fix: Disable duplicate management events for Lambda & S3 Cloudtrail event selectors

[rjbaker]

Issue #, if available: #449

Description of changes:

Prevents duplicate management event selectors being created in the organisation Cloud Trail when Lambda & S3 event selectors are enabled via the global logging config.

Resulting CloudTrail event selector configuration:

aws cloudtrail get-event-selectors --trail-name AWSAccelerator-Organizations-CloudTrail
{
    "TrailARN": "arn:aws:cloudtrail:eu-west-2:account-id:trail/AWSAccelerator-Organizations-CloudTrail",
    "EventSelectors": [
        {
            "ReadWriteType": "All",
            "IncludeManagementEvents": false,
            "DataResources": [
                {
                    "Type": "AWS::Lambda::Function",
                    "Values": [
                        "arn:aws:lambda"
                    ]
                }
            ],
            "ExcludeManagementEventSources": []
        },
        {
            "ReadWriteType": "All",
            "IncludeManagementEvents": false,
            "DataResources": [
                {
                    "Type": "AWS::S3::Object",
                    "Values": [
                        "arn:aws:s3:::"
                    ]
                }
            ],
            "ExcludeManagementEventSources": []
        },
        {
            "ReadWriteType": "All",
            "IncludeManagementEvents": true,
            "DataResources": [],
            "ExcludeManagementEventSources": []
        }
    ]
}

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

[rjbaker]

Updated for compatibility with 1.8.0 release. Issue still persists as management events default to true in methods implementing AddEventSelectorOptions when no includeManagementEvents argument is supplied: https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_cloudtrail.AddEventSelectorOptions.html#includemanagementevents

[nagmesh]

Hi @rjbaker , thank you for your contribution to the Landing Zone Accelerator!

I'm pleased to say this work has been integrated into the code base and will be available shortly in the next release. I'll close this PR in the meantime and update the associated issue once that release is publicly available.

Thank you for your support of the LZA!

[mbevc1]

Good news 🎉 . @nagmesh is there a roadmap or any future release dates you're aiming for?

[richardkeit]

@mbevc1 - dare to say end of year

#320 (comment)

[mbevc1]

Thanks! 🤞

[mbevc1]

Would be nice if you could open a roadmap and move development to this repo at some point 😉