A Terraform module that sends notifications when users perform actions in the AWS Console to improve security and compliance.
AWS ClickOps Notifier is a Terraform module that detects and alerts on manual actions performed in the AWS Management Console. It solves the problem of unmonitored manual interventions in cloud infrastructure, which can lead to security gaps, configuration drift, and compliance violations. By analyzing CloudTrail logs, it identifies console-originated API calls and sends notifications to relevant teams.
Cloud security engineers, DevOps teams, and platform engineers managing AWS environments who need to enforce infrastructure-as-code practices and maintain audit trails. It's particularly useful for organizations using AWS Control Tower or centralized logging.
Developers choose this module because it provides a ready-made, configurable solution for ClickOps monitoring without building custom tooling. Its integration with Terraform and support for both organizational and standalone deployments offer flexibility, while pre-built filters for common actions reduce alert fatigue.
Get notified when actions are taken in the AWS Console.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Specifically identifies API calls originating from the AWS Management Console versus automated tools by analyzing CloudTrail logs, ensuring precise monitoring of manual interventions.
Supports both organizational-wide monitoring with AWS ControlTower and standalone account deployments, adapting to different AWS infrastructure setups without code changes.
Sends alerts via SNS with built-in support for Slack and Microsoft Teams webhooks, allowing seamless integration into existing communication workflows without additional scripting.
Enables exclusion or inclusion of specific AWS accounts, users, and API actions through Terraform variables, reducing alert noise and focusing on relevant security events.
The README admits the module has only been tested in AWS ControlTower Log Archive accounts, which can complicate deployments in non-ControlTower environments and limit compatibility.
Requires pre-configuring CloudTrail to write logs to CloudWatch or S3, along with IAM role creation and permissions, making deployment non-trivial for teams without deep AWS expertise.
The built-in list of excluded scoped actions is hardcoded and might not cover all benign console actions, necessitating manual customization via variables to avoid false positives.
Events are batched with configurable windows up to 300 seconds and processed through SQS and Lambda, which can delay notifications for time-sensitive security incidents.