AWS EventBridge connector — customer onboarding

Secruna offers two ways to connect your AWS account for AI inventory discovery:

1. Assume role — you create a read-only IAM role we assume on a schedule. Comprehensive, but requires granting cross-account IAM access.

2. EventBridge push (recommended) — you create a single EventBridge rule that forwards AI-relevant CloudTrail events (Lambda / Bedrock / SageMaker / Comprehend / Polly / Rekognition) to a Secruna-managed bus. No IAM grant in your account. Sub-minute discovery latency.

This page covers option 2.

What gets forwarded

Only these 7 CloudTrail event names — the events that signal a new AI-relevant resource:

• CreateFunction20150331v2, UpdateFunctionConfiguration20150331v2 (Lambda)
• CreateModel (Bedrock)
• CreateEndpoint (SageMaker)
• CreateDocumentClassifier (Comprehend)
• CreateVoice (Polly)
• CreateProject (Rekognition)

Everything else stays in your account.

Step 1 — Tell us your AWS account number

In the Secruna dashboard:

1. Open Connections → Connect AWS.
2. Choose the EventBridge push (new) tab.
3. Enter your 12-digit AWS account number → Connect.

We provision a dedicated EventBridge bus (secruna-customer-<your-tenant-id>) in our AWS account and email you the next-step CloudFormation snippet within one business day.

Step 2 — Deploy the forwarding rule

The CloudFormation snippet we email creates:

• An EventBridge rule on your default event bus that matches the 7 CloudTrail events above.
• An IAM role with one inline policy granting events:PutEvents on our bus only. No other permissions.

# Excerpt from the snippet you receive:
SecrunaForwardingRule:
  Type: AWS::Events::Rule
  Properties:
    EventPattern:
      source:
        - aws.lambda
        - aws.bedrock
        - aws.sagemaker
        - aws.comprehend
        - aws.polly
        - aws.rekognition
      detail-type:
        - "AWS API Call via CloudTrail"
      detail:
        eventName:
          - CreateFunction20150331v2
          - UpdateFunctionConfiguration20150331v2
          - CreateModel
          - CreateEndpoint
          - CreateDocumentClassifier
          - CreateVoice
          - CreateProject
    Targets:
      - Arn: arn:aws:events:us-east-1:<secruna-account>:event-bus/secruna-customer-<tenant-id>
        RoleArn: !Sub "arn:aws:iam::${AWS::AccountId}:role/${SecrunaRoleName}"

Deploy with:

aws cloudformation deploy \
  --template-file secruna-eventbridge.yaml \
  --stack-name secruna-eventbridge-forwarder \
  --capabilities CAPABILITY_IAM

Step 3 — Verify

Create a test Lambda in your account (e.g. via the AWS console). Within 60 seconds the Lambda should appear in Inventory → AI systems in the Secruna dashboard.

The Connections → AWS page also shows a real-time webhook health panel (last received, 24h count, the receiver URL).

Revoking

Delete the CloudFormation stack. Future CloudTrail events stop flowing immediately. We mark every existing AI system from your account as archived on the next inventory tick.

What we DO see vs DON'T see

We see ONLY:

• The 7 CloudTrail events listed above (ARNs, names, regions).
• Your AWS account ID (carried in userIdentity.accountId).
• The exact JSON bodies AWS already emits for those events.

We do NOT see:

• Anything that didn't trip one of the 7 event matchers.
• IAM grants, secrets, or any other CloudTrail event.
• Any data plane traffic (Lambda invocation payloads, Bedrock prompts, etc.).

Security

• Every forwarded event is signed with HMAC-SHA256 by a Lambda in our AWS account; cp-api rejects unsigned / mis-signed deliveries.
• The cross-account permission grant is the narrowest EventBridge supports: events:PutEvents on a single bus ARN, principal pinned to our AWS account number.
• We log every received delivery in the audit log. You can review your audit log via the dashboard.