L m n o tiggers

plugins/aws/kms/kmsDefaultKeyUsage.js

@@ -20,6 +20,7 @@ module.exports = {
              'passwords, it is still strongly encouraged to use a ' +
              'customer-provided CMK rather than the default KMS key.'
     },
+    realtime_triggers: ['cloudtrail:CreateTrail', 'ec2:CreateVolume','elastictranscoder:CreatePipline', 'rds:CreateDBInstance', 'redshift:CreateCluster','redshift:ModifyCluster','s3:putBucketEncryption','ses:CreateEmailIdentity','ses:CreateEmailIdentity','ses:SetActiveReceiptRuleSet', 'workspace:CreateWorkSpaces',  'lambda:CreateFunction','lambda:UpdateFunctionConfiguration', 'cloudwatchlogs:CreateLogGroup', 'efs:CreateFileSystem'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/lambda/envVarsClientSideEncryption.js

@@ -20,6 +20,7 @@ module.exports = {
             default: ''
         }
     },
+    realtime_triggers: ['lambda:CreateFunction', 'lambda:UpdateFunctionConfiguration', 'lambda:DeleteFunction'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/lambda/lambdaAdminPrivileges.js

@@ -11,7 +11,8 @@ module.exports = {
     recommended_action: 'Modify IAM role attached with Lambda function to provide the minimal amount of access required to perform its tasks',
     apis: ['Lambda:listFunctions', 'IAM:listRoles', 'IAM:listAttachedRolePolicies', 'IAM:listRolePolicies',
         'IAM:listPolicies', 'IAM:getPolicy', 'IAM:getPolicyVersion', 'IAM:getRolePolicy'],
-
+    realtime_triggers: ['lambda:CreateFunction','lambda:UpdateFunctionConfiguration', 'lambda:DeleteFunction'],
+
     run: function(cache, settings, callback) {
         var results = [];
         var source = {};

plugins/aws/lambda/lambdaHasTags.js

@@ -10,7 +10,7 @@ module.exports = {
     link: 'https://docs.aws.amazon.com/lambda/latest/dg/configuration-tags.html',
     recommended_action: 'Modify Lambda function configurations and  add new tags',
     apis: ['Lambda:listFunctions', 'ResourceGroupsTaggingAPI:getResources'],
-
+    realtime_triggers: ['lambda:CreateFunction','lambda:UpdateFunctionConfiguration','lambda:DeleteFunction'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/lambda/lambdaLogGroups.js

@@ -10,6 +10,7 @@ module.exports = {
     link: 'https://docs.aws.amazon.com/lambda/latest/dg/monitoring-cloudwatchlogs.html',
     recommended_action: 'Update the Lambda function permissions to allow CloudWatch logging.',
     apis: ['Lambda:listFunctions', 'CloudWatchLogs:describeLogGroups'],
+    realtime_triggers: ['lambda:CreateFunction','lambda:UpdateFunctionConfiguration','lambda:DeleteFunction'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/lambda/lambdaOldRuntimes.js

@@ -18,6 +18,7 @@ module.exports = {
             default: 0
         }
     },
+    realtime_triggers: ['lambda:CreateFunction','lambda:UpdateFunctionConfiguration','lambda:DeleteFunction'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/lambda/lambdaPublicAccess.js

@@ -10,6 +10,7 @@ module.exports = {
     link: 'https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html',
     recommended_action: 'Update the Lambda policy to prevent access from the public.',
     apis: ['Lambda:listFunctions', 'Lambda:getPolicy'],
+    realtime_triggers: ['lambda:CreateFunction','lambda:UpdateFunctionConfiguration','lambda:AddPermission', 'lambda:RemovePermission','lambda:DeleteFunction'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/lambda/lambdaTracingEnabled.js

@@ -18,6 +18,7 @@ module.exports = {
             default: 'Aqua-CSPM-Token-Rotator-Function,-CreateCSPMKeyFunction-,-TriggerDiscoveryFunction-,-GenerateVolumeScanningEx-,-GenerateCSPMExternalIdFu-'
         }
     },
+    realtime_triggers: ['lambda:CreateFunction','lambda:UpdateFunctionConfiguration','lambda:DeleteFunction'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/lambda/lambdaUniqueExecutionRole.js

@@ -10,7 +10,7 @@ module.exports = {
     link: 'https://docs.aws.amazon.com/lambda/latest/dg/lambda-intro-execution-role.html',
     recommended_action: 'Modify Lambda function and add new execution role.',
     apis: ['Lambda:listFunctions'],
-
+    realtime_triggers: ['lambda:CreateFunction','lambda:UpdateFunctionConfiguration', 'lambda:DeleteFunction'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/lambda/lambdaVpcConfig.js

@@ -18,6 +18,7 @@ module.exports = {
             default: 'Aqua-CSPM-Token-Rotator-Function,-CreateCSPMKeyFunction-,-TriggerDiscoveryFunction-,-GenerateVolumeScanningEx-,-GenerateCSPMExternalIdFu-'
         }
     },
+    realtime_triggers: ['lambda:CreateFunction','lambda:UpdateFunctionConfiguration','lambda:DeleteFunction'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/lex/lexAudioLogsEncrypted.js

@@ -19,6 +19,7 @@ module.exports = {
             default: 'awscmk'
         }
     },
+    realtime_triggers: ['lexmodelsV2:CreateBotAlias', 'lexmodelsV2:UpdateBotAlias', 'lexmodelsV2:DeleteBotAlias'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/location/geoCollectionDataEncrypted.js

@@ -19,6 +19,7 @@ module.exports = {
             default: 'awscmk'
         }
     },
+    realtime_triggers: ['location:CreateGeofenceCollection', 'location:DeleteGeofenceCollection'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/location/trackerDataEncrypted.js

@@ -19,6 +19,7 @@ module.exports = {
             default: 'awscmk'
         }
     },
+    realtime_triggers: ['location:CreateTracker', 'location:UpdateTracker', 'location:DeleteTracker'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/lookout/anomalyDetectorEncrypted.js

@@ -19,6 +19,7 @@ module.exports = {
             default: 'awscmk'
         }
     },
+    realtime_triggers: ['lookoutmetrics:CreateAnomalyDetector', 'lookoutmetrics:UpdateAnomalyDetector', 'lookoutmetrics:DeleteAnomalyDetector'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/lookout/equipmentdatasetEncrypted.js

@@ -19,6 +19,7 @@ module.exports = {
             default: 'awscmk'
         }
     },
+    realtime_triggers: ['lookoutequipment:CreateDataset', 'lookoutequipment:DeleteDataset'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/lookout/modelDataEncrypted.js

@@ -19,6 +19,7 @@ module.exports = {
             default: 'awscmk'
         }
     },
+    realtime_triggers: ['lookoutvision:CreateModel', 'lookoutvision:DeleteModel'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/managedblockchain/networkMemberDataEncrypted.js

@@ -19,6 +19,7 @@ module.exports = {
             default: 'awscmk',
         }
     },
+    realtime_triggers: ['managedblockchain:CreateNetwork', 'managedblockchain:DeleteMember'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/memorydb/memorydbClusterEncrypted.js

@@ -19,6 +19,7 @@ module.exports = {
             default: 'awscmk',
         }
     },
+    realtime_triggers: ['MemoryDB:CreateCluster', 'MemoryDB:DeleteCluster'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/mq/mqAutoMinorVersionUpgrade.js

@@ -10,6 +10,7 @@ module.exports = {
     recommended_action: 'Enabled Auto Minor Version Upgrade feature for MQ brokers',
     link: 'https://docs.aws.amazon.com/amazon-mq/latest/developer-guide/broker.html',
     apis: ['MQ:listBrokers', 'MQ:describeBroker'],
+    realtime_triggers: ['mq:CreateBrocker', 'mq:UpdateBrocker', 'mq:DeleteBrocker'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/mq/mqBrokerEncrypted.js

@@ -18,6 +18,7 @@ module.exports = {
             default: 'awscmk'
         }
     },
+    realtime_triggers: ['mq:CreateBrocker', 'mq:DeleteBrocker'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/mq/mqBrokerPublicAccess.js

@@ -10,6 +10,7 @@ module.exports = {
     recommended_action: 'Review and update the security group settings to restrict public access to Amazon MQ brokers.',
     link: 'https://docs.aws.amazon.com/amazon-mq/latest/developer-guide/using-amazon-mq-securely.html',
     apis: ['MQ:listBrokers', 'MQ:describeBroker', 'EC2:describeSecurityGroups'],
+    realtime_triggers: ['mq:CreateBrocker', 'mq:UpdateBroker', 'mq:DeleteBrocker'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/mq/mqDeploymentMode.js

@@ -10,6 +10,7 @@ module.exports = {
     recommended_action: 'Enabled Deployment Mode feature for MQ brokers',
     link: 'https://docs.aws.amazon.com/amazon-mq/latest/developer-guide/active-standby-broker-deployment.html',
     apis: ['MQ:listBrokers'],
+    realtime_triggers: ['mq:CreateBrocker', 'mq:UpdateBroker', 'mq:DeleteBrocker'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/mq/mqDesiredInstanceType.js

@@ -18,6 +18,7 @@ module.exports = {
             default:''
         }
     },
+    realtime_triggers: ['mq:CreateBrocker', 'mq:DeleteBrocker'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/mq/mqLatestEngineVersion.js

@@ -10,6 +10,7 @@ module.exports = {
     recommended_action: 'Update Amazon MQ brokers to the latest version of Apache ActiveMQ broker engine.',
     link: 'https://docs.aws.amazon.com/amazon-mq/latest/developer-guide/activemq-version-management.html',
     apis: ['MQ:listBrokers', 'MQ:describeBroker'],
+    realtime_triggers: ['mq:CreateBrocker','mq:UpdateBrocker', 'mq:DeleteBrocker'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/mq/mqLogExports.js

@@ -10,6 +10,7 @@ module.exports = {
     recommended_action: 'Enable Log Exports feature for MQ brokers',
     link: 'https://docs.aws.amazon.com/amazon-mq/latest/developer-guide/security-logging-monitoring.html',
     apis: ['MQ:listBrokers', 'MQ:describeBroker'],
+    realtime_triggers: ['mq:CreateBroker', 'mq:UpdateBroker','mq:DeleteBrocker'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/msk/mskClusterCBEncryption.js

@@ -11,6 +11,7 @@ module.exports = {
     link: 'https://docs.aws.amazon.com/msk/latest/developerguide/msk-encryption.html',
     recommended_action: 'Enable only TLS encryption between the client and broker for all MSK clusters',
     apis: ['Kafka:listClusters'],
+    realtime_triggers: ['kafka:CreateCluster','kafka:UpdateClusterConfiguration', 'kafka:DeleteCluster'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/msk/mskClusterEncryptionAtRest.js

@@ -18,6 +18,8 @@ module.exports = {
             default: 'awscmk',
         }
     },
+    realtime_triggers: ['kafka:CreateCluster', 'kafka:DeleteCluster'],
+
     run: function(cache, settings, callback) {
         var results = [];
         var source = {};

plugins/aws/msk/mskClusterEncryptionInTransit.js

@@ -11,6 +11,7 @@ module.exports = {
     link: 'https://docs.aws.amazon.com/msk/latest/developerguide/msk-encryption.html',
     recommended_action: 'Enable TLS encryption within the cluster for all MSK clusters',
     apis: ['Kafka:listClusters'],
+    realtime_triggers: ['kafka:CreateCluster','kafka:UpdateClusterConfiguration','kafka:DeleteCluster'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/msk/mskClusterPublicAccess.js

@@ -11,6 +11,7 @@ module.exports = {
     link: 'https://docs.aws.amazon.com/msk/latest/developerguide/public-access.html',
     recommended_action: 'Check for public access feature within the cluster for all MSK clusters',
     apis: ['Kafka:listClusters'],
+    realtime_triggers: ['kafka:CreateCluster', 'kafka:DeleteCluster'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/msk/mskClusterUnauthAccess.js

@@ -11,6 +11,7 @@ module.exports = {
     link: 'https://docs.aws.amazon.com/msk/latest/developerguide/msk-authentication.html',
     recommended_action: 'Ensure that MSK clusters does not have unauthenticated access enabled.',
     apis: ['Kafka:listClusters'],
+    realtime_triggers: ['kafka:CreateCluster','kafka:UpdateSecurity', 'kafka:DeleteCluster'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/mwaa/environmentAdminPrivileges.js

@@ -11,6 +11,7 @@ module.exports = {
     recommended_action: 'Modify IAM role attached with MWAA environment to provide the minimal amount of access required to perform its tasks',
     apis: ['MWAA:listEnvironments', 'MWAA:getEnvironment', 'IAM:listRoles', 'IAM:listAttachedRolePolicies', 'IAM:listRolePolicies',
         'IAM:listPolicies', 'IAM:getPolicy', 'IAM:getPolicyVersion', 'IAM:getRolePolicy', 'STS:getCallerIdentity'],
+    realtime_triggers: ['mwaa:CreateEnvironment','mwaa:UpdateEnviroment', 'mwaa:DeleteEnvironment'],    
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/mwaa/environmentDataEncrypted.js

@@ -19,6 +19,7 @@ module.exports = {
             default: 'awscmk'
         }
     },
+    realtime_triggers: ['mwaa:CreateEnvironment', 'mwaa:DeleteEnvironment'], 
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/mwaa/webServerPublicAccess.js

@@ -10,6 +10,7 @@ module.exports = {
     link: 'https://docs.aws.amazon.com/mwaa/latest/userguide/vpc-create.html',
     recommended_action: 'Modify Amazon MWAA environments to set web server access mode to be private only',
     apis: ['MWAA:listEnvironments', 'MWAA:getEnvironment', 'STS:getCallerIdentity'],
+    realtime_triggers: ['mwaa:CreateEnvironment','mwaa:UpdateEnviroment', 'mwaa:DeleteEnvironment'], 
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/neptune/neptuneDBInstanceEncrypted.js

@@ -20,6 +20,7 @@ module.exports = {
             default: 'awscmk',
         }
     },
+    realtime_triggers: ['neptune:CreateDBCluster', 'neptune:DeleteDBCluster'], 
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/openSearchServerless/opensearchCollectionCmkEncrypted.js

@@ -19,6 +19,8 @@ module.exports = {
             default: 'awscmk'
         }
     },
+    realtime_triggers: ['opensearchserverless:CreateCollection', 'opensearchserverless:DeleteCollection'],
+
     run: function(cache, settings, callback) {
         var results = [];
         var source = {};

plugins/aws/openSearchServerless/opensearchCollectionPublicAccess.js

@@ -10,6 +10,7 @@ module.exports = {
     link: 'https://docs.aws.amazon.com/opensearch-service/latest/developerguide/serverless-network.html',
     recommended_action: 'Update the network policy and remove the public access to the collection.',
     apis: ['OpenSearchServerless:listNetworkSecurityPolicies', 'OpenSearchServerless:getNetworkSecurityPolicy', 'OpenSearchServerless:listCollections'],
+    realtime_triggers: ['opensearchserverless:CreateCollection', 'opensearserverless:UpdateCollection', 'opensearchserverless:DeleteCollection'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/opensearch/opensearchAccessFromIps.js

@@ -18,6 +18,7 @@ module.exports = {
             default: ''
         }
     },
+    realtime_triggers: ['opensearch:CreateDomain', 'opensearch:UpdateDomainConfig', 'opensearch:DeleteDomain'], 
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/opensearch/opensearchClusterStatus.js

@@ -10,6 +10,7 @@ module.exports = {
     link: 'https://docs.aws.amazon.com/opensearch-service/latest/developerguide/cloudwatch-alarms.html',
     recommended_action: 'Configure alarms to send notification if cluster status remains red for more than a minute.',
     apis: ['OpenSearch:listDomainNames', 'CloudWatch:getEsMetricStatistics', 'STS:getCallerIdentity'],
+    realtime_triggers: ['openSearch:CreateDomain', 'opensearch:UpdateDomainConfig','opensearch:DeleteDomain'], 
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/opensearch/opensearchCrossAccountAccess.js

@@ -37,6 +37,8 @@ module.exports = {
             default: 'aws:PrincipalArn,aws:PrincipalAccount,aws:PrincipalOrgID,aws:SourceAccount,aws:SourceArn,aws:SourceOwner'
         },
     },
+    realtime_triggers: ['opensearch:CreateDomain','opensearch:UpdateDomainConfig', 'opensearch:DeleteDomain'], 
+
     run: function(cache, settings, callback) {
         var config= {
             os_whitelisted_aws_account_principals : settings.os_whitelisted_aws_account_principals || this.settings.os_whitelisted_aws_account_principals.default,

plugins/aws/opensearch/opensearchDedicatedMasterEnabled.js

@@ -10,6 +10,7 @@ module.exports = {
     link: 'https://docs.aws.amazon.com/opensearch-service/latest/developerguide/managedomains-dedicatedmasternodes.html',
     recommended_action: 'Update the domain to use dedicated master nodes.',
     apis: ['OpenSearch:listDomainNames', 'OpenSearch:describeDomain', 'STS:getCallerIdentity'],
+    realtime_triggers: ['opensearch:CreateDomain','opensearch:UpdateDomainConfig', 'opensearch:DeleteDomain'], 
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/opensearch/opensearchDesiredInstanceTypes.js

@@ -24,6 +24,7 @@ module.exports = {
             default: ''
         }
     },
+    realtime_triggers: ['opensearch:CreateDomain', 'opensearch:DeleteDomain'], 
 
     run: function(cache, settings, callback) {
         const results = [];

plugins/aws/opensearch/opensearchDomainEncryptionEnabled.js

@@ -18,6 +18,7 @@ module.exports = {
             default: 'awscmk',
         }
     },
+    realtime_triggers: ['opensearch:CreateDomain', 'opensearch:UpdateDomainConfig', 'opensearch:DeleteDomain'], 
 
     run: function(cache, settings, callback) {
         var config = {

plugins/aws/opensearch/opensearchEncryptedDomain.js

@@ -29,7 +29,7 @@ module.exports = {
         remediate: ['opensearch:UpdateDomainConfig'],
         rollback: ['opensearch:UpdateDomainConfig']
     },
-    realtime_triggers: ['opensearch:CreateDomain', 'opensearch:UpdateDomainConfig'],
+    realtime_triggers: ['opensearch:CreateDomain', 'opensearch:UpdateDomainConfig', 'opensearch:DeleteDomain'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/opensearch/opensearchExposedDomain.js

@@ -10,6 +10,7 @@ module.exports = {
     link: 'https://docs.aws.amazon.com/opensearch-service/latest/developerguide/fgac.html',
     recommended_action: 'Update OpenSearch domain to set access control.',
     apis: ['OpenSearch:listDomainNames', 'OpenSearch:describeDomain', 'STS:getCallerIdentity'],
+    realtime_triggers: ['opensearch:CreateDomain', 'opensearch:UpdateDomainConfig', 'opensearch:DeleteDomain'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/opensearch/opensearchHttpsOnly.js

@@ -29,7 +29,7 @@ module.exports = {
         remediate: ['opensearch:UpdateDomainConfig'],
         rollback: ['opensearch:UpdateDomainConfig']
     },
-    realtime_triggers: ['opensearch:CreateDomain', 'opensearch:UpdateDomainConfig'],
+    realtime_triggers: ['opensearch:CreateDomain', 'opensearch:UpdateDomainConfig', 'opensearch:DeleteDomain'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/opensearch/opensearchLoggingEnabled.js

@@ -10,6 +10,7 @@ module.exports = {
     link: 'https://docs.aws.amazon.com/opensearch-service/latest/developerguide/createdomain-configure-slow-logs.html',
     recommended_action: 'Ensure logging is enabled and a CloudWatch log group is specified for each OpenSearch domain.',
     apis: ['OpenSearch:listDomainNames', 'OpenSearch:describeDomain'],
+    realtime_triggers: ['opensearch:CreateDomain', 'opensearch:UpdateDomainConfig', 'opensearch:DeleteDomain'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/opensearch/opensearchNodeToNodeEncryption.js

@@ -21,7 +21,7 @@ module.exports = {
         remediate: ['opensearch:UpdateDomainConfig'],
         rollback: ['opensearch:UpdateDomainConfig']
     },
-    realtime_triggers: ['opensearch:CreateDomain', 'opensearch:UpdateDomainConfig'],
+    realtime_triggers: ['opensearch:CreateDomain', 'opensearch:UpdateDomainConfig', 'opensearch:DeleteDomain'],
 
     run: function(cache, settings, callback) {
         var results = [];

plugins/aws/opensearch/opensearchPublicEndpoint.js

@@ -18,6 +18,7 @@ module.exports = {
             default: 'false'
         },
     },
+    realtime_triggers: ['opensearch:CreateDomain', 'opensearch:UpdateDomainConfig', 'opensearch:DeleteDomain'],
 
     run: function(cache, settings, callback) {
         var results = [];