JupiterOne Alert Rule - Unreviewed Changes To AWS Managed Policies

unreviewed-aws-managed-policy-changes.json

{
  "name": "Unreviewed Changes To AWS Managed Policies",
  "description": "AWS Managed Policies that have been unreviewed by the Security team.",
  "version": 1,
  "specVersion": 1,
  "pollingInterval": "ONE_DAY",
  "templates": {},
  "outputs": [
    "alertLevel"
  ],
  "question": {
    "queries": [
      {
        "name": "query0",
        "query": "FIND aws_iam_policy\n WITH vendorManaged=true\n AND updatedOn > date(your_team_last_reviewed_date)\n AND accountId = 'your_aws_account_id'\n THAT ALLOWS >> as allow_relationship * as impacted_service\nWHERE allow_relationship._beginOn > date(your_team_last_reviewed_date)\n",
        "version": "v1"
      }
    ]
  },
  "operations": [
    {
      "when": {
        "type": "FILTER",
        "specVersion": 1,
        "condition": [
          "AND",
          [
            "queries.query0.total",
            ">",
            0
          ]
        ]
      },
      "actions": [        
        {
            "type": "SET_PROPERTY",
            "targetValue": "HIGH",
            "targetProperty": "alertLevel"
        },
        {
          "type": "CREATE_ALERT"
        }
    ]
    }
  ],
  "tags": []
}