入力トランスフォーマーを使用して、 API コールの人が判読できる CloudWatch イベント通知を設定する方法を教えてください。

{
	"version": "0",
	"id": "41dff147-cfbc-492a-9a98-9dd00d082417",
	"detail-type": "AWS API Call via CloudTrail",
	"source": "aws.ec2",
	"account": "123456789012",
	"time": "2017-07-14T16:36:23Z",
	"region": "us-east-1",
	"resources": [],
	"detail": {
		"eventVersion": "1.05",
		"userIdentity": {
			"type": "Root",
			"principalId": "123456789012",
			"arn": "arn:aws:iam::123456789012:root",
			"accountId": "123456789012",
			"accessKeyId": "ASIAIRP4G1234567891Q",
			"userName": "iamuser",
			"sessionContext": {
				"attributes": {
					"mfaAuthenticated": "false",
					"creationDate": "2017-07-14T16:27:38Z"
				}
			}
		},
		"eventTime": "2017-07-14T16:36:23Z",
		"eventSource": "ec2.amazonaws.com",
		"eventName": "CreateSecurityGroup",
		"awsRegion": "us-east-1",
		"sourceIPAddress": "72.21.196.64",
		"userAgent": "console.ec2.amazonaws.com",
		"requestParameters": {
			"groupName": "test",
			"groupDescription": "test",
			"vpcId": "vpc-54a4232d"
		},
		"responseElements": {
			"_return": true,
			"groupId": "sg-82d531f3"
		},
		"requestID": "a4609e55-69ac-4a2d-8057-843dc8b4658b",
		"eventID": "7774b898-59c1-48a5-9c41-af1bcaa04612",
		"eventType": "AwsApiCall"
	}
}

{
  "source": [
    "aws.ec2"
  ],
  "detail-type": [
    "AWS API Call via CloudTrail"
  ],
  "detail": {
    "eventSource": [
      "ec2.amazonaws.com"
    ],
    "eventName": [
      "CreateSecurityGroup",
      "AuthorizeSecurityGroupEgress",
      "AuthorizeSecurityGroupIngress",
      "DeleteSecurityGroup",
      "RevokeSecurityGroupEgress",
      "RevokeSecurityGroupIngress",
      "DescribeStaleSecurityGroups",
      "DescribeSecurityGroups",
      "DescribeSecurityGroupReferences"
    ]
  }
}

{"sgname":"$.detail.requestParameters.groupName","sourceip":"$.detail.sourceIPAddress","vpcid":"$.detail.requestParameters.vpcId","action":"$.detail.eventName","sgid":"$.detail.responseElements.groupId","time":"$.detail.eventTime","region":"$.detail.awsRegion","user":"$.detail.userIdentity.userName","reqid":"$.detail.requestID"}

"User <user>  has executed API call <action> from source IP <sourceip> on security group <sgid>/<sgname> that belongs to vpc <vpcid> in region <region> at time(UTC) <time>. The Request ID is <reqid>."

"<type> <arn> has executed action API <action> on Security Group <sgid> located in AWS region <region> at <time> (UTC)."
"Event Details:"
"Request ID: <requestid>"
"Event ID: <eventid>"
"Event Source: <eventsource>"
"Event Type: <eventtype>"