nivleshc

def publish_to_eventbridge(job_status_event):
    """
    Publish a custom event to Amazon EventBridge.

    The event is published with:
    - Source: custom.macie.job-status
    - DetailType: Macie Classification Job Status Change
    - Detail: The full job status event data as JSON

    Parameters:

nivleshc

def parse_job_status_event(log_event):
    """
    Parse a Macie job status event from a CloudWatch Logs log event.

    Macie publishes job status events as JSON objects to CloudWatch Logs.
    The log event message contains the full event details including:
    - eventType (e.g., JOB_CREATED, ONE_TIME_JOB_STARTED, JOB_COMPLETED)
    - jobId
    - jobName
    - occurredAt

nivleshc

def decode_cloudwatch_logs_data(event):
    """
    Decode and decompress the CloudWatch Logs data from the event.

    CloudWatch Logs sends data to the subscription filter in the following format:
    - Base64 encoded
    - Gzip compressed
    - JSON formatted

    Parameters:

nivleshc

def lambda_handler(event, context):
    """
    Main handler function.

    Parameters:
        event (dict): The CloudWatch Logs event containing base64 encoded,
                      gzip compressed log data
        context: Lambda context object

    Returns:

nivleshc

import json
import base64
import gzip
import os
import logging
from datetime import datetime, timezone

import boto3

# Configure logging

nivleshc

# Copy this file to terraform.tfvars and update the values as per your requirements

environment             = "dev"
s3_bucket_names         = ["your-bucket-name-1", "your-bucket-name-2"]
email_for_notifications = "your-email@example.com"
classification_job_name = "macie-sensitive-data-discovery-job"
classification_job_type = "ONE_TIME"
sampling_percentage     = 100

nivleshc

output "macie_account_id" {
  description = "The AWS account ID where Macie has been enabled"
  value       = data.aws_caller_identity.current.account_id
}

output "classification_job_id" {
  description = "The ID of the Macie classification job"
  value       = aws_macie2_classification_job.this.job_id
}

nivleshc

# SNS Topic for Macie job status notifications
resource "aws_sns_topic" "macie_notifications" {
  name         = local.sns.topic_name
  display_name = local.sns.display_name
}

# SNS Topic Policy to allow EventBridge to publish to the topic
resource "aws_sns_topic_policy" "macie_notifications" {
  arn = aws_sns_topic.macie_notifications.arn

nivleshc

# EventBridge rule to capture the custom Macie job status change events
# published by the Lambda function
resource "aws_cloudwatch_event_rule" "macie_job_status" {
  name        = local.eventbridge.rule_name
  description = local.eventbridge.rule_description

  event_pattern = jsonencode({
    source      = [local.eventbridge.event_source]
    detail-type = [local.eventbridge.detail_type]
  })

nivleshc

# Lambda function that processes Macie job status events from CloudWatch Logs
# and publishes them as custom events to EventBridge
resource "aws_lambda_function" "macie_job_status" {
  function_name    = local.lambda_function.function_name
  description      = local.lambda_function.description
  role             = aws_iam_role.lambda_execution_role.arn
  handler          = local.lambda_function.handler
  runtime          = local.lambda_function.runtime
  timeout          = local.lambda_function.timeout
  memory_size      = local.lambda_function.memory_size