Eventbridge Pattern - Tag Change on Resource

Question

Hi! I'm trying to create at rule in Eventbridge that will target a Lambda function when an RDS snapshot tag is changed. I followed the Tag Change on Resource sample and came up with

{
  "source": ["aws.tag"],
  "detail-type": ["Tag Change on Resource"],
  "resources": ["arn:aws:rds:*:*:snapshot:*"],
  "detail": {
    "changed-tag-keys": ["ShareStatus"],
    "service": ["rds"],
    "resource-type": ["snapshot"],
    "tags": {
      "ShareStatus": ["ready"]
    }
  }
}

Changing or adding the tag to the RDS snapshot failed to trigger this event. I then modified the pattern to read:

{
  "source": ["aws.tag"],
  "detail-type": ["Tag Change on Resource"],
  "resources": ["*"]
}

This too failed to trigger the event. I stripped it down further to simply read:

{
  "source": ["aws.tag"]
}

This finally yielded the expected result. With that said, this event would now pick up on any tag change on any resource as opposed to my desired limit to RDS snapshots. So how can I adjust my event pattern to satisfy these needs? Thanks!

Answer

When editing the tags of an RDS snapshot, the events "AddTagsToResource" and "RemoveTagsFromResource" are logged in CloudTrail.  
I created an event pattern so that Lambda can be executed using this event.

However, this event pattern also catches events about editing RDS instance tags, etc., in addition to RDS snapshots.  
Therefore, please include a process on the Lambda side to determine whether the event is a snapshot tag edit event or an instance tag edit event.  
```
{
  "source": ["aws.rds"],
  "detail-type": ["AWS API Call via CloudTrail"],
  "detail": {
    "eventSource": ["rds.amazonaws.com"],
    "eventName": ["AddTagsToResource", "RemoveTagsFromResource"]
  }
}
```

Eventbridge Pattern - Tag Change on Resource

관련 콘텐츠