[IAM] How to Trigger Alarms When Creating or Deleting IAM Users

Create SNS Topic 

• To trigger alarms for IAM User creation/deletion, you must create the topic in us-east-1 as well (because IAM is a global resource). 

• Keep encryption, access policies, and other settings at their default values. 

Set SNS Subscription 

• Create a subscription with the protocol set to email. 

• A confirmation email will be sent to the specified email address, and once confirmed, the subscription is registered properly. 

Create Create/Delete IAM User Event Rule (performed in us-east-1) 

• Go to EventBridge > Events > Rules > Create Rule. 

  • Select Event Pattern > Use the predefined pattern provided by the service. 

  • Service Provider: AWS

  • Service Name: IAM

  • Event Type: AWS API Call via CloudTrail

  • Add specific actions: CreateUser, DeleteUser. 

• Connect the SNS topic as the target.