added tiggers for f,g,h and connect

plugins/aws/connect/customerProfilesDomainEncrypted.js

@@ -18,6 +18,7 @@ module.exports = {
             default: 'awscmk'
         }
     },
+    realtime_triggers: ['customerprofiles:CreateDomain', 'customerprofiles:UpdateDomain'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/connect/instanceAttachmentsEncrypted.js

@@ -19,6 +19,7 @@ module.exports = {
             default: 'awscmk'
         }
     },
+    realtime_triggers: ['connect:CreateInstance', 'connect:AssociateInstanceStorageConfig', 'connect:UpdateInstanceStorageConfig'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/connect/instanceCallRecordingEncrypted.js

@@ -19,6 +19,8 @@ module.exports = {
             default: 'awscmk'
         }
     },
+    realtime_triggers: ['connect:CreateInstance', 'connect:AssociateInstanceStorageConfig', 'connect:UpdateInstanceStorageConfig'],
+
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/connect/instanceMediaStreamsEncrypted.js

@@ -19,6 +19,7 @@ module.exports = {
             default: 'awscmk'
         }
     },
+    realtime_triggers: ['connect:CreateInstance', 'connect:AssociateInstanceStorageConfig', 'connect:UpdateInstanceStorageConfig'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/connect/instanceReportsEncrypted.js

@@ -19,6 +19,7 @@ module.exports = {
             default: 'awscmk'
         }
     },
+    realtime_triggers: ['connect:CreateInstance', 'connect:AssociateInstanceStorageConfig', 'connect:UpdateInstanceStorageConfig'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/connect/instanceTranscriptsEncrypted.js

@@ -19,6 +19,7 @@ module.exports = {
             default: 'awscmk'
         }
     },
+    realtime_triggers: ['connect:CreateInstance', 'connect:AssociateInstanceStorageConfig', 'connect:UpdateInstanceStorageConfig'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/connect/voiceIdDomainEncrypted.js

@@ -22,6 +22,7 @@ module.exports = {
             default: 'awskms'
         }
     },
+    realtime_triggers: ['voiceid:CreateDomain', 'voiceid:UpdateDomain'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/connect/wisdomDomainEncrypted.js

@@ -22,6 +22,7 @@ module.exports = {
             default: 'awskms'
         }
     },
+    realtime_triggers: ['wisdom:CreateAssistant'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/finspace/finspaceEnvironmentEncrypted.js

@@ -19,6 +19,7 @@ module.exports = {
             default: 'awscmk'
         }
     },
+    realtime_triggers: ['finspace:CreateEnnviromennt'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/firehose/deliveryStreamEncrypted.js

@@ -20,6 +20,7 @@ module.exports = {
             default: 'awscmk'
         }
     },
+    realtime_triggers: ['firehose:CreateDeliveryStreams','firehose:UpdateDestination'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/firehose/firehoseEncrypted.js

@@ -17,6 +17,7 @@ module.exports = {
                 'AWS KMS encryption ensures that the Firehose payload meets the ' +
                 'encryption in transit and at rest requirements of HIPAA.'
     },
+    realtime_triggers: ['firehose:CreateDeliveryStreams','firehose:StartDeliveryStreamEncryption', 'kinesis:StartStreamEncryption'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/forecast/datasetExportEncrypted.js

@@ -18,6 +18,7 @@ module.exports = {
             default: 'awscmk'
         }
     },
+    realtime_triggers: ['forecast:CreateForecastExportJob'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/forecast/forecastDatasetEncrypted.js

@@ -19,6 +19,8 @@ module.exports = {
             default: 'awscmk'
         }
     },
+    realtime_triggers: ['forecastservice:CreateDataset'],
+
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/frauddetector/fraudDetectorDataEncrypted.js

@@ -18,6 +18,7 @@ module.exports = {
             default: 'awscmk'
         }
     },
+    realtime_triggers: ['frauddetector:PutKMSEncryptionKey'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/fsx/fsxFileSystemEncrypted.js

@@ -18,6 +18,8 @@ module.exports = {
             default: 'awscmk'
         }
     },
+    realtime_triggers: ['fsx:CreateFileSystem'],
+
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/glue/bookmarkEncryptionEnabled.js

@@ -10,6 +10,7 @@ module.exports = {
     recommended_action: 'Recreate Glue security configurations and enable job bookmark encryption',
     link: 'https://docs.aws.amazon.com/glue/latest/dg/console-security-configurations.html',
     apis: ['Glue:getSecurityConfigurations', 'STS:getCallerIdentity'],
+    realtime_triggers: ['glue:CreateSecurityConfiguration'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/glue/dataCatalogCmkEncrypted.js

@@ -10,6 +10,7 @@ module.exports = {
     recommended_action: 'Modify Glue data catalog to use CMK instead of AWS-managed Key to encrypt Metadata',
     link: 'https://docs.aws.amazon.com/glue/latest/dg/encrypt-glue-data-catalog.html',
     apis: ['Glue:getDataCatalogEncryptionSettings', 'KMS:listKeys', 'KMS:describeKey'],
+    realtime_triggers: ['glue:PutDataCatalogEncryptionSettings'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/glue/glueCloudwatchLogsEncrypted.js

@@ -10,6 +10,7 @@ module.exports = {
     recommended_action: 'Modify Glue Security Configurations to enable CloudWatch logs encryption at-rest',
     link: 'https://docs.aws.amazon.com/glue/latest/dg/console-security-configurations.html',
     apis: ['Glue:getSecurityConfigurations', 'STS:getCallerIdentity'],
+    realtime_triggers: ['glue:CreateSecurityConfiguration'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/glue/glueS3EncryptionEnabled.js

@@ -18,6 +18,7 @@ module.exports = {
             default: 'awscmk',
         }
     },
+    realtime_triggers: ['glue:CreateSecurityConfiguration'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/gluedatabrew/databrewJobOutputEncrypted.js

@@ -18,6 +18,7 @@ module.exports = {
             default: 'awscmk',
         }
     },
+    realtime_triggers: ['databrew:CreateRecipeJob', 'databrew:UpdateRecipeJob'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/guardduty/exportedFindingsEncrypted.js

@@ -19,6 +19,7 @@ module.exports = {
             default: 'awscmk'
         }
     },
+    realtime_triggers: ['guardduty:CreateDetector'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/guardduty/guarddutyEnabled.js

@@ -10,6 +10,7 @@ module.exports = {
     recommended_action: 'Enable GuardDuty for all AWS accounts.',
     link: 'https://docs.aws.amazon.com/guardduty/latest/ug/what-is-guardduty.html',
     apis: ['GuardDuty:listDetectors', 'GuardDuty:getDetector', 'STS:getCallerIdentity'],
+    realtime_triggers: ['guardduty:CreateDetector', 'guardduty:DeleteDetector'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/guardduty/guarddutyMaster.js

@@ -18,6 +18,7 @@ module.exports = {
             default: '',
         },
     },
+    realtime_triggers: ['guardduty:CreateDetector', 'guardduty:CreateMembers'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/guardduty/noActiveFindings.js

@@ -20,6 +20,7 @@ module.exports = {
             default: '48'
         }
     },
+    realtime_triggers: ['guardduty:CreateDetector', 'guardduty:ArchiveFindings'],
 
     run: function(cache, settings, callback) {
         const results = [];

plugins/aws/guardduty/s3ProtectionEnabled.js

@@ -10,7 +10,8 @@ module.exports = {
     recommended_action: 'Enable GuardDuty S3 protection for all AWS accounts.',
     link: 'https://docs.aws.amazon.com/guardduty/latest/ug/s3-protection.html',
     apis: ['GuardDuty:listDetectors', 'GuardDuty:getDetector', 'STS:getCallerIdentity'],
-
+    realtime_triggers: ['guardduty:CreateDetector', 'guardduty:UpdateDetector'],
+
     run: function(cache, settings, callback) {
         var results = [];
         var source = {};

plugins/aws/healthlake/dataStoreEncrypted.js

@@ -19,6 +19,7 @@ module.exports = {
             default: 'awscmk'
         }
     },
+    realtime_triggers: ['healthlake:CreateFHIRDatastore'],
 
     run: function(cache, settings, callback) {
         var results = [];