Stream signed Decionis Decision Dossiers into AWS Security Hub (as ASFF findings) and CloudWatch Logs — continuous, audit-ready compliance evidence in the customer's own security stack (docs/brief/decionis.aws.md Feature 4). This is the net-new streaming sink: the dossier/ledger already exist; only batch export did before.

Every governed decision becomes a finding whose severity and compliance status derive from the outcome — a REJECT is a HIGH/FAILED finding, an APPROVE is INFORMATIONAL/PASSED — each carrying the dossier id, policy version, dossier_sha256, ledger hash, and a verification URL.

Usage (Lambda)

import { createHandlerFromEnv } from "@decionis/aws-securityhub";

// Reads AWS_REGION + DECIONIS_CLOUDWATCH_LOG_GROUP + (optional) Security Hub config.
export const handler = createHandlerFromEnv();

Or inject sinks directly (e.g. to add only one):

import { createDossierStreamHandler, AwsSecurityHubSink } from "@decionis/aws-securityhub";

export const handler = createDossierStreamHandler({
  securityHub: new AwsSecurityHubSink({ region: "us-east-1" }),
});

The handler accepts the shapes Decionis delivery can emit — a raw array, a single event, an SNS envelope (Records[].Sns.Message), or an EventBridge detail.

Input contract

The producer (Decionis-hosted decision graph) emits a DecisionDossierEvent per decision: dossier_id, org_id, decision_type, outcome, confidence?, policy_version?, dossier_sha256?, ledger_entry_hash?, evaluation_id?, occurred_at, verify_url?, aws_account_id, aws_region. Missing aws_account_id / aws_region are filled from env (DECIONIS_AWS_ACCOUNT_ID / AWS_REGION).

Environment (customer stack)

Var	Required	Meaning
`AWS_REGION`	✓	Region for findings + ProductArn
`DECIONIS_CLOUDWATCH_LOG_GROUP`		Enable CloudWatch streaming when set
`DECIONIS_CLOUDWATCH_LOG_STREAM`		Default `decionis-decision-dossiers`
`DECIONIS_SECURITYHUB_ENABLED`		`false` to skip Security Hub
`DECIONIS_SECURITYHUB_PRODUCT_ARN`		Explicit ASFF ProductArn (else own-account default)
`DECIONIS_AWS_ACCOUNT_ID`		Fallback account id for events that omit it

Producer hook (Decionis side — follow-up)

Decionis emits these events through the existing integration-delivery framework to the customer's SNS topic / HTTPS endpoint. Wiring a dedicated AWS_SECURITY_HUB delivery channel in apps/api is the remaining producer-side task; this package is the complete consumer.