHPublicKey",
      "UpdateUser",
      "UploadServerCertificate",
      "UploadSigningCertificate",
      "UploadSSHPublicKey"
    ]
  }
}