aws_cloudwatch_metric_alarm.root.tf

resource "aws_cloudwatch_metric_alarm" "root" {
  alarm_name          = "root_usage_alarm"
  comparison_operator = "GreaterThanOrEqualToThreshold"
  evaluation_periods  = 1
  metric_name         = "root_usage_metric"
  namespace           = "CISBenchmark"
  period              = 300
  statistic           = "Sum"
  threshold           = 1
  alarm_actions       = [aws_sns_topic.trail-unauthorised.arn]
}