def create_cloudwatch_alarm(metric_name, namespace, alarm_name, alarm_description, threshold, sns_topic_arn):
      cloudwatch = boto3.client('cloudwatch')
      cloudwatch.put_metric_alarm(
            AlarmName=alarm_name,
            AlarmDescription=alarm_description,
            MetricName=metric_name,
            Namespace=namespace,
            ComparisonOperator='GreaterThanOrEqualToThreshold',
            Threshold=threshold,
            EvaluationPeriods=1,
            Statistic='Sum',
            Period=300,
            ActionsEnabled=True,
            AlarmActions=[sns_topic_arn]
      )

   sns_topic_arn = `<SNS topic ARN>`
   create_cloudwatch_alarm('RootAccountUsageCount', 'CloudTrailMetrics', 'RootAccountUsageCountAlarm', 'Alarm for Root Account Usage Count', 1, sns_topic_arn)
   create_cloudwatch_alarm('RootAccountUsageEventCount', 'CloudTrailMetrics', 'RootAccountUsageEventCountAlarm', 'Alarm for Root Account Usage Event Count', 1, sns_topic_arn)

# SNS topic to receive root account usage alerts
resource "aws_sns_topic" "root_account_usage_alerts" {
  name = "RootAccountUsageAlerts"
}

# Email subscription for the SNS topic
# WARNING: The email owner must confirm the subscription from the email they receive.
resource "aws_sns_topic_subscription" "root_account_usage_email" {
  topic_arn = aws_sns_topic.root_account_usage_alerts.arn
  protocol  = "email"
  endpoint  = "YOUR_EMAIL_ADDRESS" # replace with a valid email address
}

# CloudWatch Logs metric filter on the CloudTrail log group
# WARNING: Replace CLOUDTRAIL_LOG_GROUP_NAME with the name of the log group that receives your CloudTrail logs.
resource "aws_cloudwatch_log_metric_filter" "root_account_usage_filter" {
  name           = "RootAccountUsageFilter"
  log_group_name = "CLOUDTRAIL_LOG_GROUP_NAME" # replace with your CloudTrail log group name

  pattern = "{ ($.userIdentity.type = \"Root\") && ($.userIdentity.invokedBy NOT EXISTS) && ($.eventType != \"AwsServiceEvent\") }"

  metric_transformation {
    name      = "RootAccountUsage"
    namespace = "CloudTrailMetrics"
    value     = "1"
  }
}

# CloudWatch alarm for root account usage
resource "aws_cloudwatch_metric_alarm" "root_account_usage_alarm" {
  alarm_name          = "RootAccountUsageAlarm"
  alarm_description   = "Triggers when root account is used"
  namespace           = "CloudTrailMetrics"
  metric_name         = "RootAccountUsage"
  statistic           = "Sum"
  period              = 300
  threshold           = 1
  comparison_operator = "GreaterThanOrEqualToThreshold"
  evaluation_periods  = 1

  alarm_actions = [
    aws_sns_topic.root_account_usage_alerts.arn,
  ]

  depends_on = [
    aws_cloudwatch_log_metric_filter.root_account_usage_filter,
  ]
}