cwe-ecs-rule.json

{
  "detail-type": [
    "AWS API Call via CloudTrail"
  ],
  "detail": {
    "eventSource": [
      "ecs.amazonaws.com"
    ],
    "eventName": [
      "CreateService",
      "DeleteService"
    ]
  }
}