How do I get notified when IAM changes occur in my AWS account?

Short description

Create an Amazon EventBridge rule with an event pattern that matches a specific IAM API call or multiple IAM API calls. Then, associate the rule with an Amazon Simple Notification Service (Amazon SNS) topic. When the rule runs, Amazon SNS sends an SNS notification to the corresponding subscriptions.

Resolution

Prerequisites:

• Create an Amazon SNS topic.
• You must have a CloudTrail trail configured in the US East (N. Virginia) AWS Region with management events set to Write-only or All.

EventBridge receives IAM API call events through CloudTrail. The IAM service and related AWS API calls are available only in the US East (N. Virginia) Region. This means that the EventBridge rule must also be in the US East (N. Virginia) Region.

The following example custom event pattern starts a notification when CreateUser and DeleteUser API calls are made in your account.

Complete the following steps:

1. Open the EventBridge console in the US East (N. Virginia) Region.

2. In the navigation pane, choose Rules, and then select Create rule.

3. Enter a Name and Description for the rule.

4. For Event bus, select the default AWS event bus. When IAM emits an event, it goes to your account's default event bus.

5. For Rule type, choose Rule with an event pattern, and then select Next.

6. For Event source, choose AWS events or EventBridge partner events.

7. Under Event pattern, choose the following:
   For Event source, choose AWS services.
   For AWS service, choose IAM.
   For Event type, choose AWS API Call via CloudTrail.
   To start the rule for specific API calls, choose Specific operation(s).
   In the text box, enter the name of an API call to receive notifications. For example, CreateUser.
   To add more API calls, choose Add.

8. Under the Event pattern preview box, choose Edit pattern.

9. Copy and paste the following example template into the event pattern preview pane:

   {  
     "source": [
       "aws.iam"
     ],
     "detail-type": [
       "AWS API Call via CloudTrail"
     ],
     "detail": {
       "eventSource": [
         "iam.amazonaws.com"
       ],
       "eventName": [
         "CreateUser",
         "DeleteUser"
       ]
     }
   }

10. Choose Save.

11. Choose Next.

12. For Target types, choose AWS service.

13. For Select a target, choose SNS topic.

14. In the Topic dropdown list, select your SNS topic.

15. (Optional) To add another target for this rule, choose Add another target.

16. Choose Next.

17. (Optional) Enter one or more tags for the rule. For more information, see Adding or removing tags on event buses.

18. Choose Next.

19. Confirm that the details of the rule are correct, and then choose Create rule.

Related information

How do I get notifications when changes happen to my Route 53 hosted zone records?

How do I configure EventBridge rules for GuardDuty to send custom SNS notifications for specific service finding types?

My rule matches AWS global service API calls but it didn't run