- Newest
- Most votes
- Most comments
Can anyone provide any updates to this issue? Still having the same problem.
Even following the AWS docs and using the JSON code provided to write input transformer queries it still returns no results.
Hello,
An event in EventBridge has the format as defined in [1]. When you monitor an CloudTrail API call, it has the following format.
{ "id": "<required>", "account": "<required>", "source": "aws.<service>, <--- the source service "time": "<required>", "region": "<required>", "resources": "<required>", "detail-type": "AWS API Call via CloudTrail" "detail" : {
// Contains the complete cloudtrail event } }
Therefore for your use case, the actual event received by EventBridge would be:
{ "version": "0", "id": "b03f6e6c-1a74-4f69-e219-84e2498d7f20", "detail-type": "AWS API Call via CloudTrail", "source": "aws.route53", "account": "123456789012", "time": "2022-04-01T00:00:00Z", "region": "us-east-1", "resources": [], "detail": { "eventVersion": "1.05", "userIdentity": { "type": "IAMUser", "principalId": "", "arn": "arn:aws:iam:::user/blakes", "accountId": "", "accessKeyId": "", "userName": "blakes", "sessionContext": { "attributes": { "mfaAuthenticated": "true", "creationDate": "2019-02-12T18:23:55Z" } }, "invokedBy": "signin.amazonaws.com" }, "eventTime": "2019-02-13T00:16:25Z", "eventSource": "route53.amazonaws.com", "eventName": "CreateHostedZone", "awsRegion": "us-east-1", "sourceIPAddress": "", "userAgent": "signin.amazonaws.com", "requestParameters": { "hostedZoneConfig": { "privateZone": false, "comment": "ERIC testing" }, "callerReference": "AB354EGG09E-FC5E-046A-A6C1-8B1815375B0C", "name": "testeric.com" }, "responseElements": { "changeInfo": { "status": "PENDING", "id": "/change/C3TJKPOO14VP6B", "submittedAt": "Feb 13, 2019 12:16:25 AM" }, "location": "https://route53.amazonaws.com/2013-04-01/hostedzone/Z3JK3REDKJVTQZ", "hostedZone": { "resourceRecordSetCount": 2, "config": { "privateZone": false, "comment": "eric testing" }, "name": "testeric.com.", "id": "/hostedzone/Z3JKGRGERGDKJVTQZ", "callerReference": "AB35409E-FC5EHERH-046A-A6C1-8B1815375B0C" }, "delegationSet": { "nameServers": [ "ns-942.awsdns-53.net", "ns-121.awsdns-15.com", "ns-1417.awsdns-49.org", "ns-1927.awsdns-48.co.uk" ] } }, "requestID": "99c9fb95-2f24-11e9-a419-4fc3574ffweewqb5f52", "eventID": "32bbf0ffw0e-1a95-416e-9dd5-ae2eec971b41", "eventType": "AwsApiCall", "apiVersion": "2013-04-01", "recipientAccountId": "**" } }
Based on the above, to extract the hosted zone name, you can use the following input transformer.
{"hzname":"$.detail.responseElements.hostedZone.name"}
"HZ name is <hzname>"
The output:
HZ name is testeric.com.
Similarly you can extract other fields as required.
[1] https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-events.html
Relevant content
- asked 3 months ago
- Accepted Answerasked 5 months ago
- Generate specific parameters to appear in SNS email notification in CloudWatch Alarm for a Log GroupAccepted Answerasked a year ago
- AWS OFFICIALUpdated 3 months ago
- AWS OFFICIALUpdated 2 years ago
- AWS OFFICIALUpdated 6 months ago