amazon-archives/aws-security-benchmark

Rules > DetectEc2TerminationEvents is not working

dark-spark2 opened this issue · 1 comments

Hi,
only after adding "TerminateInstances" to eventName the rule worked.
has amazon changed the event name ?
{
"detail-type": [
"AWS API Call via CloudTrail"
],
"detail": {
"eventSource": [
"ec2.amazonaws.com"
],
"eventName": [
"TerminateInstance",
"TerminateInstances"
]
}
}

Thank you for identifying this issue. The event should indeed be "TerminateInstances". This has just been fixed.