# AWS audit pipeline: CloudTrail management events -> Postgres.
#
# Requires the community plugins library:
#   export STREAMLING__PLUGIN__PATH=./libcommunity_plugins.so
#
# Postgres sink connection (env, not YAML):
#   export STREAMLING__POSTGRES_SINK__HOST=localhost
#   export STREAMLING__POSTGRES_SINK__USER=postgres
#   export STREAMLING__POSTGRES_SINK__PASS=postgres
#   export STREAMLING__POSTGRES_SINK__DB=aws
#
# AWS credentials come from the default chain (aws configure, SSO, roles);
# the only IAM permission needed is cloudtrail:LookupEvents.

sources:
  aws_audit:
    type: cloudtrail_source
    primary_key: event_id
    options:
      # One source covers one region; us-east-1 also carries global-service
      # events (IAM, STS, console sign-in).
      region: us-east-1
      # Backfill from this point (any time within the 90-day retention),
      # then keep tailing. Use "now" to skip the backfill entirely.
      start_time: "2026-07-27T00:00:00Z"
      # Management events are dominated by reads; keep only mutating calls.
      # Drop this filter if you also want denied read attempts captured.
      lookup_attribute_key: ReadOnly
      lookup_attribute_value: "false"

transforms: {}

sinks:
  postgres.audit_events:
    type: postgres
    from: aws_audit
    schema: audit
    table: events
    # Upserting by CloudTrail's event UUID absorbs the source's
    # at-least-once re-deliveries (lookback re-scans, restarts).
    primary_key: event_id