import * as cdk from "aws-cdk-lib"; import * as cloudwatch from "aws-cdk-lib/aws-cloudwatch"; import * as constructs from "constructs"; export interface CloudTrailSlackIntegrationProps extends cdk.StackProps { /** * A key-value pair of values to augment (e.g., AWS account IDs, principal IDs) with friendly names * to use when sending messages to Slack. * * NOTE: A simple heuristic is used to avoid replacing values inside of ARNs etc. as this can * lead to unpleasant formatting of various fields in the Slack message. */ friendlyNames?: { [key: string]: string; }; slackWebhookUrl: string; slackChannel: string; /** * A list of ARNs of roles in the current account to monitor usage of. */ rolesToMonitor?: string[]; /** * Whether to monitor various IAM API calls associated with the current account's root user (e.g., console login, password reset, etc.) * * @default true */ monitorRootUserActions?: boolean; /** * Whether to set up additional AWS infrastructure to deduplicate CloudTrail events in order to avoid duplicate Slack messages. May be used to decrease noise. * * @default false */ deduplicateEvents?: boolean; /** * If supplied, CloudWatch alarms will be created for the construct's underlying infrastructure (e.g., Lambda functions) and the action will be used to notify on OK and ALARM actions. */ infrastructureAlarmAction?: cloudwatch.IAlarmAction; } /** * Forward a predefined set of CloudTrail API events to Slack using EventBridge, Lambda * and an optional SQS FIFO queue for deduplicating events. * The API events are limited to monitoring access to the current account's root user and/or specific IAM roles. * * NOTE: The construct needs to be provisioned in us-east-1, and requires an existing CloudTrail set up in that region. */ export declare class CloudTrailSlackIntegration extends constructs.Construct { constructor(scope: constructs.Construct, id: string, props: CloudTrailSlackIntegrationProps); }