@meyicloud/meyi-insight-server 1.0.0

package/dist/features/sources/cloudtrail/template.js

@@ -0,0 +1,1230 @@
+/**
+ * Unified Stack CloudFormation template for CloudTrail security monitoring.
+ *
+ * The raw YAML is embedded here verbatim from meyi-security-monitoring.yaml.
+ * Two server-side substitutions are applied at serve time:
+ *   __MEYI_WEBHOOK_URL__           → the source's authenticated webhook URL
+ *   __MEYI_DEPLOYMENT_STATUS_URL__ → the deployment-status callback URL (token-gated)
+ *   __MEYI_WEBHOOK_AUTH_TOKEN__    → webhook auth token
+ */
+export const ALL_AWS_ACTIVE_REGIONS = [
+    'us-east-1', 'us-east-2', 'us-west-1', 'us-west-2',
+    'ca-central-1',
+    'eu-west-1', 'eu-west-2', 'eu-west-3',
+    'eu-central-1',
+    'eu-north-1',
+    'ap-south-1',
+    'ap-southeast-1', 'ap-southeast-2',
+    'ap-northeast-1', 'ap-northeast-2', 'ap-northeast-3',
+    'sa-east-1',
+].join(',');
+const CENTRAL_STACK_YAML = `
+AWSTemplateFormatVersion: '2010-09-09'
+Description: |
+  MeyiConnect Security Monitoring — Unified Stack.
+  Deploys the StackSet across customer accounts/regions AND notifies
+  the MeyiConnect backend via EventBridge API Destinations when deployment completes.
+  Deploy this ONCE in the MeyiConnect management account (primary region).
+
+Metadata:
+  AWS::CloudFormation::Interface:
+    ParameterGroups:
+      - Label:
+          default: "Deployment Targets"
+        Parameters:
+          - DeploymentMode
+          - CreateIAMRoles
+          - TargetOUs
+          - TargetAccounts
+          - TargetRegions
+      - Label:
+          default: "CloudTrail Settings"
+        Parameters:
+          - CreateCloudTrail
+          - PrimaryRegion
+      - Label:
+          default: "Template"
+        Parameters:
+          - TemplateUrl
+          - GlobalTemplateUrl
+      - Label:
+          default: "MeyiConnect Backend"
+        Parameters:
+          - BackendUrl
+          - WebhookAuthToken
+    ParameterLabels:
+      WebhookUrl:
+        default: "MeyiConnect Security Alerts Webhook URL"
+      DeploymentMode:
+        default: "Deployment Mode"
+      CreateIAMRoles:
+        default: "Create StackSet IAM Roles?"
+      TargetOUs:
+        default: "Target Organizational Unit IDs (comma separated)"
+      TargetAccounts:
+        default: "Optional: Target AWS Account IDs to filter (comma separated)"
+      TargetRegions:
+        default: "Target Regions (comma separated)"
+      CreateCloudTrail:
+        default: "Create Multi-Region CloudTrail?"
+      PrimaryRegion:
+        default: "Primary Region (for CloudTrail)"
+      BackendUrl:
+        default: "MeyiConnect Backend Notification URL"
+      WebhookAuthToken:
+        default: "MeyiConnect Webhook Authorization Token"
+
+Parameters:
+
+  WebhookUrl:
+    Type: String
+    Description: MeyiConnect webhook URL for security alerts.
+    Default: "__MEYI_WEBHOOK_URL__"
+
+  DeploymentMode:
+    Type: String
+    Default: '__MEYI_DEPLOYMENT_MODE__'
+    AllowedValues:
+      - 'Organizations'
+      - 'Standalone'
+    Description: "Deploy via Organizations (Service-Managed) or Standalone account (Self-Managed)."
+
+  CreateIAMRoles:
+    Type: String
+    Default: '__MEYI_CREATE_IAM_ROLES__'
+    AllowedValues:
+      - 'true'
+      - 'false'
+    Description: "Create standard AWSCloudFormationStackSetAdministrationRole and AWSCloudFormationStackSetExecutionRole? Only used in Standalone mode."
+
+  TargetOUs:
+    Type: CommaDelimitedList
+__MEYI_TARGET_OUS_DEFAULT__
+    Description: AWS Organizational Unit IDs (OUs) to deploy security monitoring (comma separated). To deploy to all accounts, enter your Organization Root ID (e.g., r-xxxx). Leave empty for Standalone mode.
+    Default: "ou-0gey-xp0hksbc"
+
+  TargetAccounts:
+    Type: CommaDelimitedList
+__MEYI_TARGET_ACCOUNTS_DEFAULT__
+    Description: Optional AWS Account IDs to restrict deployment (comma separated). Leave blank to deploy to all accounts in targeted OUs.
+
+  TargetRegions:
+    Type: CommaDelimitedList
+    Description: AWS Regions to deploy security monitoring (comma separated).
+    Default: '__MEYI_TARGET_REGIONS__'
+
+  CreateCloudTrail:
+    Type: String
+    Default: 'true'
+    AllowedValues:
+      - 'true'
+      - 'false'
+    Description: Set to false if the customer already has a CloudTrail.
+
+  PrimaryRegion:
+    Type: String
+    Default: '__MEYI_PRIMARY_REGION__'
+    Description: Primary region where the multi-region CloudTrail and S3 bucket will be created.
+
+  BackendUrl:
+    Type: String
+    Default: '__MEYI_DEPLOYMENT_STATUS_URL__'
+    Description: MeyiConnect internal backend URL to receive deployment status notifications.
+
+  WebhookAuthToken:
+    Type: String
+    NoEcho: true
+    Default: '__MEYI_WEBHOOK_AUTH_TOKEN__'
+    Description: MeyiConnect Webhook Authorization Token.
+
+Conditions:
+  HasTargetOUs: !Not [ !Equals [ !Join [ "", !Ref TargetOUs ], "" ] ]
+  HasTargetAccounts: !Not [ !Equals [ !Join [ "", !Ref TargetAccounts ], "" ] ]
+  IsServiceManaged: !Equals [ !Ref DeploymentMode, 'Organizations' ]
+  IsSelfManaged: !Equals [ !Ref DeploymentMode, 'Standalone' ]
+  ShouldCreateRoles: !And [ !Equals [ !Ref DeploymentMode, 'Standalone' ], !Equals [ !Ref CreateIAMRoles, 'true' ] ]
+  ShouldCreateStackInstances: !Or [ !Condition IsSelfManaged, !Condition HasTargetOUs ]
+
+Resources:
+
+  # ============================================================
+  # IAM ROLES FOR SELF-MANAGED STACKSETS (STANDALONE MODE)
+  # ============================================================
+
+  StackSetAdministrationRole:
+    Type: AWS::IAM::Role
+    Condition: ShouldCreateRoles
+    Properties:
+      RoleName: AWSCloudFormationStackSetAdministrationRole
+      AssumeRolePolicyDocument:
+        Version: '2012-10-17'
+        Statement:
+          - Effect: Allow
+            Principal:
+              Service: cloudformation.amazonaws.com
+            Action: sts:AssumeRole
+      Policies:
+        - PolicyName: AssumeRole-AWSCloudFormationStackSetExecutionRole
+          PolicyDocument:
+            Version: '2012-10-17'
+            Statement:
+              - Effect: Allow
+                Action: sts:AssumeRole
+                Resource: !GetAtt StackSetExecutionRole.Arn
+
+  StackSetExecutionRole:
+    Type: AWS::IAM::Role
+    Condition: ShouldCreateRoles
+    Properties:
+      RoleName: AWSCloudFormationStackSetExecutionRole
+      AssumeRolePolicyDocument:
+        Version: '2012-10-17'
+        Statement:
+          - Effect: Allow
+            Principal:
+              AWS: !Ref AWS::AccountId
+            Action: sts:AssumeRole
+      Policies:
+        - PolicyName: !Sub "\${AWS::StackName}-StackSetExecutionPolicy"
+          PolicyDocument:
+            Version: '2012-10-17'
+            Statement:
+              - Sid: CloudFormationOperations
+                Effect: Allow
+                Action:
+                  - cloudformation:CreateStack
+                  - cloudformation:UpdateStack
+                  - cloudformation:DeleteStack
+                  - cloudformation:DescribeStacks
+                  - cloudformation:DescribeStackEvents
+                  - cloudformation:DescribeStackResource
+                  - cloudformation:GetTemplate
+                  - cloudformation:GetTemplateSummary
+                  - cloudformation:ListStackResources
+                Resource: !Sub "arn:aws:cloudformation:*:\${AWS::AccountId}:stack/StackSet-\${AWS::StackName}-SecurityMonitoring*"
+              - Sid: S3Operations
+                Effect: Allow
+                Action:
+                  - s3:CreateBucket
+                  - s3:DeleteBucket
+                  - s3:GetBucketLocation
+                  - s3:GetBucketPolicy
+                  - s3:PutBucketPolicy
+                  - s3:DeleteBucketPolicy
+                  - s3:GetBucketVersioning
+                  - s3:PutBucketVersioning
+                  - s3:GetEncryptionConfiguration
+                  - s3:PutEncryptionConfiguration
+                  - s3:GetBucketPublicAccessBlock
+                  - s3:PutBucketPublicAccessBlock
+                  - s3:GetBucketTagging
+                  - s3:PutBucketTagging
+                Resource: "arn:aws:s3:::*"
+              - Sid: CloudTrailOperations
+                Effect: Allow
+                Action:
+                  - cloudtrail:CreateTrail
+                  - cloudtrail:UpdateTrail
+                  - cloudtrail:DeleteTrail
+                  - cloudtrail:GetTrail
+                  - cloudtrail:GetTrailStatus
+                  - cloudtrail:StartLogging
+                  - cloudtrail:StopLogging
+                  - cloudtrail:ListTags
+                  - cloudtrail:AddTags
+                  - cloudtrail:RemoveTags
+                Resource: !Sub "arn:aws:cloudtrail:*:\${AWS::AccountId}:trail/\${AWS::StackName}-SecurityTrail"
+              - Sid: SNSOperations
+                Effect: Allow
+                Action:
+                  - sns:CreateTopic
+                  - sns:DeleteTopic
+                  - sns:GetTopicAttributes
+                  - sns:SetTopicAttributes
+                  - sns:Subscribe
+                  - sns:Unsubscribe
+                  - sns:TagResource
+                  - sns:UntagResource
+                  - sns:ListTagsForResource
+                Resource:
+                  - !Sub "arn:aws:sns:*:\${AWS::AccountId}:*"
+              - Sid: EventBridgeOperations
+                Effect: Allow
+                Action:
+                  - events:PutRule
+                  - events:DeleteRule
+                  - events:DescribeRule
+                  - events:PutTargets
+                  - events:RemoveTargets
+                  - events:ListTargetsByRule
+                  - events:TagResource
+                  - events:UntagResource
+                  - events:ListTagsForResource
+                Resource: !Sub "arn:aws:events:*:\${AWS::AccountId}:rule/\${AWS::StackName}-*"
+
+  # ============================================================
+  # STACKSET
+  # Deploys central-stack.yaml across target accounts and regions
+  # ============================================================
+
+  SecurityMonitoringStackSet:
+    Type: AWS::CloudFormation::StackSet
+    DependsOn:
+      - StackSetApiDestination
+      - StackSetOperationRule
+    Properties:
+      StackSetName: !Sub "\${AWS::StackName}-SecurityMonitoring"
+      Description: !Sub "\${AWS::StackName} Security Monitoring (regional logs)"
+      TemplateBody: |
+        AWSTemplateFormatVersion: '2010-09-09'
+        Description: |
+          Meyi Connect Security Monitoring - Central Stack. Deploys local regional security alerting rules via EventBridge API Destinations (Serverless / Raw Event Payload), and an optional multi-region CloudTrail.
+          Reports deployment status back to Meyi Connect.
+
+        Metadata:
+          AWS::CloudFormation::Interface:
+            ParameterGroups:
+              - Label:
+                  default: "Naming & Context"
+                Parameters:
+                  - ParentStackName
+              - Label:
+                  default: "CloudTrail Deployment Settings"
+                Parameters:
+                  - CreateCloudTrail
+                  - PrimaryRegion
+              - Label:
+                  default: "Alert Settings"
+                Parameters:
+                  - WebhookUrl
+                  - WebhookAuthToken
+            ParameterLabels:
+              ParentStackName:
+                default: "Parent Stack Name Prefix"
+              CreateCloudTrail:
+                default: "Create Multi-Region CloudTrail?"
+              PrimaryRegion:
+                default: "Primary Region (Only used if 'Create Multi-Region CloudTrail?' is true)"
+              WebhookUrl:
+                default: "MeyiConnect Webhook URL"
+              WebhookAuthToken:
+                default: "MeyiConnect Webhook Authorization Token"
+
+        Parameters:
+
+          ParentStackName:
+            Type: String
+            Default: 'MeyiConnect'
+            Description: Parent stack name prefix used for naming resources.
+
+          WebhookUrl:
+            Type: String
+            Description: MeyiConnect webhook URL for security alerts.
+
+          WebhookAuthToken:
+            Type: String
+            NoEcho: true
+            Default: '28e3b2faf28d48f28ef74759f8a40fefbd4be6ccce2544f1aeb63ddcbdebe8d4'
+            Description: MeyiConnect Webhook Authorization Token.
+
+          CreateCloudTrail:
+            Type: String
+            Default: 'true'
+            AllowedValues:
+              - 'true'
+              - 'false'
+            Description: Whether to create a new multi-region CloudTrail and S3 bucket. Set to 'false' if you already have a trail.
+
+          PrimaryRegion:
+            Type: String
+            Default: 'us-west-2'
+            Description: The primary region where the multi-region CloudTrail and its S3 bucket should be created.
+
+        Conditions:
+          CreateNewTrail: !And
+            - !Equals [ !Ref CreateCloudTrail, 'true' ]
+            - !Equals [ !Ref 'AWS::Region', !Ref PrimaryRegion ]
+
+        Resources:
+
+          # ============================================================
+          # S3 BUCKET FOR CLOUDTRAIL
+          # ============================================================
+
+          CloudTrailS3Bucket:
+            Type: AWS::S3::Bucket
+            Condition: CreateNewTrail
+            DeletionPolicy: Retain
+            Properties:
+              Tags:
+                - Key: Project
+                  Value: MeyiConnect
+                - Key: Created_for
+                  Value: L1 Security
+                - Key: aws-apn-id
+                  Value: pc:eyl8vo7kcwv8k9qctzbathhiq
+              VersioningConfiguration:
+                Status: Enabled
+              PublicAccessBlockConfiguration:
+                BlockPublicAcls: true
+                BlockPublicPolicy: true
+                IgnorePublicAcls: true
+                RestrictPublicBuckets: true
+              BucketEncryption:
+                ServerSideEncryptionConfiguration:
+                  - ServerSideEncryptionByDefault:
+                       SSEAlgorithm: AES256
+
+          CloudTrailS3BucketPolicy:
+            Type: AWS::S3::BucketPolicy
+            Condition: CreateNewTrail
+            Properties:
+              Bucket: !Ref CloudTrailS3Bucket
+              PolicyDocument:
+                Version: '2012-10-17'
+                Statement:
+                  - Sid: AWSCloudTrailAclCheck
+                    Effect: Allow
+                    Principal:
+                      Service: cloudtrail.amazonaws.com
+                    Action: s3:GetBucketAcl
+                    Resource: !Sub arn:aws:s3:::\${CloudTrailS3Bucket}
+                  - Sid: AWSCloudTrailWrite
+                    Effect: Allow
+                    Principal:
+                      Service: cloudtrail.amazonaws.com
+                    Action: s3:PutObject
+                    Resource: !Sub arn:aws:s3:::\${CloudTrailS3Bucket}/AWSLogs/\${AWS::AccountId}/*
+                    Condition:
+                      StringEquals:
+                        s3:x-amz-acl: bucket-owner-full-control
+
+          # ============================================================
+          # CLOUDTRAIL
+          # ============================================================
+
+          CloudTrail:
+            Type: AWS::CloudTrail::Trail
+            Condition: CreateNewTrail
+            DependsOn: CloudTrailS3BucketPolicy
+            Properties:
+              Tags:
+                - Key: Project
+                  Value: MeyiConnect
+                - Key: Created_for
+                  Value: L1 Security
+                - Key: aws-apn-id
+                  Value: pc:eyl8vo7kcwv8k9qctzbathhiq
+              TrailName: !Sub "\${ParentStackName}-SecurityTrail"
+              S3BucketName: !Ref CloudTrailS3Bucket
+              IsLogging: true
+              IsMultiRegionTrail: true
+              IncludeGlobalServiceEvents: true
+              EnableLogFileValidation: true
+              IsOrganizationTrail: false
+              EventSelectors:
+                - ReadWriteType: All
+                  IncludeManagementEvents: true
+
+          # ============================================================
+          # EVENTBRIDGE API DESTINATION & CONNECTION
+          # ============================================================
+
+          SecurityApiConnection:
+            Type: AWS::Events::Connection
+            Properties:
+              Name: !Sub "\${ParentStackName}-ApiConn-\${AWS::Region}"
+              Description: API Connection for MeyiConnect regional security alerts with Bearer Token auth
+              AuthorizationType: API_KEY
+              AuthParameters:
+                ApiKeyAuthParameters:
+                  ApiKeyName: Authorization
+                  ApiKeyValue: !Sub "Bearer \${WebhookAuthToken}"
+
+          SecurityApiDestination:
+            Type: AWS::Events::ApiDestination
+            Properties:
+              Name: !Sub "\${ParentStackName}-ApiDest-\${AWS::Region}"
+              Description: API Destination for MeyiConnect regional security alerts
+              ConnectionArn: !GetAtt SecurityApiConnection.Arn
+              InvocationEndpoint: !Ref WebhookUrl
+              HttpMethod: POST
+              InvocationRateLimitPerSecond: 100
+
+          EventBridgeApiDestinationRole:
+            Type: AWS::IAM::Role
+            Properties:
+              RoleName: !Sub "\${ParentStackName}-EbRole-\${AWS::Region}"
+              AssumeRolePolicyDocument:
+                Version: '2012-10-17'
+                Statement:
+                  - Effect: Allow
+                    Principal:
+                      Service: events.amazonaws.com
+                    Action: sts:AssumeRole
+              Policies:
+                - PolicyName: InvokeApiDestinationPolicy
+                  PolicyDocument:
+                    Version: '2012-10-17'
+                    Statement:
+                      - Effect: Allow
+                        Action:
+                          - events:InvokeApiDestination
+                        Resource: !GetAtt SecurityApiDestination.Arn
+              Tags:
+                - Key: Project
+                  Value: MeyiConnect
+                - Key: Created_for
+                  Value: L1 Security
+                - Key: aws-apn-id
+                  Value: pc:eyl8vo7kcwv8k9qctzbathhiq
+
+          # ============================================================
+          # EVENTBRIDGE RULES ON DEFAULT BUS
+          # ============================================================
+
+          DataAndInfrastructureSecurityRule:
+            Type: AWS::Events::Rule
+            DependsOn: SecurityApiDestination
+            Properties:
+              Tags:
+                - Key: Project
+                  Value: MeyiConnect
+                - Key: Created_for
+                  Value: L1 Security
+                - Key: aws-apn-id
+                  Value: pc:eyl8vo7kcwv8k9qctzbathhiq
+              Name: !Sub "\${ParentStackName}-DataInfraRule"
+              Description: EC2, VPC, network, S3, and RDS configuration changes in the deployment region
+              EventPattern:
+                source:
+                  - aws.ec2
+                  - aws.s3
+                  - aws.rds
+                detail-type:
+                  - AWS API Call via CloudTrail
+                detail:
+                  eventSource:
+                    - ec2.amazonaws.com
+                    - s3.amazonaws.com
+                    - rds.amazonaws.com
+                  eventName:
+                    # EC2 & Network Events
+                    - StopInstances
+                    - RunInstances
+                    - RebootInstances
+                    - StartInstances
+                    - TerminateInstances
+                    - CreateCustomerGateway
+                    - DeleteCustomerGateway
+                    - AttachInternetGateway
+                    - CreateInternetGateway
+                    - DeleteInternetGateway
+                    - DetachInternetGateway
+                    - CreateNetworkAcl
+                    - DeleteNetworkAcl
+                    - CreateNetworkAclEntry
+                    - DeleteNetworkAclEntry
+                    - ReplaceNetworkAclEntry
+                    - ReplaceNetworkAclAssociation
+                    - AuthorizeSecurityGroupIngress
+                    - AuthorizeSecurityGroupEgress
+                    - RevokeSecurityGroupIngress
+                    - RevokeSecurityGroupEgress
+                    - CreateSecurityGroup
+                    - DeleteSecurityGroup
+                    - CreateVpc
+                    - DeleteVpc
+                    - ModifyVpcAttribute
+                    - AcceptVpcPeeringConnection
+                    - CreateVpcPeeringConnection
+                    - DeleteVpcPeeringConnection
+                    - RejectVpcPeeringConnection
+                    - AttachClassicLinkVpc
+                    - DetachClassicLinkVpc
+                    - DisableVpcClassicLink
+                    - EnableVpcClassicLink
+                    - ModifyImageAttribute
+                    - ModifySnapshotAttribute
+                    - ModifyInstanceAttribute
+                    - ImportKeyPair
+                    - CreateKeyPair
+                    - DisableEbsEncryptionByDefault
+                    - DeleteFlowLogs
+                    # S3 Events
+                    - PutBucketPublicAccessBlock
+                    - DeletePublicAccessBlock
+                    - PutBucketPolicy
+                    - DeleteBucketPolicy
+                    - PutBucketAcl
+                    - PutBucketEncryption
+                    - DeleteBucketEncryption
+                    - DeleteBucket
+                    # RDS Events
+                    - ModifyDBInstance
+                    - ModifyDBSnapshotAttribute
+                    - DeleteDBInstance
+                    - DeleteDBClusterSnapshot
+                    - RestoreDBInstanceFromDBSnapshot
+              State: ENABLED
+              Targets:
+                - Id: ApiDestinationTarget
+                  Arn: !GetAtt SecurityApiDestination.Arn
+                  RoleArn: !GetAtt EventBridgeApiDestinationRole.Arn
+
+          OperationsAndSecretsSecurityRule:
+            Type: AWS::Events::Rule
+            DependsOn: SecurityApiDestination
+            Properties:
+              Tags:
+                - Key: Project
+                  Value: MeyiConnect
+                - Key: Created_for
+                  Value: L1 Security
+                - Key: aws-apn-id
+                  Value: pc:eyl8vo7kcwv8k9qctzbathhiq
+              Name: !Sub "\${ParentStackName}-OpsSecretsRule"
+              Description: Lambda, SSM, Secrets Manager, and KMS configuration/management events
+              EventPattern:
+                source:
+                  - aws.lambda
+                  - aws.ssm
+                  - aws.secretsmanager
+                  - aws.kms
+                detail-type:
+                  - AWS API Call via CloudTrail
+                detail:
+                  eventSource:
+                    - lambda.amazonaws.com
+                    - ssm.amazonaws.com
+                    - secretsmanager.amazonaws.com
+                    - kms.amazonaws.com
+                  eventName:
+                    # Lambda, SSM, Secrets Manager
+                    - AddPermission
+                    - CreateFunction
+                    - UpdateFunctionCode
+                    - CreateEventSourceMapping
+                    - SendCommand
+                    - StartSession
+                    - PutParameter
+                    - DeleteParameter
+                    - DeleteSecret
+                    - PutResourcePolicy
+                    # KMS
+                    - ScheduleKeyDeletion
+                    - DisableKey
+                    - DisableKeyRotation
+                    - PutKeyPolicy
+                    - DeleteAlias
+                    - CancelKeyDeletion
+              State: ENABLED
+              Targets:
+                - Id: ApiDestinationTarget
+                  Arn: !GetAtt SecurityApiDestination.Arn
+                  RoleArn: !GetAtt EventBridgeApiDestinationRole.Arn
+
+          AuditAndTamperingSecurityRule:
+            Type: AWS::Events::Rule
+            DependsOn: SecurityApiDestination
+            Properties:
+              Tags:
+                - Key: Project
+                  Value: MeyiConnect
+                - Key: Created_for
+                  Value: L1 Security
+                - Key: aws-apn-id
+                  Value: pc:eyl8vo7kcwv8k9qctzbathhiq
+              Name: !Sub "\${ParentStackName}-AuditRule"
+              Description: CloudTrail, GuardDuty, Security Hub, and Config auditing or tampering events
+              EventPattern:
+                source:
+                  - aws.cloudtrail
+                  - aws.securityhub
+                  - aws.guardduty
+                  - aws.config
+                detail-type:
+                  - AWS API Call via CloudTrail
+                detail:
+                  eventSource:
+                    - cloudtrail.amazonaws.com
+                    - securityhub.amazonaws.com
+                    - guardduty.amazonaws.com
+                    - config.amazonaws.com
+                  eventName:
+                    # CloudTrail
+                    - CreateTrail
+                    - UpdateTrail
+                    - DeleteTrail
+                    - StartLogging
+                    - StopLogging
+                    - PutEventSelectors
+                    - DeleteEventDataStore
+                    # Security Services Tampering
+                    - BatchDisableStandards
+                    - DeleteMembers
+                    - DisassociateMembers
+                    - DeleteDetector
+                    - UpdateDetector
+                    - CreateFilter
+                    - StopMonitoringMembers
+                    - DisableSecurityHub
+                    - StopConfigurationRecorder
+                    - DeleteConfigurationRecorder
+                    - DeleteDeliveryChannel
+              State: ENABLED
+              Targets:
+                - Id: ApiDestinationTarget
+                  Arn: !GetAtt SecurityApiDestination.Arn
+                  RoleArn: !GetAtt EventBridgeApiDestinationRole.Arn
+
+          ControlTowerManagedRule:
+            Type: AWS::Events::Rule
+            DependsOn: SecurityApiDestination
+            Properties:
+              Tags:
+                - Key: Project
+                  Value: MeyiConnect
+                - Key: Created_for
+                  Value: L1 Security
+                - Key: aws-apn-id
+                  Value: pc:eyl8vo7kcwv8k9qctzbathhiq
+              Name: !Sub "\${ParentStackName}-CtrlTowerRule"
+              Description: Security Hub findings imported by AWS Control Tower
+              EventPattern:
+                source:
+                  - aws.securityhub
+                detail-type:
+                  - Security Hub Findings - Imported
+                detail:
+                  findings:
+                    Compliance:
+                      AssociatedStandards:
+                        StandardsId:
+                          - prefix: standards/service-managed-aws-control-tower
+              State: ENABLED
+              Targets:
+                - Id: ApiDestinationTarget
+                  Arn: !GetAtt SecurityApiDestination.Arn
+                  RoleArn: !GetAtt EventBridgeApiDestinationRole.Arn
+
+        Outputs:
+          CloudTrailMode:
+            Description: CloudTrail deployment mode
+            Value: !If
+              - CreateNewTrail
+              - Created new CloudTrail
+              - Reusing existing CloudTrail
+
+          CloudTrailBucket:
+            Description: S3 Bucket used for CloudTrail
+            Value: !If
+              - CreateNewTrail
+              - !Ref CloudTrailS3Bucket
+              - N/A - reusing existing CloudTrail
+      PermissionModel: !If [ IsServiceManaged, 'SERVICE_MANAGED', 'SELF_MANAGED' ]
+      AdministrationRoleARN: !If
+        - IsSelfManaged
+        - !If
+          - ShouldCreateRoles
+          - !GetAtt StackSetAdministrationRole.Arn
+          - !Sub "arn:aws:iam::\${AWS::AccountId}:role/AWSCloudFormationStackSetAdministrationRole"
+        - !Ref "AWS::NoValue"
+      ExecutionRoleName: !If [ IsSelfManaged, 'AWSCloudFormationStackSetExecutionRole', !Ref "AWS::NoValue" ]
+      AutoDeployment: !If
+        - IsServiceManaged
+        - Enabled: true
+          RetainStacksOnAccountRemoval: false
+        - !Ref "AWS::NoValue"
+      Parameters:
+        - ParameterKey: ParentStackName
+          ParameterValue: !Ref "AWS::StackName"
+        - ParameterKey: WebhookUrl
+          ParameterValue: !Ref WebhookUrl
+        - ParameterKey: WebhookAuthToken
+          ParameterValue: !Ref WebhookAuthToken
+        - ParameterKey: CreateCloudTrail
+          ParameterValue: !Ref CreateCloudTrail
+        - ParameterKey: PrimaryRegion
+          ParameterValue: !Ref PrimaryRegion
+      StackInstancesGroup: !If
+        - ShouldCreateStackInstances
+        - - DeploymentTargets:
+              OrganizationalUnitIds: !If [ HasTargetOUs, !Ref TargetOUs, !Ref "AWS::NoValue" ]
+              Accounts: !If 
+                - IsSelfManaged
+                - - !Ref AWS::AccountId
+                - !If [ HasTargetAccounts, !Ref TargetAccounts, !Ref "AWS::NoValue" ]
+              AccountFilterType: !If [ IsServiceManaged, !If [ HasTargetAccounts, INTERSECTION, !Ref "AWS::NoValue" ], !Ref "AWS::NoValue" ]
+            Regions: !Ref TargetRegions
+        - !Ref "AWS::NoValue"
+      OperationPreferences:
+        MaxConcurrentPercentage: 50
+        FailureToleranceCount: 1
+        RegionConcurrencyType: PARALLEL
+      Capabilities:
+        - CAPABILITY_NAMED_IAM
+      Tags:
+        - Key: Project
+          Value: MeyiConnectSecurityMonitoring
+        - Key: Created_for
+          Value: L1 Security
+        - Key: aws-apn-id
+          Value: pc:eyl8vo7kcwv8k9qctzbathhiq
+
+  GlobalSecurityMonitoringStackSet:
+    Type: AWS::CloudFormation::StackSet
+    DependsOn:
+      - StackSetApiDestination
+      - StackSetOperationRule
+    Properties:
+      StackSetName: !Sub "\${AWS::StackName}-SecurityMonitoring-Global"
+      Description: !Sub "\${AWS::StackName} Global Security Monitoring (us-east-1 only)"
+      TemplateBody: |
+        AWSTemplateFormatVersion: '2010-09-09'
+        Description: |
+          Meyi Connect Security Monitoring - Global Events Stack (us-east-1). Fully independent of
+          the regional Central Stack. Captures IAM, Root Login, Console Login Failure, and AWS Health
+          events (all global services that only fire in us-east-1) and delivers them directly to the
+          Meyi Connect webhook via EventBridge API Destinations (Serverless / Raw Event Payload). No cross-region forwarding,
+          no shared resources with any other stack.
+
+        Parameters:
+          ParentStackName:
+            Type: String
+            Default: "MeyiConnect"
+            Description: Parent stack name prefix used for naming resources.
+
+          WebhookUrl:
+            Type: String
+            Description: MeyiConnect webhook URL for global security alerts.
+
+          WebhookAuthToken:
+            Type: String
+            NoEcho: true
+            Default: '28e3b2faf28d48f28ef74759f8a40fefbd4be6ccce2544f1aeb63ddcbdebe8d4'
+            Description: MeyiConnect Webhook Authorization Token.
+
+          CreateCloudTrail:
+            Type: String
+            Default: 'false'
+            Description: Dummy parameter for compatibility with meyi-security-monitoring.yaml.
+
+          PrimaryRegion:
+            Type: String
+            Default: 'us-east-1'
+            Description: Dummy parameter for compatibility with meyi-security-monitoring.yaml.
+
+        Resources:
+
+          # ============================================================
+          # EVENTBRIDGE API DESTINATION & CONNECTION
+          # ============================================================
+
+          GlobalSecurityApiConnection:
+            Type: AWS::Events::Connection
+            Properties:
+              Name: !Sub "\${ParentStackName}-GlApiConn-\${AWS::Region}"
+              Description: API Connection for MeyiConnect Global Security alerts with Bearer Token auth
+              AuthorizationType: API_KEY
+              AuthParameters:
+                ApiKeyAuthParameters:
+                  ApiKeyName: Authorization
+                  ApiKeyValue: !Sub "Bearer \${WebhookAuthToken}"
+
+          GlobalSecurityApiDestination:
+            Type: AWS::Events::ApiDestination
+            Properties:
+              Name: !Sub "\${ParentStackName}-GlApiDest-\${AWS::Region}"
+              Description: API Destination for MeyiConnect Global Security alerts
+              ConnectionArn: !GetAtt GlobalSecurityApiConnection.Arn
+              InvocationEndpoint: !Ref WebhookUrl
+              HttpMethod: POST
+              InvocationRateLimitPerSecond: 100
+
+          EventBridgeApiDestinationRole:
+            Type: AWS::IAM::Role
+            Properties:
+              RoleName: !Sub "\${ParentStackName}-GlEbRole-\${AWS::Region}"
+              AssumeRolePolicyDocument:
+                Version: '2012-10-17'
+                Statement:
+                  - Effect: Allow
+                    Principal:
+                      Service: events.amazonaws.com
+                    Action: sts:AssumeRole
+              Policies:
+                - PolicyName: InvokeApiDestinationPolicy
+                  PolicyDocument:
+                    Version: '2012-10-17'
+                    Statement:
+                      - Effect: Allow
+                        Action:
+                          - events:InvokeApiDestination
+                        Resource: !GetAtt GlobalSecurityApiDestination.Arn
+              Tags:
+                - Key: Project
+                  Value: MeyiConnect
+                - Key: Created_for
+                  Value: L1 Security
+                - Key: aws-apn-id
+                  Value: pc:eyl8vo7kcwv8k9qctzbathhiq
+
+          # ============================================================
+          # EVENTBRIDGE RULES - GLOBAL EVENTS
+          # ============================================================
+
+          IAMAndOrganizationsSecurityEventsRule:
+            Type: AWS::Events::Rule
+            DependsOn: GlobalSecurityApiDestination
+            Properties:
+              Tags:
+                - Key: Project
+                  Value: MeyiConnect
+                - Key: Created_for
+                  Value: L1 Security
+                - Key: aws-apn-id
+                  Value: pc:eyl8vo7kcwv8k9qctzbathhiq
+              Name: !Sub "\${ParentStackName}-GlobalIAMRule"
+              Description: IAM and Organizations security configuration changes
+              EventPattern:
+                source:
+                  - aws.iam
+                  - aws.organizations
+                detail-type:
+                  - AWS API Call via CloudTrail
+                detail:
+                  eventName:
+                    # IAM events
+                    - CreateUser
+                    - DeleteUser
+                    - CreateAccessKey
+                    - UpdateAccessKey
+                    - DeleteAccessKey
+                    - AttachRolePolicy
+                    - DetachRolePolicy
+                    - PutUserPolicy
+                    - PutRolePolicy
+                    - UpdateAssumeRolePolicy
+                    - DeactivateMFADevice
+                    - CreateLoginProfile
+                    - UpdateLoginProfile
+                    - DeleteLoginProfile
+                    - CreateAccountAlias
+                    - DeleteAccountAlias
+                    - UpdateAccountPasswordPolicy
+                    - DeleteAccountPasswordPolicy
+                    - DeleteGroupPolicy
+                    - PutGroupPolicy
+                    - CreatePolicy
+                    - DeletePolicy
+                    - CreatePolicyVersion
+                    - DeletePolicyVersion
+                    - AttachUserPolicy
+                    - DetachUserPolicy
+                    - AttachGroupPolicy
+                    - DetachGroupPolicy
+                    - CreateRole
+                    - DeleteRole
+                    - CreateSAMLProvider
+                    - UpdateSAMLProvider
+                    - CreateOpenIDConnectProvider
+                    - UpdateOpenIDConnectProvider
+                    - CreateServiceSpecificCredential
+                    # Organizations events
+                    - LeaveOrganization
+                    - RemoveAccountFromOrganization
+                    - DeletePolicy
+                    - DetachPolicy
+                    - DisablePolicyType
+                    - UpdatePolicy
+                    - CreateAccount
+                    - InviteAccountToOrganization
+              State: ENABLED
+              Targets:
+                - Id: ApiDestinationTarget
+                  Arn: !GetAtt GlobalSecurityApiDestination.Arn
+                  RoleArn: !GetAtt EventBridgeApiDestinationRole.Arn
+
+          ConsoleLoginRule:
+            Type: AWS::Events::Rule
+            DependsOn: GlobalSecurityApiDestination
+            Properties:
+              Tags:
+                - Key: Project
+                  Value: MeyiConnect
+                - Key: Created_for
+                  Value: L1 Security
+                - Key: aws-apn-id
+                  Value: pc:eyl8vo7kcwv8k9qctzbathhiq
+              Name: !Sub "\${ParentStackName}-GlobalLoginRule"
+              Description: Root login and failed console logins
+              EventPattern:
+                detail-type:
+                  - AWS Console Sign In via CloudTrail
+                detail:
+                  eventName:
+                    - ConsoleLogin
+                  \$or:
+                    - userIdentity:
+                        type:
+                          - Root
+                      responseElements:
+                        ConsoleLogin:
+                          - Success
+                    - responseElements:
+                        ConsoleLogin:
+                          - Failure
+              State: ENABLED
+              Targets:
+                - Id: ApiDestinationTarget
+                  Arn: !GetAtt GlobalSecurityApiDestination.Arn
+                  RoleArn: !GetAtt EventBridgeApiDestinationRole.Arn
+
+          HealthEventsRule:
+            Type: AWS::Events::Rule
+            DependsOn: GlobalSecurityApiDestination
+            Properties:
+              Tags:
+                - Key: Project
+                  Value: MeyiConnect
+                - Key: Created_for
+                  Value: L1 Security
+                - Key: aws-apn-id
+                  Value: pc:eyl8vo7kcwv8k9qctzbathhiq
+              Name: !Sub "\${ParentStackName}-GlobalHealthRule"
+              Description: AWS Health notifications
+              EventPattern:
+                source:
+                  - aws.health
+                detail-type:
+                  - AWS Health Event
+              State: ENABLED
+              Targets:
+                - Id: ApiDestinationTarget
+                  Arn: !GetAtt GlobalSecurityApiDestination.Arn
+                  RoleArn: !GetAtt EventBridgeApiDestinationRole.Arn
+
+          RootAPICallsRule:
+            Type: AWS::Events::Rule
+            DependsOn: GlobalSecurityApiDestination
+            Properties:
+              Tags:
+                - Key: Project
+                  Value: MeyiConnect
+                - Key: Created_for
+                  Value: L1 Security
+                - Key: aws-apn-id
+                  Value: pc:eyl8vo7kcwv8k9qctzbathhiq
+              Name: !Sub "\${ParentStackName}-GlobalRootRule"
+              Description: Capture any API call made by the Root user account in us-east-1
+              EventPattern:
+                detail-type:
+                  - AWS API Call via CloudTrail
+                detail:
+                  userIdentity:
+                    type:
+                      - Root
+              State: ENABLED
+              Targets:
+                - Id: ApiDestinationTarget
+                  Arn: !GetAtt GlobalSecurityApiDestination.Arn
+                  RoleArn: !GetAtt EventBridgeApiDestinationRole.Arn
+
+        Outputs:
+          GlobalSecurityApiConnectionArn:
+            Description: Global security alerts EventBridge Connection ARN
+            Value: !GetAtt GlobalSecurityApiConnection.Arn
+
+          GlobalSecurityApiDestinationArn:
+            Description: Global security alerts EventBridge API Destination ARN
+            Value: !GetAtt GlobalSecurityApiDestination.Arn
+      PermissionModel: !If [ IsServiceManaged, 'SERVICE_MANAGED', 'SELF_MANAGED' ]
+      AdministrationRoleARN: !If
+        - IsSelfManaged
+        - !If
+          - ShouldCreateRoles
+          - !GetAtt StackSetAdministrationRole.Arn
+          - !Sub "arn:aws:iam::\${AWS::AccountId}:role/AWSCloudFormationStackSetAdministrationRole"
+        - !Ref "AWS::NoValue"
+      ExecutionRoleName: !If [ IsSelfManaged, 'AWSCloudFormationStackSetExecutionRole', !Ref "AWS::NoValue" ]
+      AutoDeployment: !If
+        - IsServiceManaged
+        - Enabled: true
+          RetainStacksOnAccountRemoval: false
+        - !Ref "AWS::NoValue"
+      Parameters:
+        - ParameterKey: ParentStackName
+          ParameterValue: !Ref "AWS::StackName"
+        - ParameterKey: WebhookUrl
+          ParameterValue: !Ref WebhookUrl
+        - ParameterKey: WebhookAuthToken
+          ParameterValue: !Ref WebhookAuthToken
+        - ParameterKey: CreateCloudTrail
+          ParameterValue: !Ref CreateCloudTrail
+        - ParameterKey: PrimaryRegion
+          ParameterValue: !Ref PrimaryRegion
+      StackInstancesGroup: !If
+        - ShouldCreateStackInstances
+        - - DeploymentTargets:
+              OrganizationalUnitIds: !If [ HasTargetOUs, !Ref TargetOUs, !Ref "AWS::NoValue" ]
+              Accounts: !If 
+                - IsSelfManaged
+                - - !Ref AWS::AccountId
+                - !If [ HasTargetAccounts, !Ref TargetAccounts, !Ref "AWS::NoValue" ]
+              AccountFilterType: !If [ IsServiceManaged, !If [ HasTargetAccounts, INTERSECTION, !Ref "AWS::NoValue" ], !Ref "AWS::NoValue" ]
+            Regions:
+              - us-east-1
+        - !Ref "AWS::NoValue"
+      OperationPreferences:
+        MaxConcurrentPercentage: 50
+        FailureToleranceCount: 1
+        RegionConcurrencyType: PARALLEL
+      Capabilities:
+        - CAPABILITY_NAMED_IAM
+      Tags:
+        - Key: Project
+          Value: MeyiConnectSecurityMonitoring
+        - Key: Created_for
+          Value: L1 Security
+        - Key: aws-apn-id
+          Value: pc:eyl8vo7kcwv8k9qctzbathhiq
+
+  # ============================================================
+  # EVENTBRIDGE API DESTINATION & CONNECTION (PARENT STACKSET STATUS)
+  # ============================================================
+
+  StackSetApiConnection:
+    Type: AWS::Events::Connection
+    Properties:
+      Name: !Sub "\${AWS::StackName}-SsApiConn-\${AWS::Region}"
+      Description: API Connection for MeyiConnect StackSet status notifications
+      AuthorizationType: API_KEY
+      AuthParameters:
+        ApiKeyAuthParameters:
+          ApiKeyName: Authorization
+          ApiKeyValue: !Sub "Bearer \${WebhookAuthToken}"
+
+  StackSetApiDestination:
+    Type: AWS::Events::ApiDestination
+    Properties:
+      Name: !Sub "\${AWS::StackName}-SsApiDest-\${AWS::Region}"
+      Description: API Destination for StackSet status notification webhooks
+      ConnectionArn: !GetAtt StackSetApiConnection.Arn
+      InvocationEndpoint: !Ref BackendUrl
+      HttpMethod: POST
+      InvocationRateLimitPerSecond: 100
+
+  EventBridgeApiDestinationRole:
+    Type: AWS::IAM::Role
+    Properties:
+      RoleName: !Sub "\${AWS::StackName}-SsEbRole-\${AWS::Region}"
+      AssumeRolePolicyDocument:
+        Version: '2012-10-17'
+        Statement:
+          - Effect: Allow
+            Principal:
+              Service: events.amazonaws.com
+            Action: sts:AssumeRole
+      Policies:
+        - PolicyName: InvokeApiDestinationPolicy
+          PolicyDocument:
+            Version: '2012-10-17'
+            Statement:
+              - Effect: Allow
+                Action:
+                  - events:InvokeApiDestination
+                Resource: !GetAtt StackSetApiDestination.Arn
+      Tags:
+        - Key: Project
+          Value: MeyiConnect
+        - Key: Created_for
+          Value: L1 Security
+        - Key: aws-apn-id
+          Value: pc:eyl8vo7kcwv8k9qctzbathhiq
+
+  # ============================================================
+  # EVENTBRIDGE RULE (PARENTS STACKSET STATUS)
+  # Forwards native raw StackSet & StackInstance status change events
+  # ============================================================
+
+  StackSetOperationRule:
+    Type: AWS::Events::Rule
+    Properties:
+      Name: !Sub "\${AWS::StackName}-SsNotifier"
+      Description: !Sub Triggers API Destination when StackSet operations occur for customer.
+      EventPattern:
+        source:
+          - aws.cloudformation
+        \$or:
+          - detail-type:
+              - CloudFormation StackSet Status Change
+            detail:
+              stack-set-arn:
+                - prefix: !Sub "arn:aws:cloudformation:\${AWS::Region}:\${AWS::AccountId}:stackset/\${AWS::StackName}-SecurityMonitoring"
+          - detail-type:
+              - CloudFormation StackSet StackInstance Status Change
+            detail:
+              stack-set-arn:
+                - prefix: !Sub "arn:aws:cloudformation:\${AWS::Region}:\${AWS::AccountId}:stackset/\${AWS::StackName}-SecurityMonitoring"
+              status-details:
+                detailed-status:
+                  - SUCCEEDED
+                  - FAILED
+                  - CANCELLED
+      State: ENABLED
+      Targets:
+        - Id: MeyiConnectNotifierTarget
+          Arn: !GetAtt StackSetApiDestination.Arn
+          RoleArn: !GetAtt EventBridgeApiDestinationRole.Arn
+
+# ============================================================
+# OUTPUTS
+# ============================================================
+
+Outputs:
+
+  StackSetName:
+    Description: Name of the deployed StackSet
+    Value: !Ref SecurityMonitoringStackSet
+
+  StackSetApiConnectionArn:
+    Description: EventBridge Connection ARN for StackSet notifications
+    Value: !GetAtt StackSetApiConnection.Arn
+
+  StackSetApiDestinationArn:
+    Description: EventBridge API Destination ARN for StackSet notifications
+    Value: !GetAtt StackSetApiDestination.Arn
+
+  EventBridgeRuleName:
+    Description: EventBridge rule monitoring StackSet operations
+    Value: !Ref StackSetOperationRule
+
+  DeploymentSummary:
+    Description: Deployment summary
+    Value: !Sub |
+      StackSet:    \${AWS::StackName}-SecurityMonitoring
+      Backend:     \${BackendUrl}
+
+`;
+export function buildCloudTrailCentralStackTemplate(input) {
+    const mode = input.deploymentMode ?? 'Standalone';
+    const createIAMRoles = mode === 'Standalone' ? 'true' : 'false';
+    const targetOUs = input.targetOUs ?? '';
+    const targetAccounts = input.targetAccounts ?? '';
+    const resolvedRegions = (input.targetRegions ?? '').trim() || ALL_AWS_ACTIVE_REGIONS;
+    const primaryRegion = resolvedRegions.split(',')[0].trim() || 'us-east-1';
+    const createCloudTrailDefault = input.createCloudTrail ? "true" : "false";
+    return CENTRAL_STACK_YAML
+        .replace(/__MEYI_WEBHOOK_URL__/g, input.webhookUrl)
+        .replace(/__MEYI_WEBHOOK_AUTH_TOKEN__/g, input.webhookAuthToken || '')
+        .replace(/__MEYI_DEPLOYMENT_STATUS_URL__/g, input.deploymentStatusUrl)
+        .replace(/__MEYI_CREATE_CLOUDTRAIL_DEFAULT__/g, createCloudTrailDefault)
+        .replace(/__MEYI_DEPLOYMENT_MODE__/g, mode)
+        .replace(/__MEYI_CREATE_IAM_ROLES__/g, createIAMRoles)
+        .replace(/__MEYI_TARGET_OUS_DEFAULT__/g, targetOUs ? `    Default: "${targetOUs}"` : "")
+        .replace(/__MEYI_TARGET_ACCOUNTS_DEFAULT__/g, targetAccounts ? `    Default: "${targetAccounts}"` : "")
+        .replace(/__MEYI_TARGET_REGIONS__/g, resolvedRegions)
+        .replace(/__MEYI_PRIMARY_REGION__/g, primaryRegion);
+}
+//# sourceMappingURL=template.js.map