// RiskCredentialsExposedRule
resource "aws_cloudwatch_event_rule" "risk_credentials_exposed_rule" {
  name          = "${local.name_prefix}-cloudwatch-event-rule"
  description   = "Risk credentials exposed rule"
  event_pattern = <<PATTERN
  {
    "source": ["aws.health"],
    "detail-type": ["AWS Health Event"],
    "detail": {
      "service": ["RISK"],
      "eventTypeCategory": ["issue"],
      "eventTypeCode": [
        "AWS_RISK_CREDENTIALS_EXPOSED",
        "AWS_RISK_IAM_QUARANTINE"
      ]
    }
  }
PATTERN

  tags = local.common_tags
}

resource "aws_cloudwatch_event_target" "risk_credentials_exposed_rule_target" {
  rule      = aws_cloudwatch_event_rule.risk_credentials_exposed_rule.name
  target_id = "TargetFunctionV1"
  arn       = aws_sfn_state_machine.exposed_key_step_function.id
  role_arn  = aws_iam_role.execute_state_machine_role.arn
}