This template creates an AWS Events Rule that notifies an Amazon Simple Notification Service (SNS) topic if an AWS CloudTrail log entry contains a call by the root user. The rule is configured with an event pattern that filters for CloudTrail log entries with a specific detail type and detail, and a target that specifies the SNS topic to notify.

CloudFormation Template