I've been setting up CloudGuard for our AWS environments to get a handle on posture management and threat prevention. We have a pretty complex IAM setup, and I want to be immediately notified of any changes to IAM roles—like trust policy modifications, new inline policies attached, or the role being deleted. I know CloudGuard can detect these events, but I'm trying to fine-tune the alerting so my team isn't flooded with noise.
From the Event Policy section, I see I can create a rule based on the "Action Type" (like `iam:UpdateAssumeRolePolicy`). My current setup looks something like this in the rule criteria:
```
Action Type: is one of
- iam:UpdateAssumeRolePolicy
- iam:PutRolePolicy
- iam:DeleteRolePolicy
- iam:DeleteRole
Resource Type: equals AWS::IAM::Role
```
My main questions are:
1. Is this the most precise way to catch all role modifications, or am I missing some critical API actions?
2. How are you all handling the alert delivery? I'd prefer a Slack webhook, but I only see the default email/SMS options in the alert actions. Do I need to route it through an SNS topic first?
3. Has anyone successfully filtered this further to only alert on roles matching a specific name pattern (e.g., `prod-*`)? I'm not sure if the resource name is available as a filter field.
I'm used to building these kinds of workflows in Zapier, so I'm trying to map that logic over. Any screenshots or specific JSON filter examples from your own configurations would be incredibly helpful.