AWSTemplateFormatVersion: "2010-09-09"
Description: "This template will create a rules-only detector for catching specific fraud cases."
Resources:
  # Outcomes
  InvestigateOutcome:
    Type: AWS::FraudDetector::Outcome
    Properties:
      Name: 'investigate'
  AllowOutcome:
    Type: AWS::FraudDetector::Outcome
    Properties:
      Name: 'automatically_allow'
  # Labels
  FraudLabel:
    Type: AWS::FraudDetector::Label
    Properties:
      Name: 'fraud'
  LegitLabel:
    Type: AWS::FraudDetector::Label
    Properties:
      Name: 'legit'
  # Variables
  EmailVariable:
    Type: AWS::FraudDetector::Variable
    Properties:
      Name: 'email_address'
      DataSource: 'EVENT'
      DataType: 'STRING'
      DefaultValue: 'DEFAULT'
      VariableType: 'EMAIL_ADDRESS'
  IpVariable:
    Type: AWS::FraudDetector::Variable
    Properties:
      Name: 'ip_address'
      DataSource: 'EVENT'
      DataType: 'STRING'
      DefaultValue: 'DEFAULT'
      VariableType: 'IP_ADDRESS'
  PriceVariable:
    Type: AWS::FraudDetector::Variable
    Properties:
      Name: 'price'
      DataSource: 'EVENT'
      DataType: 'FLOAT'
      DefaultValue: '0.0'
      VariableType: 'PRICE'
  # Entity Type
  GuestEntityType:
    Type: AWS::FraudDetector::EntityType
    Properties:
      Name: 'guest'
  # EventType
  GuestCheckoutEventType:
    DependsOn:
      - FraudLabel
      - LegitLabel
      - EmailVariable
      - IpVariable
      - PriceVariable
      - GuestEntityType
    Type: AWS::FraudDetector::EventType
    Properties:
      Name: 'guest_checkout_event'
      EventVariables:
        - Inline: false
          Name: 'email_address'
          Arn: !Ref EmailVariable
        - Inline: false
          Name: 'ip_address'
          Arn: !Ref IpVariable
        - Inline: false
          Name: 'price'
          Arn: !Ref PriceVariable
      Labels:
        - Inline: false
          Name: 'fraud'
          Arn: !Ref FraudLabel
        - Inline: false
          Name: 'legit'
          Arn: !Ref LegitLabel
      EntityTypes:
        - Inline: false
          Name: 'guest'
          Arn: !Ref GuestEntityType
  # Detector
  GuestCheckoutDetector:
    DependsOn:
      - InvestigateOutcome
      - AllowOutcome
      - GuestCheckoutEventType
    Type: AWS::FraudDetector::Detector
    Properties:
      DetectorId: 'guest_checkout_detector'
      DetectorVersionStatus: 'ACTIVE'
      RuleExecutionMode: 'ALL_MATCHED'
      Description: 'detector for guest checkout investigations based on ip, email, and price'
      EventType:
        Inline: false
        Name: 'guest_checkout_event'
        Arn: !Ref GuestCheckoutEventType
      Rules:
        - RuleId: 'investigate_specific_email'
          DetectorId: 'guest_checkout_detector'
          Expression: '$email_address == "specific@email.address"'
          Language: 'DETECTORPL'
          Outcomes:
            - Inline: false
              Name: 'investigate'
              Arn: !Ref InvestigateOutcome
        - RuleId: 'allow_specific_ip'
          DetectorId: 'guest_checkout_detector'
          Expression: '$ip_address == "fictional_ip_address_to_automatically_allow"'
          Language: 'DETECTORPL'
          Outcomes:
            - Inline: false
              Name: 'automatically_allow'
              Arn: !Ref AllowOutcome
        - RuleId: 'allow_low_price'
          DetectorId: 'guest_checkout_detector'
          Expression: '$price <= 100'
          Language: 'DETECTORPL'
          Outcomes:
            - Inline: false
              Name: 'automatically_allow'
              Arn: !Ref AllowOutcome
        - RuleId: 'investigate_high_price'
          DetectorId: 'guest_checkout_detector'
          Expression: '$price >= 10000'
          Language: 'DETECTORPL'
          Outcomes:
            - Inline: false
              Name: 'investigate'
              Arn: !Ref InvestigateOutcome
# Outputs
Outputs:
  InvestigateOutcomeArn:
    Value: !Ref InvestigateOutcome
    Export:
      Name: 'InvestigateOutcomeArn'
  AllowOutcomeArn:
    Value: !Ref AllowOutcome
    Export:
      Name: 'AllowOutcomeArn'
  FraudLabelArn:
    Value: !Ref FraudLabel
    Export:
      Name: 'FraudLabelArn'
  LegitLabelArn:
    Value: !Ref LegitLabel
    Export:
      Name: 'LegitLabelArn'
  EmailVariableArn:
    Value: !Ref EmailVariable
    Export:
      Name: 'EmailVariableArn'
  IpVariableArn:
    Value: !Ref IpVariable
    Export:
      Name: 'IpVariableArn'
  PriceVariableArn:
    Value: !Ref PriceVariable
    Export:
      Name: 'PriceVariableArn'
  GuestEntityTypeArn:
    Value: !Ref GuestEntityType
    Export:
      Name: 'GuestEntityTypeArn'
  GuestCheckoutEventTypeArn:
    Value: !Ref GuestCheckoutEventType
    Export:
      Name: 'GuestCheckoutEventTypeArn'
  GuestCheckoutDetectorArn:
    Value: !Ref GuestCheckoutDetector
    Export:
      Name: 'GuestCheckoutDetectorArn'

The following is the code for example_detector_template_update_yaml:

AWSTemplateFormatVersion: "2010-09-09"
Description: "This template will create a rules-only detector for catching specific fraud cases."
Resources:
  # Outcomes
  InvestigateOutcome:
    Type: AWS::FraudDetector::Outcome
    Properties:
      Description: 'investigate this event'
      Name: 'investigate'
  AllowOutcome:
    Type: AWS::FraudDetector::Outcome
    Properties:
      Description: 'automatically allow this event'
      Name: 'automatically_allow'
  # Labels
  FraudLabel:
    Type: AWS::FraudDetector::Label
    Properties:
      Name: 'fraud'
  LegitLabel:
    Type: AWS::FraudDetector::Label
    Properties:
      Name: 'legit'
  # Variables
  EmailVariable:
    Type: AWS::FraudDetector::Variable
    Properties:
      Name: 'email_address'
      DataSource: 'EVENT'
      DataType: 'STRING'
      DefaultValue: 'DEFAULT'
      VariableType: 'EMAIL_ADDRESS'
  IpVariable:
    Type: AWS::FraudDetector::Variable
    Properties:
      Name: 'ip_address'
      DataSource: 'EVENT'
      DataType: 'STRING'
      DefaultValue: 'DEFAULT'
      VariableType: 'IP_ADDRESS'
  PriceVariable:
    Type: AWS::FraudDetector::Variable
    Properties:
      Name: 'price'
      DataSource: 'EVENT'
      DataType: 'FLOAT'
      DefaultValue: '0.0'
      VariableType: 'PRICE'
  PhoneNumberVariable:
    Type: AWS::FraudDetector::Variable
    Properties:
      Name: 'phone_number'
      DataSource: 'EVENT'
      DataType: 'STRING'
      DefaultValue: ' '
      VariableType: 'PHONE_NUMBER'
  # Entity Type
  GuestEntityType:
    Type: AWS::FraudDetector::EntityType
    Properties:
      Name: 'guest'
  # EventType
  GuestCheckoutEventType:
    DependsOn:
      - FraudLabel
      - LegitLabel
      - EmailVariable
      - IpVariable
      - PriceVariable
      - PhoneNumberVariable
      - GuestEntityType
    Type: AWS::FraudDetector::EventType
    Properties:
      Name: 'guest_checkout_event'
      EventVariables:
        - Inline: false
          Name: 'email_address'
          Arn: !Ref EmailVariable
        - Inline: false
          Name: 'ip_address'
          Arn: !Ref IpVariable
        - Inline: false
          Name: 'price'
          Arn: !Ref PriceVariable
        - Inline: false
          Name: 'phone_number'
          Arn: !Ref PhoneNumberVariable
      Labels:
        - Inline: false
          Name: 'fraud'
          Arn: !Ref FraudLabel
        - Inline: false
          Name: 'legit'
          Arn: !Ref LegitLabel
      EntityTypes:
        - Inline: false
          Name: 'guest'
          Arn: !Ref GuestEntityType
  # Detector
  GuestCheckoutDetector:
    DependsOn:
      - InvestigateOutcome
      - AllowOutcome
      - GuestCheckoutEventType
    Type: AWS::FraudDetector::Detector
    Properties:
      DetectorId: 'guest_checkout_detector'
      DetectorVersionStatus: 'ACTIVE'
      RuleExecutionMode: 'ALL_MATCHED'
      Description: 'detector for guest checkout investigations based on ip, email, and price'
      EventType:
        Inline: false
        Name: 'guest_checkout_event'
        Arn: !Ref GuestCheckoutEventType
      Rules:
        - RuleId: 'investigate_specific_email'
          DetectorId: 'guest_checkout_detector'
          Expression: '$email_address == "specific@email.address"'
          Language: 'DETECTORPL'
          Outcomes:
            - Inline: false
              Name: 'investigate'
              Arn: !Ref InvestigateOutcome
        - RuleId: 'allow_specific_ip'
          DetectorId: 'guest_checkout_detector'
          Expression: '$ip_address == "fictional_ip_address_to_automatically_allow"'
          Language: 'DETECTORPL'
          Outcomes:
            - Inline: false
              Name: 'automatically_allow'
              Arn: !Ref AllowOutcome
        - RuleId: 'allow_low_price'
          DetectorId: 'guest_checkout_detector'
          Expression: '$price <= 100'
          Language: 'DETECTORPL'
          Outcomes:
            - Inline: false
              Name: 'automatically_allow'
              Arn: !Ref AllowOutcome
        - RuleId: 'investigate_high_price'
          DetectorId: 'guest_checkout_detector'
          Expression: '$price >= 10000'
          Language: 'DETECTORPL'
          Outcomes:
            - Inline: false
              Name: 'investigate'
              Arn: !Ref InvestigateOutcome
        - RuleId: 'investigate_missing_phone_number'
          DetectorId: 'guest_checkout_detector'
          Expression: '$phone_number == " "'
          Language: 'DETECTORPL'
          Outcomes:
            - Inline: false
              Name: 'investigate'
              Arn: !Ref InvestigateOutcome
# Outputs
Outputs:
  InvestigateOutcomeArn:
    Value: !Ref InvestigateOutcome
    Export:
      Name: 'InvestigateOutcomeArn'
  AllowOutcomeArn:
    Value: !Ref AllowOutcome
    Export:
      Name: 'AllowOutcomeArn'
  FraudLabelArn:
    Value: !Ref FraudLabel
    Export:
      Name: 'FraudLabelArn'
  LegitLabelArn:
    Value: !Ref LegitLabel
    Export:
      Name: 'LegitLabelArn'
  EmailVariableArn:
    Value: !Ref EmailVariable
    Export:
      Name: 'EmailVariableArn'
  IpVariableArn:
    Value: !Ref IpVariable
    Export:
      Name: 'IpVariableArn'
  PriceVariableArn:
    Value: !Ref PriceVariable
    Export:
      Name: 'PriceVariableArn'
  PhoneNumberVariableArn:
    Value: !Ref PhoneNumberVariable
    Export:
      Name: 'PhoneNumberVariableArn'
  GuestEntityTypeArn:
    Value: !Ref GuestEntityType
    Export:
      Name: 'GuestEntityTypeArn'
  GuestCheckoutEventTypeArn:
    Value: !Ref GuestCheckoutEventType
    Export:
      Name: 'GuestCheckoutEventTypeArn'
  GuestCheckoutDetectorArn:
    Value: !Ref GuestCheckoutDetector
    Export:
      Name: 'GuestCheckoutDetectorArn'
