Policy Setting: AWS > Turbot > Audit Trail > CloudTrail > Trail > Event Selectors

resource "turbot_policy_setting" "aws_trail_event_selectors" {
  resource = turbot_policy_pack.main.id
  type     = "tmod:@turbot/aws#/policy/types/trailEventSelectors"
  note     = "AWS CIS v3.0.0 - Controls: 3.1 & 3.8 & 3.9"
  value    = <<-EOT
    event_selector {
      read_write_type           = "All"
      include_management_events = true
      data_resource {
        type   = "AWS::S3::Object"
        values = ["arn:aws:s3"]
      }
    }
  EOT
}