Send AWS Security Hub alerts to on-call with CallHeim.

# Security Hub findings reach CallHeim through an EventBridge rule you create in your own AWS account — nothing forwards them for you.
# EventBridge → API destinations → Connections → Create connection. Authorization type: API Key, with API key name X-Placeholder and any value. EventBridge requires one; CallHeim does not read it. Do not use Authorization or an X-CallHeim- / X-ItOnCall- header name, which CallHeim does read.
# EventBridge → API destinations → Create API destination: endpoint {{WEBHOOK_URL}}, HTTP method POST, using the connection you created above.
# EventBridge → Rules → Create rule on the default event bus, with this event pattern:
{"source":["aws.securityhub"],"detail-type":["Security Hub Findings - Imported"]}
# Target: EventBridge API destination → the API destination you created above. Keep the target input as "Matched events" — no input transformer — so CallHeim receives the event exactly as EventBridge emits it. Let the console create the rule's execution role (it needs events:InvokeApiDestination on the destination).
# Each finding in an event becomes its own alert. Security Hub sends a finding again whenever it changes; the update with workflow status RESOLVED, compliance status PASSED or record state ARCHIVED resolves that finding's incident.
# Do not filter the pattern on severity: a control finding drops to INFORMATIONAL when it passes, and a severity filter would drop the update that resolves it.
# EventBridge rules, connections and API destinations are regional: repeat the connection, API destination and rule in every region you want covered.