Send AWS Macie alerts to on-call with CallHeim.

# Macie findings reach CallHeim through an EventBridge rule you create in your own AWS account — nothing forwards them for you.
# EventBridge → API destinations → Connections → Create connection. Authorization type: API Key, with API key name X-Placeholder and any value. EventBridge requires one; CallHeim does not read it. Do not use Authorization or an X-CallHeim- / X-ItOnCall- header name, which CallHeim does read.
# EventBridge → API destinations → Create API destination: endpoint {{WEBHOOK_URL}}, HTTP method POST, using the connection you created above.
# EventBridge → Rules → Create rule on the default event bus, with this event pattern:
{"source":["aws.macie"],"detail-type":["Macie Finding"]}
# Target: EventBridge API destination → the API destination you created above. Keep the target input as "Matched events" — no input transformer — so CallHeim receives the event exactly as EventBridge emits it. Let the console create the rule's execution role (it needs events:InvokeApiDestination on the destination).
# CallHeim reads no resolved state from a Macie finding, so these incidents do not auto-resolve: resolve them in CallHeim once the finding is dealt with.
# EventBridge rules, connections and API destinations are regional: repeat the connection, API destination and rule in every region you want covered.