adding realtime triggers for plugins section a,b,c,d,i,k

plugins/aws/accessanalyzer/accessAnalyzerActiveFindings.js

@@ -11,6 +11,7 @@ module.exports = {
     link: 'https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-work-with-findings.html',
     recommended_action: 'Investigate into active findings in your account and do the needful until you have zero active findings.',
     apis: ['AccessAnalyzer:listAnalyzers', 'AccessAnalyzer:listFindings'],
+    realtime_triggers: ['accessanalyzer:CreateAnalyzer','accessanalyzer:DeleteAnalyzer','accessanalyzer:CreateArchiveRule','accessanalyzer:StartResourceScan'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/accessanalyzer/accessAnalyzerEnabled.js

@@ -10,6 +10,8 @@ module.exports = {
     link: 'https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-getting-started.html',
     recommended_action: 'Enable Access Analyzer for all regions',
     apis: ['AccessAnalyzer:listAnalyzers'],
+    realtime_triggers: ['accessanalyzer:CreateAnalyzer','accessanalyzer:DeleteAnalyzer'],
+
     run: function(cache, settings, callback) {
         var results = [];
         var source = {};

plugins/aws/acm/acmCertificateExpiry.js

@@ -27,6 +27,7 @@ module.exports = {
             default: 30
         }
     },
+    realtime_triggers: ['acm:RequestCertificate','acm:ImportCertificate','acm:DeleteCertificate'],
 
     run: function(cache, settings, callback) {
         var config = {

plugins/aws/acm/acmCertificateHasTags.js

@@ -10,6 +10,7 @@ module.exports = {
     link: 'https://docs.aws.amazon.com/acm/latest/userguide/tags.html',
     recommended_action: 'Modify ACM certificate and add tags.',
     apis: ['ACM:listCertificates', 'ResourceGroupsTaggingAPI:getResources'],
+    realtime_triggers: ['acm:RequestCertificate','acm:ImportCertificate','acm:DeleteCertificate','acm:AddTagsToCertificate', 'acm:RemoveTagsFromCertificate'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/acm/acmSingleDomainNameCertificate.js

@@ -10,6 +10,7 @@ module.exports = {
     link: 'https://docs.aws.amazon.com/acm/latest/userguide/acm-certificate.html',
     recommended_action: 'Configure ACM managed certificates to use single name domain instead of wildcards.',
     apis: ['ACM:listCertificates', 'ACM:describeCertificate'],
+    realtime_triggers: ['acm:RequestCertificate','acm:ImportCertificate','acm:DeleteCertificate'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/acm/acmValidation.js

@@ -11,6 +11,7 @@ module.exports = {
     cs_link: 'https://cloudsploit.com/remediations/aws/acm/acm-certificate-validation',
     recommended_action: 'Configure ACM managed certificates to use DNS validation.',
     apis: ['ACM:listCertificates', 'ACM:describeCertificate'],
+    realtime_triggers: ['acm:RequestCertificate','acm:ImportCertificate','acm:DeleteCertificate'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/apigateway/apiStageLevelCacheEncryption.js

@@ -10,6 +10,8 @@ module.exports = {
     recommended_action: 'Modify API Gateway API stages to enable encryption on cache data',
     link: 'https://docs.aws.amazon.com/apigateway/latest/developerguide/data-protection-encryption.html',
     apis: ['APIGateway:getRestApis', 'APIGateway:getStages'],
+    realtime_triggers: ['apigateway:CreateRestApi','apigateway:ImportRestApi','apigateway:DeleteRestApi','apigateway:CreateStage','apigateway:UpdateStage','apigateway:DeleteStage'],
+
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/apigateway/apigatewayAuthorization.js

@@ -10,6 +10,7 @@ module.exports = {
     recommended_action: 'Modify API Gateway configuration and ensure that appropriate authorizers are set up for each API.',
     link: 'https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html',
     apis: ['APIGateway:getRestApis', 'APIGateway:getAuthorizers'],
+    realtime_triggers: ['apigateway:CreateRestApi','apigateway:DeleteRestApi','apigateway:ImportRestApi','apigateway:CreateAuthorizer','apigateway:DeleteAuthorizer'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/apigateway/apigatewayCertificateRotation.js

@@ -18,6 +18,7 @@ module.exports = {
             default: '30',
         }
     },
+    realtime_triggers: ['apigateway:CreateRestApi','apigateway:DeleteRestApi','apigateway:ImportRestApi','apigateway:CreateStage','apigateway:DeleteStage','apigateway:GenerateClientCertificate','apigateway:DeleteClientCertificate'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/apigateway/apigatewayClientCertificate.js

@@ -10,6 +10,7 @@ module.exports = {
     recommended_action: 'Attach client certificate to API Gateway API stages',
     link: 'https://docs.aws.amazon.com/apigateway/latest/developerguide/getting-started-client-side-ssl-authentication.html',
     apis: ['APIGateway:getRestApis', 'APIGateway:getStages'],
+    realtime_triggers: ['apigateway:CreateRestApi','apigateway:DeleteRestApi','apigateway:ImportRestApi','apigateway:CreateStage','apigateway:DeleteStage','apigateway:UpdateStage'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/apigateway/apigatewayCloudwatchLogs.js

@@ -10,6 +10,7 @@ module.exports = {
     recommended_action: 'Modify API Gateway API stages to enable CloudWatch Logs',
     link: 'https://docs.aws.amazon.com/apigateway/latest/developerguide/set-up-logging.html',
     apis: ['APIGateway:getRestApis', 'APIGateway:getStages'],
+    realtime_triggers: ['apigateway:CreateStage','apigateway:UpdateStage','apigateway:DeleteStage'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/apigateway/apigatewayContentEncoding.js

@@ -10,6 +10,8 @@ module.exports = {
     recommended_action: 'Enable content encoding and set minimum compression size of API Gateway API response',
     link: 'https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-gzip-compression-decompression.html',
     apis: ['APIGateway:getRestApis'],
+    realtime_triggers: ['apigateway:CreateRestApi','apigateway:ImportRestApi','apigateway:UpdateRestApi','apigateway:DeleteRestApi'],
+
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/apigateway/apigatewayDefaultEndpointDisabled.js

@@ -10,6 +10,7 @@ module.exports = {
     recommended_action: 'Modify API Gateway to disable default execute-api endpoint.',
     link: 'https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-caching.html',
     apis: ['APIGateway:getRestApis'],
+    realtime_triggers: ['apigateway:CreateRestApi','apigateway:ImportRestApi','apigateway:UpdateRestApi','apigateway:DeleteRestApi'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/apigateway/apigatewayPrivateEndpoints.js

@@ -10,6 +10,7 @@ module.exports = {
     recommended_action: 'Set API Gateway API endpoint configuration to private',
     link: 'https://aws.amazon.com/blogs/compute/introducing-amazon-api-gateway-private-endpoints',
     apis: ['APIGateway:getRestApis'],
+    realtime_triggers: ['apigateway:CreateRestApi','apigateway:ImportRestApi','apigateway:UpdateRestApi','apigateway:DeleteRestApi'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/apigateway/apigatewayResponseCaching.js

@@ -11,6 +11,7 @@ module.exports = {
     recommended_action: 'Modify API Gateway API stages to enable API cache',
     link: 'https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-caching.html',
     apis: ['APIGateway:getRestApis', 'APIGateway:getStages'],
+    realtime_triggers: ['apigateway:CreateRestApi','apigateway:ImportRestApi','apigateway:DeleteRestApi','apigateway:CreateStage','apigateway:UpdateStage','apigateway:DeleteStage'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/apigateway/apigatewayTracingEnabled.js

@@ -10,6 +10,8 @@ module.exports = {
     recommended_action: 'Enable tracing on API Gateway API stages',
     link: 'https://docs.aws.amazon.com/xray/latest/devguide/xray-services-apigateway.html',
     apis: ['APIGateway:getRestApis', 'APIGateway:getStages'],
+    realtime_triggers: ['apigateway:CreateRestApi','apigateway:ImportRestApi','apigateway:DeleteRestApi','apigateway:CreateStage','apigateway:UpdateStage','apigateway:DeleteStage'],
+
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/apigateway/apigatewayWafEnabled.js

@@ -10,6 +10,8 @@ module.exports = {
     recommended_action: 'Associate API Gateway API with Web Application Firewall',
     link: 'https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-control-access-aws-waf.html',
     apis: ['APIGateway:getRestApis', 'APIGateway:getStages'],
+    realtime_triggers: ['apigateway:CreateRestApi','apigateway:ImportRestApi','apigateway:DeleteRestApi','apigateway:CreateStage','apigateway:DeleteStage','wafregional:AssociateWebACL'],
+
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/apigateway/customDomainTlsVersion.js

@@ -10,6 +10,8 @@ module.exports = {
     recommended_action: 'Modify API Gateway custom domain security policy and specify new TLS version.',
     link: 'https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-custom-domain-tls-version.html',
     apis: ['APIGateway:getDomainNames'],
+    realtime_triggers: ['apigateway:CreateDomainName','apigateway:UpdateDomainName','apigateway:DeleteDomainName'],
+
     run: function(cache, settings, callback) {
         var results = [];
         var source = {};

plugins/aws/apigateway/detailedCloudWatchMetrics.js

@@ -10,6 +10,8 @@ module.exports = {
     recommended_action: 'Add CloudWatch role ARN to API settings and enabled detailed metrics for each stage',
     link: 'https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-metrics.html',
     apis: ['APIGateway:getRestApis', 'APIGateway:getStages'],
+    realtime_triggers: ['apigateway:CreateRestApi','apigateway:ImportRestApi','apigateway:DeleteRestApi','apigateway:CreateStage','apigateway:UpdateStage','apigateway:DeleteStage'],
+
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/appflow/flowEncrypted.js

@@ -19,6 +19,8 @@ module.exports = {
             default: 'awscmk',
         }
     },
+    realtime_triggers: ['appflow:CreateFlow','appflow:DeleteFlow'],
+
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/appmesh/appmeshTLSRequired.js

@@ -10,6 +10,8 @@ module.exports = {
     link: 'https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_ListenerTls.html',
     recommended_action: 'Restrict AWS App Mesh virtual gateway listeners to accept only TLS enabled connections.',
     apis: ['AppMesh:listMeshes', 'AppMesh:listVirtualGateways', 'AppMesh:describeVirtualGateway'],
+    realtime_triggers: ['appmesh:CreateMesh','appmesh:DeleteMesh','appmesh:CreateVirtualGateway','appmesh:UpdateVirtualGateway','appmesh:DeleteVirtualGateway'],
+
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/appmesh/appmeshVGAccessLogging.js

@@ -10,6 +10,8 @@ module.exports = {
     link: 'https://docs.aws.amazon.com/app-mesh/latest/userguide/envoy-logs.html',
     recommended_action: 'To enable access logging, modify virtual gateway configuration settings and configure the file path to write access logs to.',
     apis: ['AppMesh:listMeshes', 'AppMesh:listVirtualGateways', 'AppMesh:describeVirtualGateway'],
+    realtime_triggers: ['appmesh:CreateMesh','appmesh:DeleteMesh','appmesh:CreateVirtualGateway','appmesh:UpdateVirtualGateway','appmesh:DeleteVirtualGateway'],
+
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/appmesh/appmeshVGHealthChecks.js

@@ -10,6 +10,7 @@ module.exports = {
     link: 'https://docs.aws.amazon.com/app-mesh/latest/userguide/virtual_gateway_health_checks.html',
     recommended_action: 'Configure health check policies for the virtual gateway listeners in your App Mesh, specifying values for healthy threshold, health check interval, health check protocol, timeout period, and unhealthy threshold.',
     apis: ['AppMesh:listMeshes', 'AppMesh:listVirtualGateways', 'AppMesh:describeVirtualGateway'],
+    realtime_triggers: ['appmesh:CreateMesh','appmesh:DeleteMesh','appmesh:CreateVirtualGateway','appmesh:UpdateVirtualGateway','appmesh:DeleteVirtualGateway'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/appmesh/restrictExternalTraffic.js

@@ -12,6 +12,7 @@ module.exports = {
     link: 'https://docs.aws.amazon.com/app-mesh/latest/userguide/security.html',
     recommended_action: 'Deny all traffic to the external services',
     apis: ['AppMesh:listMeshes', 'AppMesh:describeMesh'],
+    realtime_triggers: ['appmesh:CreateMesh','appmesh:DeleteMesh','appmesh:UpdateMesh'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/apprunner/serviceEncrypted.js

@@ -19,6 +19,8 @@ module.exports = {
             default: 'awscmk'
         }
     },
+    realtime_triggers: ['apprunner:CreateService','apprunner:DeleteService'],
+
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/athena/workgroupEncrypted.js

@@ -21,7 +21,7 @@ module.exports = {
         remediate: ['athena:UpdateWorkGroup'],
         rollback: ['athena:UpdateWorkGroup']
     },
-    realtime_triggers: ['athena:CreateWorkGroup', 'athena:UpdateWorkGroup'],
+    realtime_triggers: ['athena:CreateWorkGroup', 'athena:UpdateWorkGroup', 'athena:DeleteWorkGroup'],
     remediation_inputs: {
         encryptionOption: {
             name: '(Mandatory) Encryption method',

plugins/aws/athena/workgroupEnforceConfiguration.js

@@ -10,6 +10,8 @@ module.exports = {
     link: 'https://docs.aws.amazon.com/athena/latest/ug/workgroups-settings.html',
     recommended_action: 'Disable the ability for clients to override Athena workgroup configuration options.',
     apis: ['Athena:listWorkGroups', 'Athena:getWorkGroup', 'STS:getCallerIdentity'],
+    realtime_triggers: ['athena:CreateWorkGroup', 'athena:UpdateWorkGroup', 'athena:DeleteWorkGroup'],
+
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/auditmanager/auditmanagerDataEncrypted.js

@@ -19,6 +19,7 @@ module.exports = {
             default: 'awscmk',
         }
     },
+    realtime_triggers: ['auditmanager:registerAccount','auditmanager:UpdateSettings','auditmanager:DeregisterAccount'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/autoscaling/appTierAsgApprovedAmi.js

@@ -24,6 +24,7 @@ module.exports = {
             default: ''
         }
     },
+    realtime_triggers: ['autoscaling:CreateAutoScalingGroup','autoscaling:DeleteAutoScalingGroup','autoscaling:UpdateAutoScalingGroup','autoscaling:createLaunchConfiguration','autoscaling:DeleteLaunchConfiguration'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/autoscaling/appTierAsgCloudwatchLogs.js

@@ -32,6 +32,8 @@ module.exports = {
             default: ''
         }
     },
+    realtime_triggers: ['autoscaling:CreateAutoScalingGroup','autoscaling:DeleteAutoScalingGroup','autoscaling:UpdateAutoScalingGroup','autoscaling:createLaunchConfiguration','autoscaling:DeleteLaunchConfiguration'],
+
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/autoscaling/appTierIamRole.js

@@ -18,6 +18,7 @@ module.exports = {
             default: ''
         }
     },
+    realtime_triggers: ['autoscaling:CreateAutoScalingGroup','autoscaling:DeleteAutoScalingGroup','autoscaling:UpdateAutoScalingGroup','autoscaling:createLaunchConfiguration','autoscaling:DeleteLaunchConfiguration'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/autoscaling/asgActiveNotifications.js

@@ -10,6 +10,8 @@ module.exports = {
     link: 'https://docs.aws.amazon.com/autoscaling/ec2/userguide/ASGettingNotifications.html',
     recommended_action: 'Add a notification endpoint to the auto scaling group.',
     apis: ['AutoScaling:describeAutoScalingGroups', 'AutoScaling:describeNotificationConfigurations'],
+    realtime_triggers: ['autoscaling:CreateAutoScalingGroup','autoscaling:DeleteAutoScalingGroup','autoscaling:PutNotificationConfiguration'],
+
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/autoscaling/asgCooldownPeriod.js

@@ -10,6 +10,7 @@ module.exports = {
     link: 'https://docs.aws.amazon.com/autoscaling/ec2/userguide/Cooldown.html',
     recommended_action: 'Implement proper cool down period for Auto Scaling groups to temporarily suspend any scaling actions.',
     apis: ['AutoScaling:describeAutoScalingGroups'],
+    realtime_triggers: ['autoscaling:CreateAutoScalingGroup','autoscaling:UpdateAutoScalingGroup','autoscaling:DeleteAutoScalingGroup'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/autoscaling/asgMissingELB.js

@@ -10,6 +10,7 @@ module.exports = {
     link: 'https://docs.aws.amazon.com/autoscaling/ec2/userguide/attach-load-balancer-asg.html',
     recommended_action: 'Ensure that the Auto Scaling group load balancer has not been deleted. If so, remove it from the ASG.',
     apis: ['AutoScaling:describeAutoScalingGroups', 'ELB:describeLoadBalancers', 'ELBv2:describeLoadBalancers'],
+    realtime_triggers: ['autoscaling:CreateAutoScalingGroup','autoscaling:DeleteAutoScalingGroup','autoscaling:AttachLoadBalancers','autoscaling:DetachLoadBalancers','elb:CreateLoadBalancer','elbv2:CreateLoadBalancer','elb:DeleteLoadBalancer','elbv2:DeleteLoadBalancer'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/autoscaling/asgMissingSecurityGroups.js

@@ -10,6 +10,7 @@ module.exports = {
     link: 'https://docs.aws.amazon.com/autoscaling/ec2/userguide/GettingStartedTutorial.html',
     recommended_action: 'Ensure that the launch configuration security group has not been deleted. If so, remove it from launch configurations',
     apis: ['AutoScaling:describeLaunchConfigurations', 'EC2:describeSecurityGroups'],
+    realtime_triggers: ['autoscaling:CreateLaunchConfiguration','autoscaling:DeleteLaunchConfiguration','ec2:CreateSecurityGroup','ec2:DeleteSecurityGroup'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/autoscaling/asgMultiAz.js

@@ -10,6 +10,8 @@ module.exports = {
     link: 'http://docs.aws.amazon.com/autoscaling/latest/userguide/AutoScalingGroup.html',
     recommended_action: 'Modify the autoscaling instance to enable scaling across multiple availability zones.',
     apis: ['AutoScaling:describeAutoScalingGroups'],
+    realtime_triggers: ['autoscaling:CreateAutoScalingGroup','autoscaling:UpdateAutoScalingGroup','autoscaling:DeleteAutoScalingGroup'],
+
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/autoscaling/asgSuspendedProcesses.js

@@ -10,6 +10,7 @@ module.exports = {
     link: 'https://docs.aws.amazon.com/autoscaling/ec2/userguide/as-suspend-resume-processes.html',
     recommended_action: 'Update the AutoScaling group to resume the suspended processes.',
     apis: ['AutoScaling:describeAutoScalingGroups'],
+    realtime_triggers: ['autoscaling:CreateAutoScalingGroup','autoscaling:ResumeProcesses','autoscaling:DeleteAutoScalingGroup'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/autoscaling/asgUnusedLaunchConfiguration.js

@@ -11,6 +11,8 @@ module.exports = {
     link: 'https://docs.aws.amazon.com/autoscaling/ec2/userguide/LaunchConfiguration.html',
     recommended_action: 'Identify and remove any Auto Scaling Launch Configuration templates that are not associated anymore with ASGs available in the selected AWS region.',
     apis: ['AutoScaling:describeAutoScalingGroups', 'AutoScaling:describeLaunchConfigurations'],
+    realtime_triggers: ['autoscaling:CreateAutoScalingGroup','autoscaling:DeleteAutoScalingGroup','autoscaling:CreateLaunchConfiguration','autoscaling:DeleteLaunchConfiguration'],
+
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/autoscaling/elbHealthCheckActive.js

@@ -10,6 +10,8 @@ module.exports = {
     link: 'https://docs.aws.amazon.com/autoscaling/ec2/userguide/as-add-elb-healthcheck.html',
     recommended_action: 'Enable ELB health check for the Auto Scaling groups.',
     apis: ['AutoScaling:describeAutoScalingGroups'],
+    realtime_triggers: ['autoscaling:CreateAutoScalingGroup','autoscaling:UpdateAutoScalingGroup','autoscaling:DeleteAutoScalingGroup'],
+
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/autoscaling/emptyASG.js

@@ -10,6 +10,8 @@ module.exports = {
     link: 'https://docs.aws.amazon.com/autoscaling/ec2/userguide/AutoScalingGroup.html',
     recommended_action: 'Delete the unused AutoScaling group.',
     apis: ['AutoScaling:describeAutoScalingGroups'],
+    realtime_triggers: ['autoscaling:CreateAutoScalingGroup','autoscaling:DeleteAutoScalingGroup'],
+
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/autoscaling/sameAzElb.js

@@ -10,6 +10,9 @@ module.exports = {
     link: 'https://docs.aws.amazon.com/autoscaling/ec2/userguide/as-add-availability-zone.html',
     recommended_action: 'Update the ELB to use the same availability zones as the autoscaling group.',
     apis: ['AutoScaling:describeAutoScalingGroups', 'ELB:describeLoadBalancers', 'ELBv2:describeLoadBalancers'],
+    realtime_triggers: ['autoscaling:CreateAutoScalingGroup','autoscaling:UpdateAutoScalingGroup','autoscaling:DeleteAutoScalingGroup','elb:CreateLoadBalancer','elbv2:CreateLoadBalancer','elb:DeleteLoadBalancer','elbv2:DeleteLoadBalancer'],
+
+
 
     run: function(cache, settings, callback) {
         var results = [];