From 3af301d3dae2788bfc4d6d3a25396ded0d61fed7 Mon Sep 17 00:00:00 2001
From: Rene Benner <rene@fortytwo.nl>
Date: Thu, 27 Jul 2023 15:05:01 +0200
Subject: [PATCH] Update main.tf

---
 modules/alarm-baseline/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/alarm-baseline/main.tf b/modules/alarm-baseline/main.tf
index 2d12e970..a6f6b6da 100644
--- a/modules/alarm-baseline/main.tf
+++ b/modules/alarm-baseline/main.tf
@@ -43,7 +43,7 @@ resource "aws_cloudwatch_log_metric_filter" "unauthorized_api_calls" {
   count = var.unauthorized_api_calls_enabled ? 1 : 0
 
   name           = "UnauthorizedAPICalls"
-  pattern        = "{(($.errorCode = \"*UnauthorizedOperation\") || ($.errorCode = \"AccessDenied*\")) && (($.sourceIPAddress!=\"delivery.logs.amazonaws.com\") && ($.eventName!=\"HeadBucket\"))}"
+  pattern        = "{(($.errorCode = \"*UnauthorizedOperation\") || ($.errorCode = \"AccessDenied*\"))}"
   log_group_name = var.cloudtrail_log_group_name
 
   metric_transformation {