Capturing CloudTrail events from QuickSight

0

I am trying to catch the CloudTrail events into EventBridge. I am following this article:

https://aws.amazon.com/blogs/big-data/using-administrative-dashboards-for-a-centralized-view-of-amazon-quicksight-objects/

Which also uses this code base:

https://github.com/aws-samples/amazon-quicksight-sdk-proserve/blob/master/Administrative_Dashboard/administrative_dashboard/administrative_dashboard_stack.py

I am pretty much doing everything the same, except in TypeScript:

Trail.onEvent(this, 'OnEvent', {
  description: 'Catch QuickSight CloudTrail events.',
  target: new aws_events_targets.CloudWatchLogGroup(new LogGroup(this, 'EventLog')),
  eventPattern: {
    source: ['aws.quicksight'],
    detail: {
      eventSource: ['quicksight.amazonaws.com'],
      eventName: ['CreateGroup'],
    },
  },
})

Yet, I am not getting any events in my log.

I do see them in the CloudTrail UI though.

The final EventBridge rule is:

{
  "detail-type": ["AWS API Call via CloudTrail"],
  "source": ["aws.quicksight"],
  "detail": {
    "eventSource": ["quicksight.amazonaws.com"],
    "eventName": ["CreateGroup"]
  }
}
  • QuickSight and everything is in the same region
  • I am using AWS CDK, so I can almost rule out any permission issue, as all of that is handled
  • I am using the same rules as the linked codebase above, just in TS

Is there anything else that needs to be done on the account to be able to pipe these events to EventBridge?

Thanks.

  • Have you created a Cloudtrail Trail that monitors that event?

  • @vtjean I have tried that, yes, but it had no effect. Also, the article I have linked does not indicate that this is a required step.

  • Have been trying to solve this with support since posting this question. Still no full resolution, but some updates.

    Indeed, creating a CloudTrail trail does solve the issue and does emit events to EB.

    However, the question still remains, how this works in the other (staging) account, which has no trails?

    And how did it work for that demo code that has been shared on GH, without the trail?

    My guess would be that perhaps, depending on the age of the account, trail events are automatically enabled, but for older accounts, they were not enabled retroactively for some reason.

1개 답변
0

It was confirmed by AWS that it appears to be a bug on an individual account. They are looking into it.

profile picture
m0ltar
답변함 일 년 전

로그인하지 않았습니다. 로그인해야 답변을 게시할 수 있습니다.

좋은 답변은 질문에 명확하게 답하고 건설적인 피드백을 제공하며 질문자의 전문적인 성장을 장려합니다.

질문 답변하기에 대한 가이드라인