I have implemented the AWS S3 Malware GuardDuty protection as detailed https://github.com/aws-samples/guardduty-malware-protection/tree/main/cdk, the events are being triggered when a file is uploaded. I have also created an additional Rule that will trigger an AWS StepFunction, but this seems not to trigger. I have used the payload as document here: https://docs.aws.amazon.com/guardduty/latest/ug/monitor-with-eventbridge-s3-malware-protection.html

Here is part of the code:

    // Workflow
    const workflowStack = new WorkflowStack(this, "Workflow", {
      config: props.config,
      bucketArn: sftpBucket.bucketArn
    });

    const guardDutyNoMalwareRule = new Rule(
      this,
      "GuardDutyMalwareScanResultRule",
      {
        eventPattern: {
          source: ["aws.guardduty"],
          detailType: ["GuardDuty Malware Protection Object Scan Result"],
          detail: {
            scanResultDetails: {
              scanResultStatus: ["NO_THREATS_FOUND"],
            },
          },
        },
      },
    );

    guardDutyNoMalwareRule.addEventPattern({
      detail: {
        responsePayload: {
          input_key: [
            {
              "anything-but": { wildcard: ["results/*"] },
            },
          ],
        },
      },
    });

    guardDutyNoMalwareRule.addTarget(
      new SfnStateMachine(workflowStack.sfn, {
        input: RuleTargetInput.fromObject({
          input_bucket: EventField.fromPath(
            "$.detail.s3ObjectDetails.bucketName",
          ),
          input_key: EventField.fromPath("$.detail.s3ObjectDetails.objectKey"),
          message: "Scan completed, no threats found.",
          source: EventField.fromPath("$.source"),
          status: EventField.fromPath(
            "$.detail.scanResultDetails.scanResultStatus",
          ),
        }),
      }),
    );

Basically I want to trigger the StepFunction when aws.guardduty with "GuardDuty Malware Protection Object Scan Result"] and scanResultStatus: ["NO_THREATS_FOUND"]
I also want to transform the input and send it to the StepFunction, but is not even triggering the step function.

Any advice is much appreciated