### Example Usage of AWS ClickOps Notifier Module (HCL)

Source: https://github.com/cloudandthings/terraform-aws-clickops-notifier/blob/main/examples/basic/README.md

This HCL code block defines the required Terraform version and providers (AWS, random), configures the AWS provider region, sets up local variables for naming and tags, creates a random pet name for uniqueness, provisions an S3 bucket and KMS key, and finally invokes the `clickops_notifications` module with necessary inputs.

```HCL
terraform {
  required_version = ">= 0.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 4.9"
    }

    random = {
      source  = "hashicorp/random"
      version = "~> 3.4"
    }
  }
}

provider "aws" {
  region = "eu-west-1"
}

locals {
  tags = {
    usage = "clickops-testing"
    run   = random_pet.run_id.id
  }

  naming_prefix = "clickops-test-basic-${random_pet.run_id.id}"
}

resource "random_pet" "run_id" {
  keepers = {
    # Generate a new pet name
    run_id = var.run_id
  }
}

module "clickops_notifications" {
  source = "../../"

  naming_prefix          = local.naming_prefix
  cloudtrail_bucket_name = aws_s3_bucket.test_bucket.id

  webhooks_for_slack_notifications = {
    my-first-notification : "https://fake.com"
  }
  webhooks_for_msteams_notifications = {
    my-second-notification : "https://fake.com"
  }

  tags = local.tags

  # Optional
  kms_key_id_for_sns_topic = aws_kms_key.clickops_sns_topic.arn
}


resource "aws_s3_bucket" "test_bucket" {
  bucket = local.naming_prefix
  tags   = local.tags
}

# To encrypt the SNS topic
data "aws_caller_identity" "current" {}

data "aws_iam_policy_document" "clickops_sns_topic" {
  statement {
    sid = "Enable IAM User Permissions"
    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
    }
    actions   = ["kms:*"]
    resources = ["*"]
  }
  statement {
    principals {
      type        = "Service"
      identifiers = ["s3.amazonaws.com"]
    }
    actions = [
      "kms:GenerateDataKey*",
      "kms:Decrypt"
    ]
    resources = ["*"]
    condition {
      test     = "ArnEquals"
      variable = "aws:SourceArn"
      values   = [aws_s3_bucket.test_bucket.arn]
    }
    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = [data.aws_caller_identity.current.account_id]
    }
  }
}

resource "aws_kms_key" "clickops_sns_topic" {
  description             = "KMS key for SNS topic ${local.naming_prefix}"
  deletion_window_in_days = 7
  policy                  = data.aws_iam_policy_document.clickops_sns_topic.json

  tags = local.tags
}
```

--------------------------------

### Configure Providers and Setup Test Infrastructure

Source: https://github.com/cloudandthings/terraform-aws-clickops-notifier/blob/main/examples/delivery_stream/README.md

This HCL code block defines the required Terraform providers (AWS, random), configures the AWS provider region, sets up local variables for naming and tags, creates a random pet name for a unique run ID, and provisions AWS resources like an S3 bucket for logs, a CloudTrail trail, and integrates the local `clickops_notifications` module, depending on the CloudTrail setup.

```HCL
terraform {
  required_version = ">= 0.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 4.9"
    }

    random = {
      source  = "hashicorp/random"
      version = "~> 3.4"
    }
  }
}

provider "aws" {
  region = "eu-west-1"
}

locals {
  tags = {
    usage = "clickops-testing"
    run   = random_pet.run_id.id
  }

  naming_prefix = "clickops-test-basic-${random_pet.run_id.id}"
}

resource "random_pet" "run_id" {
  keepers = {
    # Generate a new pet name
    run_id = var.run_id
  }
}

#---------------------------------------
# Cloudtrail infrastructure - standalone
#---------------------------------------
# S3 bucket
module "logs_bucket" {
  source  = "trussworks/logs/aws"
  version = "~> 14"

  s3_bucket_name = local.naming_prefix

  allow_cloudtrail = true
  force_destroy    = true
}

# Cloudtrail
locals {
  naming_prefix_cloudtrail = "${local.naming_prefix}-cloudtrail"
  naming_prefix_firehose   = "${local.naming_prefix}-firehose"
}
module "aws_cloudtrail" {
  source  = "trussworks/cloudtrail/aws"
  version = "~> 4"

  s3_bucket_name = module.logs_bucket.aws_logs_bucket

  trail_name      = local.naming_prefix_cloudtrail
  iam_policy_name = local.naming_prefix_cloudtrail
  iam_role_name   = local.naming_prefix_cloudtrail

  cloudwatch_log_group_name = local.naming_prefix_cloudtrail
  log_retention_days        = 30
}

#---------------------------------------
# ClickOps module
#---------------------------------------
module "clickops_notifications" {
  source = "../.."

  standalone = true

  naming_prefix = local.naming_prefix

  webhooks_for_slack_notifications = {
    my-first-notification : "https://fake.com"
  }
  webhooks_for_msteams_notifications = {
    my-second-notification : "https://fake.com"
  }

  tags = local.tags

  # cloudtrail_bucket_name = aws_s3_bucket.clickops_cloudtrail.id
  cloudtrail_log_group = local.naming_prefix_cloudtrail

  firehose_delivery_stream_name = aws_kinesis_firehose_delivery_stream.extended_s3_stream.name

  depends_on = [
    module.aws_cloudtrail
  ]

}

#---------------------------------------
```

--------------------------------

### Specify CloudTrail S3 Bucket Name (HCL)

Source: https://github.com/cloudandthings/terraform-aws-clickops-notifier/blob/main/README.md

Sets the name of the S3 bucket where CloudTrail logs are stored and from which events should be processed. A common naming convention for Control Tower buckets is provided as an example. This variable is optional and defaults to an empty string.

```HCL
variable "cloudtrail_bucket_name" {
  description = "Bucket containing the Cloudtrail logs that you want to process. ControlTower bucket name follows this naming convention `aws-controltower-logs-{{account_id}}-{{region}}`"
  type        = string
  default     = ""
}
```

--------------------------------

### Configure Terraform Providers and AWS Resources

Source: https://github.com/cloudandthings/terraform-aws-clickops-notifier/blob/main/examples/standalone/README.md

This HCL code block initializes Terraform, defines required providers (AWS and random), sets the AWS region, defines local variables for naming and tags, creates a random pet resource for a unique run ID, and instantiates modules for an S3 logs bucket, AWS CloudTrail, and the clickops_notifications module.

```HCL
terraform {
  required_version = ">= 0.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 4.9"
    }

    random = {
      source  = "hashicorp/random"
      version = "~> 3.4"
    }
  }
}

provider "aws" {
  region = "eu-west-1"
}

locals {
  tags = {
    usage = "clickops-testing"
    run   = random_pet.run_id.id
  }

  naming_prefix = "clickops-test-basic-${random_pet.run_id.id}"
}

resource "random_pet" "run_id" {
  keepers = {
    # Generate a new pet name
    run_id = var.run_id
  }
}

#---------------------------------------
# Cloudtrail infrastructure - standalone
#---------------------------------------
# S3 bucket
module "logs_bucket" {
  source  = "trussworks/logs/aws"
  version = "~> 14"

  s3_bucket_name = local.naming_prefix

  allow_cloudtrail = true
  force_destroy    = true
}

# Cloudtrail
locals {
  naming_prefix_cloudtrail = "${local.naming_prefix}-cloudtrail"
}
module "aws_cloudtrail" {
  source  = "trussworks/cloudtrail/aws"
  version = "~> 4"

  s3_bucket_name = module.logs_bucket.aws_logs_bucket

  trail_name      = local.naming_prefix_cloudtrail
  iam_policy_name = local.naming_prefix_cloudtrail
  iam_role_name   = local.naming_prefix_cloudtrail

  cloudwatch_log_group_name = local.naming_prefix_cloudtrail
  log_retention_days        = 30
}

#---------------------------------------
# ClickOps module
#---------------------------------------
module "clickops_notifications" {
  source = "../.."

  standalone = true

  naming_prefix = local.naming_prefix

  webhooks_for_slack_notifications = {
    my-first-notification : "https://fake.com"
  }
  webhooks_for_msteams_notifications = {
    my-second-notification : "https://fake.com"
  }

  tags = local.tags

  # cloudtrail_bucket_name = aws_s3_bucket.clickops_cloudtrail.id
  cloudtrail_log_group = local.naming_prefix_cloudtrail

  depends_on = [
    module.aws_cloudtrail
  ]

}
```

--------------------------------

### Configuring Terraform Providers and Resources for ClickOps Notifier Test

Source: https://github.com/cloudandthings/terraform-aws-clickops-notifier/blob/main/examples/role/README.md

This HCL code block defines the required Terraform version and providers (AWS, random), sets up local variables for naming and tags, creates test resources like a random pet name, an S3 bucket, and an IAM role with a policy attachment, and configures the `clickops_notifications` module for testing.

```HCL
terraform {
  required_version = ">= 0.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 4.9"
    }

    random = {
      source  = "hashicorp/random"
      version = "~> 3.4"
    }
  }
}

provider "aws" {
  region = "eu-west-1"
}

locals {
  tags = {
    usage = "clickops-testing"
    run   = random_pet.run_id.id
  }

  naming_prefix = "clickops-test-role-${random_pet.run_id.id}"
}

resource "random_pet" "run_id" {
  keepers = {
    # Generate a new pet name
    run_id = var.run_id
  }
}

module "clickops_notifications" {
  source = "../../"

  naming_prefix          = local.naming_prefix
  cloudtrail_bucket_name = aws_s3_bucket.test_bucket.id

  webhooks_for_slack_notifications = {
    my-first-notification : "https://fake.com"
  }
  webhooks_for_msteams_notifications = {
    my-second-notification : "https://fake.com"
  }

  tags = local.tags

  create_iam_role = false
  iam_role_arn    = aws_iam_role.test_role.arn
}

resource "aws_iam_role" "test_role" {
  name = local.naming_prefix

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Sid    = ""
        Principal = {
          Service = "lambda.amazonaws.com"
        }
      }
    ]
  })

  tags = local.tags
}

resource "aws_iam_role_policy_attachment" "test_attach" {
  role       = aws_iam_role.test_role.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonSQSFullAccess"
}



resource "aws_s3_bucket" "test_bucket" {
  bucket = local.naming_prefix
  tags   = local.tags
}
```

--------------------------------

### Run Pytest Tests (Basic) - Shell

Source: https://github.com/cloudandthings/terraform-aws-clickops-notifier/blob/main/tests/README.md

Execute the pytest tests, excluding those marked as 'slow', and specify a unique run ID for the test execution. This command assumes necessary AWS credentials and region configuration are already in place.

```sh
pytest -m 'not slow' --run-id MY_RUN_ID
```

--------------------------------

### Creating AWS S3 Bucket for Firehose (HCL)

Source: https://github.com/cloudandthings/terraform-aws-clickops-notifier/blob/main/examples/delivery_stream/README.md

Defines an AWS S3 bucket intended to store the output from the Kinesis Firehose delivery stream. It uses a local naming prefix and includes comments indicating ignored security findings related to encryption, logging, and versioning.

```HCL
resource "aws_s3_bucket" "firehose" {
  #tfsec:ignore:aws-s3-encryption-customer-key
  #tfsec:ignore:aws-s3-enable-bucket-logging
  #tfsec:ignore:aws-s3-enable-versioning
  bucket = local.naming_prefix_firehose
}
```

--------------------------------

### Run Pytest Tests (with EC2 Key Pair) - Shell

Source: https://github.com/cloudandthings/terraform-aws-clickops-notifier/blob/main/tests/README.md

Execute the pytest tests, excluding 'slow' tests, specifying a run ID, and additionally providing an EC2 key pair name. This is useful if tests require EC2 instances and a specific key pair is needed for access or operations.

```sh
pytest -m 'not slow' --run-id MY_RUN_ID --ec2-key-pair-name MY_KEY_PAIR_NAME
```

--------------------------------

### Configuring AWS Kinesis Firehose Delivery Stream (HCL)

Source: https://github.com/cloudandthings/terraform-aws-clickops-notifier/blob/main/examples/delivery_stream/README.md

Defines an AWS Kinesis Firehose delivery stream configured to send data to an S3 bucket. It includes dynamic partitioning based on recipientAccountId and awsRegion, and processing steps for record de-aggregation, metadata extraction (using JQ), and appending a delimiter.

```HCL
resource "aws_kinesis_firehose_delivery_stream" "extended_s3_stream" {
  name        = local.naming_prefix
  destination = "extended_s3"

  extended_s3_configuration {
    role_arn   = aws_iam_role.firehose.arn
    bucket_arn = aws_s3_bucket.firehose.arn

    compression_format = "UNCOMPRESSED"

    buffer_size     = 64
    buffer_interval = 300

    # Hive-style dynamic partitioning by recipientAccountId and awsRegion
    # https://docs.aws.amazon.com/firehose/latest/dev/dynamic-partitioning.html

    dynamic_partitioning_configuration {
      enabled = "true"
    }

    prefix = join("/", [
      "data",
      "recipientAccountId=!{partitionKeyFromQuery:recipientAccountId}",
      "awsRegion=!{partitionKeyFromQuery:awsRegion}",
      "year=!{timestamp:yyyy}", "month=!{timestamp:MM}", "day=!{timestamp:dd}", "hour=!{timestamp:HH}",
      ""
    ])
    error_output_prefix = join("/", [
      "errors",
      "year=!{timestamp:yyyy}", "month=!{timestamp:MM}", "day=!{timestamp:dd}", "hour=!{timestamp:HH}",
      "!{firehose:error-output-type}",
      ""
    ])

    processing_configuration {
      enabled = "true"

      # DeAggreagate records
      processors {
        type = "RecordDeAggregation"
        parameters {
          parameter_name  = "SubRecordType"
          parameter_value = "JSON"
        }
      }

      # Calculate partition variables
      processors {
        type = "MetadataExtraction"
        parameters {
          parameter_name  = "JsonParsingEngine"
          parameter_value = "JQ-1.6"
        }
        parameters {
          parameter_name  = "MetadataExtractionQuery"
          parameter_value = "{recipientAccountId:.recipientAccountId, awsRegion:.awsRegion}"
        }
      }

      # Append new line between output records
      processors {
        type = "AppendDelimiterToRecord"
      }
    }
  }
}
```

--------------------------------

### Specify Lambda Deployment S3 Key (HCL)

Source: https://github.com/cloudandthings/terraform-aws-clickops-notifier/blob/main/README.md

Sets the S3 object key (path) for the Lambda deployment package within the specified S3 bucket (`lambda_deployment_s3_bucket`). If not provided, it defaults to a path based on the naming prefix and deployment filename. This variable is optional and defaults to null.

```HCL
variable "lambda_deployment_s3_key" {
  description = "S3 object key for lambda deployment package. Otherwise, defaults to `var.naming_prefix/local.deployment_filename`."
  type        = string
  default     = null
}
```

--------------------------------

### Defining IAM Policy Document for Firehose (HCL)

Source: https://github.com/cloudandthings/terraform-aws-clickops-notifier/blob/main/examples/delivery_stream/README.md

Defines the IAM policy document specifying the permissions that the Firehose service needs to interact with the target S3 bucket. It grants permissions for various S3 operations like putting objects, listing buckets, and handling multipart uploads.

```HCL
data "aws_iam_policy_document" "firehose" {
  #tfsec:ignore:aws-iam-no-policy-wildcards
  statement {
    actions = [
      "s3:AbortMultipartUpload",
      "s3:GetBucketLocation",
      "s3:GetObject",
      "s3:ListBucket",
      "s3:ListBucketMultipartUploads",
      "s3:PutObject"
    ]

    resources = [
      aws_s3_bucket.firehose.arn,
      "${aws_s3_bucket.firehose.arn}/*"
    ]
  }
}
```

--------------------------------

### Configuring S3 Bucket Server-Side Encryption (HCL)

Source: https://github.com/cloudandthings/terraform-aws-clickops-notifier/blob/main/examples/delivery_stream/README.md

Configures server-side encryption for the Firehose S3 bucket, enforcing AES256 encryption by default for all objects stored in the bucket.

```HCL
resource "aws_s3_bucket_server_side_encryption_configuration" "firehose" {
  bucket = aws_s3_bucket.firehose.bucket

  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm = "AES256"
    }
  }
}
```

--------------------------------

### Specify Lambda Deployment S3 Bucket (HCL)

Source: https://github.com/cloudandthings/terraform-aws-clickops-notifier/blob/main/README.md

Sets the name of the S3 bucket where the Lambda deployment package is stored. This is required if the Lambda package is not built locally or included directly in the module. This variable is optional and defaults to null.

```HCL
variable "lambda_deployment_s3_bucket" {
  description = "S3 bucket for lambda deployment package."
  type        = string
  default     = null
}
```

--------------------------------

### Configure Event Maximum Batching Window (HCL)

Source: https://github.com/cloudandthings/terraform-aws-clickops-notifier/blob/main/README.md

Sets the maximum amount of time (in seconds) the SQS queue will wait to gather a batch of events before sending it to the Lambda function. This variable is optional and defaults to 300 seconds.

```HCL
variable "event_maximum_batching_window" {
  description = "Maximum batching window in seconds."
  type        = number
  default     = 300
}
```

--------------------------------

### Creating AWS IAM Role for Firehose (HCL)

Source: https://github.com/cloudandthings/terraform-aws-clickops-notifier/blob/main/examples/delivery_stream/README.md

Defines an AWS IAM role that the Kinesis Firehose service will assume to perform actions on other AWS resources, specifically the target S3 bucket. The assume role policy grants trust to the `firehose.amazonaws.com` service principal.

```HCL
resource "aws_iam_role" "firehose" {
  name = local.naming_prefix_firehose

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Sid    = ""
        Principal = {
          Service = "firehose.amazonaws.com"
        }
      }
    ]
  })
}
```

--------------------------------

### Attaching IAM Policy to Firehose Role (HCL)

Source: https://github.com/cloudandthings/terraform-aws-clickops-notifier/blob/main/examples/delivery_stream/README.md

Attaches an IAM policy to the Firehose IAM role. The policy document is sourced from a data block and defines the specific permissions required by Firehose to interact with the S3 bucket.

```HCL
resource "aws_iam_role_policy" "firehose" {
  name   = local.naming_prefix_firehose
  role   = aws_iam_role.firehose.id
  policy = data.aws_iam_policy_document.firehose.json
}
```

--------------------------------

### Verify AWS Account ID (CLI)

Source: https://github.com/cloudandthings/terraform-aws-clickops-notifier/blob/main/README.md

This command uses the AWS CLI to retrieve the caller's identity and filters the output to show the Account ID. It is used to verify that the current AWS credentials point to the correct account, such as the Control Tower Log Archive account, before deploying the module.

```bash
aws sts get-caller-identity | grep Account
```

--------------------------------

### Specify Included Users (HCL)

Source: https://github.com/cloudandthings/terraform-aws-clickops-notifier/blob/main/README.md

Provides a list of email addresses for users whose manual actions should be scanned. If this list is empty, all users will be scanned, subject to `excluded_users`. This variable is optional and defaults to an empty list.

```HCL
variable "included_users" {
  description = "List of emails that be scanned to manual actions. If empty will scan all emails."
  type        = list(string)
  default     = []
}
```

--------------------------------

### Specify Included Accounts (HCL)

Source: https://github.com/cloudandthings/terraform-aws-clickops-notifier/blob/main/README.md

Provides a list of AWS account IDs that should be scanned for manual actions. If this list is empty, all accounts will be scanned, subject to `excluded_accounts`. This variable is optional and defaults to an empty list.

```HCL
variable "included_accounts" {
  description = "List of accounts that be scanned to manual actions. If empty will scan all accounts."
  type        = list(string)
  default     = []
}
```

--------------------------------

### Configure Event Batch Size (HCL)

Source: https://github.com/cloudandthings/terraform-aws-clickops-notifier/blob/main/README.md

Sets the maximum number of events to process in a single batch by the Lambda function. This affects how events are pulled from the SQS queue. This variable is optional and defaults to 100.

```HCL
variable "event_batch_size" {
  description = "Batch events into chunks of `event_batch_size`"
  type        = number
  default     = 100
}
```

--------------------------------

### Blocking S3 Bucket Public Access (HCL)

Source: https://github.com/cloudandthings/terraform-aws-clickops-notifier/blob/main/examples/delivery_stream/README.md

Configures the S3 bucket to block public access control lists (ACLs), ensuring the bucket used by Firehose remains private and inaccessible from the public internet.

```HCL
resource "aws_s3_bucket_public_access_block" "firehose" {
  bucket            = aws_s3_bucket.firehose.id
  block_public_acls = true
}
```

--------------------------------

### Specify Existing CloudTrail Bucket Notifications SNS ARN (HCL)

Source: https://github.com/cloudandthings/terraform-aws-clickops-notifier/blob/main/README.md

Provides the ARN of an existing SNS topic used for S3 bucket notifications from the CloudTrail log bucket. If not provided, the module will create a new SNS topic and configure bucket notifications. This variable is optional and defaults to null.

```HCL
variable "cloudtrail_bucket_notifications_sns_arn" {
  description = "SNS topic ARN for bucket notifications. If not provided, a new SNS topic will be created along with the bucket notifications configuration."
  type        = string
  default     = null
}
```

--------------------------------

### Control IAM Role Creation (HCL)

Source: https://github.com/cloudandthings/terraform-aws-clickops-notifier/blob/main/README.md

Boolean flag to determine whether the module should create a new IAM role for the Lambda function (`true`) or use an existing one (`false`). If set to `false`, the `iam_role_arn` variable must be provided. This variable is optional and defaults to `true`.

```HCL
variable "create_iam_role" {
  description = "Determines whether a an IAM role is created or to use an existing IAM role"
  type        = bool
  default     = true
}
```

--------------------------------

### Specify Existing IAM Role ARN (HCL)

Source: https://github.com/cloudandthings/terraform-aws-clickops-notifier/blob/main/README.md

Provides the ARN of an existing IAM role to be used by the Lambda function. This variable is required if `create_iam_role` is set to `false`. This variable is optional and defaults to null.

```HCL
variable "iam_role_arn" {
  description = "Existing IAM role ARN for the lambda. Required if `create_iam_role` is set to `false`"
  type        = string
  default     = null
}
```

--------------------------------

### Configure Additional IAM Policy Statements (HCL)

Source: https://github.com/cloudandthings/terraform-aws-clickops-notifier/blob/main/README.md

Defines a map of dynamic policy statements to be attached to the Lambda function's IAM role. This allows for custom permissions beyond the default configuration. The variable is optional and defaults to an empty map.

```HCL
variable "additional_iam_policy_statements" {
  description = "Map of dynamic policy statements to attach to Lambda Function role"
  type        = any
  default     = {}
}
```

--------------------------------

### Specify Allowed Principals for SNS Subscription (HCL)

Source: https://github.com/cloudandthings/terraform-aws-clickops-notifier/blob/main/README.md

Provides a list of AWS principals that are permitted to subscribe to the SNS topic created by the module. This is primarily applicable in organizational deployments to control access. The variable is optional and defaults to an empty list.

```HCL
variable "allowed_aws_principals_for_sns_subscribe" {
  description = "List of AWS principals allowed to subscribe to the SNS topic (only applicable to org deployments)."
  type        = list(string)
  default     = []
}
```

--------------------------------

### Configure Event Processing Timeout (HCL)

Source: https://github.com/cloudandthings/terraform-aws-clickops-notifier/blob/main/README.md

Sets the maximum execution time (in seconds) for the Lambda function and the visibility timeout for messages in the SQS queue after being received by the Lambda. This variable is optional and defaults to 60 seconds.

```HCL
variable "event_processing_timeout" {
  description = "Maximum number of seconds the lambda is allowed to run and number of seconds events should be hidden in SQS after being picked up my Lambda."
  type        = number
  default     = 60
}
```

--------------------------------

### Specify Excluded Scoped Actions (HCL)

Source: https://github.com/cloudandthings/terraform-aws-clickops-notifier/blob/main/README.md

Provides a list of specific service-scoped actions that should not trigger alerts. The format is `{{service}}.amazonaws.com:{{action}}`. This variable is optional and defaults to an empty list.

```HCL
variable "excluded_scoped_actions" {
  description = "A list of service scoped actions that will not be alerted on. Format {{service}}.amazonaws.com:{{action}}"
  type        = list(string)
  default     = []
}
```

--------------------------------

### Specify Kinesis Firehose Delivery Stream Name (HCL)

Source: https://github.com/cloudandthings/terraform-aws-clickops-notifier/blob/main/README.md

Sets the name of a Kinesis Firehose delivery stream where ClickOps events should be outputted. This allows integration with other data processing or storage services. This variable is optional and defaults to null.

```HCL
variable "firehose_delivery_stream_name" {
  description = "Kinesis Firehose delivery stream name to output ClickOps events to."
  type        = string
  default     = null
}
```

--------------------------------

### Specify KMS Key ID for SNS Topic Encryption (HCL)

Source: https://github.com/cloudandthings/terraform-aws-clickops-notifier/blob/main/README.md

Provides the KMS key ID to be used for encrypting the SNS topic created by the module. This is only applicable in organizational deployments where SNS encryption is required. This variable is optional and defaults to null.

```HCL
variable "kms_key_id_for_sns_topic" {
  description = "KMS key ID for encrypting the sns_topic (only applicable to org deployments)."
  type        = string
  default     = null
}
```

--------------------------------

### Configure Excluded Scoped Actions Effect (HCL)

Source: https://github.com/cloudandthings/terraform-aws-clickops-notifier/blob/main/README.md

Determines whether the provided `excluded_scoped_actions` list should replace the default list (`REPLACE`) or be added to it (`APPEND`). Valid values are `APPEND` and `REPLACE`. This variable is optional and defaults to `APPEND`.

```HCL
variable "excluded_scoped_actions_effect" {
  description = "Should the existing exluded actions be replaces or appended to. By default it will append to the list, valid values: APPEND, REPLACE"
  type        = string
  default     = "APPEND"
}
```

--------------------------------

### Specify Excluded Accounts (HCL)

Source: https://github.com/cloudandthings/terraform-aws-clickops-notifier/blob/main/README.md

Provides a list of AWS account IDs that should be excluded from manual action scans and reporting. This list takes precedence over `included_accounts`. This variable is optional and defaults to an empty list.

```HCL
variable "excluded_accounts" {
  description = "List of accounts that be excluded for scans on manual actions. These take precidence over `included_accounts`"
  type        = list(string)
  default     = []
}
```

--------------------------------

### Specify Excluded Users (HCL)

Source: https://github.com/cloudandthings/terraform-aws-clickops-notifier/blob/main/README.md

Provides a list of email addresses for users whose manual actions should not be reported. This allows filtering out specific individuals from ClickOps reporting. This variable is optional and defaults to an empty list.

```HCL
variable "excluded_users" {
  description = "List of email addresses will not be reported on when practicing ClickOps."
  type        = list(string)
  default     = []
}
```

--------------------------------

### Specify CloudTrail CloudWatch Log Group (HCL)

Source: https://github.com/cloudandthings/terraform-aws-clickops-notifier/blob/main/README.md

Sets the name of the CloudWatch Log Group where CloudTrail events are sent. This is used for processing events directly from CloudWatch Logs if S3 bucket notifications are not used. This variable is optional and defaults to an empty string.

```HCL
variable "cloudtrail_log_group" {
  description = "CloudWatch Log group for CloudTrail events."
  type        = string
  default     = ""
}
```

--------------------------------

### Define Default Excluded AWS Actions (HCL)

Source: https://github.com/cloudandthings/terraform-aws-clickops-notifier/blob/main/README.md

This HCL code block defines a local variable `ignored_scoped_events_built_in` which is a list of AWS API actions. These actions are intended to be excluded from monitoring by the ClickOps notifier, likely because they represent common or non-critical operations that would generate excessive noise.

```HCL
locals {
  ignored_scoped_events_built_in = [
    "cognito-idp.amazonaws.com:InitiateAuth",
    "cognito-idp.amazonaws.com:RespondToAuthChallenge",

    "sso.amazonaws.com:Federate",
    "sso.amazonaws.com:Authenticate",
    "sso.amazonaws.com:Logout",
    "sso.amazonaws.com:SearchUsers",
    "sso.amazonaws.com:SearchGroups",
    "sso.amazonaws.com:CreateToken",

    "signin.amazonaws.com:UserAuthentication",
    "signin.amazonaws.com:SwitchRole",
    "signin.amazonaws.com:RenewRole",
    "signin.amazonaws.com:ExternalIdPDirectoryLogin",
    "signin.amazonaws.com:CredentialVerification",
    "signin.amazonaws.com:CredentialChallenge",
    "signin.amazonaws.com:CheckMfa",

    "logs.amazonaws.com:StartQuery",
    "cloudtrail.amazonaws.com:StartQuery",

    "iam.amazonaws.com:SimulatePrincipalPolicy",
    "iam.amazonaws.com:GenerateServiceLastAccessedDetails",

    "glue.amazonaws.com:BatchGetJobs",
    "glue.amazonaws.com:BatchGetCrawlers",
    "glue.amazonaws.com:StartJobRun",
    "glue.amazonaws.com:StartCrawler",

    "athena.amazonaws.com:StartQueryExecution",

    "servicecatalog.amazonaws.com:SearchProductsAsAdmin",
    "servicecatalog.amazonaws.com:SearchProducts",
    "servicecatalog.amazonaws.com:SearchProvisionedProducts",
    "servicecatalog.amazonaws.com:TerminateProvisionedProduct",

    "cloudshell.amazonaws.com:CreateSession",
    "cloudshell.amazonaws.com:PutCredentials",
    "cloudshell.amazonaws.com:SendHeartBeat",
    "cloudshell.amazonaws.com:CreateEnvironment",

    "kms.amazonaws.com:Decrypt",
    "kms.amazonaws.com:RetireGrant",

    "trustedadvisor.amazonaws.com:RefreshCheck",

    # Must CreateMultipartUpload before uploading any parts.
    "s3.amazonaws.com:UploadPart",
    "s3.amazonaws.com:UploadPartCopy",

    "route53domains:TransferDomain",

    "support.amazonaws.com:AddAttachmentsToSet",
    "support.amazonaws.com:AddCommunicationToCase",
    "support.amazonaws.com:CreateCase",
    "support.amazonaws.com:InitiateCallForCase",
    "support.amazonaws.com:InitiateChatForCase",
    "support.amazonaws.com:PutCaseAttributes",
    "support.amazonaws.com:RateCaseCommunication",
    "support.amazonaws.com:RefreshTrustedAdvisorCheck",
    "support.amazonaws.com:ResolveCase",

    "grafana.amazonaws.com:login_auth_sso",
  ]
}
```

=== COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.