Skip to main content

New Security Group

Triggers a workflow on every new Security Group captured by CloudTrail.

info

Automations based on this trigger will search for new events every 5 minutes.

Parameters​

ParameterDescription
RegionRegion for the AWS command.

Sample Event​

{
    "EventId": "03b21563-6720-45d4-b652-1aeffbbc9d5",
    "EventName": "CreateSecurityGroup",
    "ReadOnly": "false",
    "AccessKeyId": "ASIAWF7NI8EGJFKRYXRG",
    "EventTime": "2022-11-21T09:49:19+02:00",
    "EventSource": "ec2.amazonaws.com",
    "Username": "user@domain.com",
    "Resources": [
        {
            "ResourceType": "AWS::EC2::VPC",
            "ResourceName": "vpc-0ab1a3d08b258258d"
        },
        {
            "ResourceType": "AWS::EC2::SecurityGroup",
            "ResourceName": "launch-wizard-8"
        },
        {
            "ResourceType": "AWS::EC2::SecurityGroup",
            "ResourceName": "sg-0423a47204af9ed2s"
        }
    ],
    "CloudTrailEvent": "{\"eventVersion\":\"1.08\",\"userIdentity\":{\"type\":\"IAMUser\",\"principalId\":\"ASIAWF7NI8EGJFKRYXRG\",\"arn\":\"arn:aws:iam::425162425841:user/user@domain.com\",\"accountId\":\"425162425841\",\"accessKeyId\":\"ASIAWF7NI8EGJFKRYXRG\",\"userName\":\"user@domain.com\",\"sessionContext\":{\"sessionIssuer\":{},\"webIdFederationData\":{},\"attributes\":{\"creationDate\":\"2022-11-20T21:58:16Z\",\"mfaAuthenticated\":\"false\"}}},\"eventTime\":\"2022-11-21T07:49:19Z\",\"eventSource\":\"ec2.amazonaws.com\",\"eventName\":\"CreateSecurityGroup\",\"awsRegion\":\"eu-west-1\",\"sourceIPAddress\":\"AWS Internal\",\"userAgent\":\"AWS Internal\",\"requestParameters\":{\"groupName\":\"launch-wizard-8\",\"groupDescription\":\"launch-wizard-8 created 2022-11-21T07:49:07.523Z\",\"vpcId\":\"vpc-0ab1a3d08b258258d\"},\"responseElements\":{\"requestId\":\"d07df3b4-0f08-4720-8b0e-fb742ajkd852\",\"_return\":true,\"groupId\":\"sg-0423a47204af9ed2s\"},\"requestID\":\"d07df3b4-0f08-4720-8b0e-fb742ajkd852\",\"eventID\":\"03b21563-6720-45d4-b652-1aeffbbc9d5\",\"readOnly\":false,\"eventType\":\"AwsApiCall\",\"managementEvent\":true,\"recipientAccountId\":\"425162425841\",\"eventCategory\":\"Management\",\"sessionCredentialFromConsole\":\"true\"}"
}