Merge pull request #6 from schubergphilis/update-iam-activity-filter

Update IAM activity filter
schubergphilis · Sep 9, 2021 · c6785c4 · c6785c4
2 parents 7b8dd74 + 8b3b17f
commit c6785c4
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/.github/workflows/terraform.yml b/.github/workflows/terraform.yml
@@ -46,4 +46,4 @@ jobs:
       - name: Check out code
         uses: actions/checkout@master
       - name: Terraform security scan
-        uses: triat/terraform-security-scan@v2.1.0
+        uses: triat/terraform-security-scan@v3.0.0
diff --git a/locals.tf b/locals.tf
@@ -10,7 +10,7 @@ locals {
 
   iam_activity = merge(
     {
-      Root = "{ $.userIdentity.type = \"Root\" }"
+      Root = "{ $.userIdentity.type=\"Root\" && $.userIdentity.invokedBy NOT EXISTS && $.eventType != \"AwsServiceEvent\" }"
     },
     var.monitor_iam_activity_sso == true ? {
       SSO = "{ $.readOnly IS FALSE  && $.userIdentity.sessionContext.sessionIssuer.userName = \"AWSReservedSSO_*\" && $.eventName != \"ConsoleLogin\" }"