Send AWS Inspector alerts to on-call with CallHeim.

# Amazon Inspector findings reach CallHeim through an EventBridge rule you create in your own AWS account — nothing forwards them for you.
# EventBridge → API destinations → Connections → Create connection. Authorization type: API Key, with API key name X-Placeholder and any value. EventBridge requires one; CallHeim does not read it. Do not use Authorization or an X-CallHeim- / X-ItOnCall- header name, which CallHeim does read.
# EventBridge → API destinations → Create API destination: endpoint {{WEBHOOK_URL}}, HTTP method POST, using the connection you created above.
# EventBridge → Rules → Create rule on the default event bus, with this event pattern:
{"source":["aws.inspector2"],"detail-type":["Inspector2 Finding"],"detail":{"status":["ACTIVE","CLOSED"]}}
# Target: EventBridge API destination → the API destination you created above. Keep the target input as "Matched events" — no input transformer — so CallHeim receives the event exactly as EventBridge emits it. Let the console create the rule's execution role (it needs events:InvokeApiDestination on the destination).
# An ACTIVE finding opens an incident; the same finding sent again as CLOSED resolves it. SUPPRESSED is left out of the pattern because it would open an incident.
# EventBridge rules, connections and API destinations are regional: repeat the connection, API destination and rule in every region you want covered.