Inquiries about combining the CloudWatch Logs and CloudTrail

Question

Hi, I have a question about combining CloudWatch Logs and CloudTrail.

I have a Lambda function triggered by CloudWatch Logs.
What I want to achieve is sending audit logs as Slack messages when a trigger event occurs.
For example: RunInstances, CreateDBInstance, CreateDBCluster, etc.

I’ve configured an EventBridge rule with the following snippet:
```
{
  "source": ["aws.ec2"],
  "detail-type": ["AWS API Call via CloudTrail"],
  "detail": {
    "eventSource": ["ec2.amazonaws.com"],
    "eventName": ["RunInstances"]
  }
}
```

Currently, I am testing the trigger only for RunInstances, but the event trigger is not working as expected. 
Could you please help me figure out what might be going wrong?

Thanks in advance

weinsran · Accepted Answer

Can you please describe the steps you've already taken?

There are several potential issues ranging from Access/Permissions issues to trigger issues and/or delivery issues.

Did you create a new/dedicated Event Bus? It's recommended to Not use the default bus.

Best practices also include:
* Set a single target for each rule
* Set rule permissions using least-privilege
* Monitor rule performance

Additional considerations:
* EventBridge ignores the fields in the event that aren't included in the event pattern. The effect is that there is a "*": "*" wildcard for fields that don't appear in the event pattern.
* The values that event patterns match follow JSON rules. You can include strings enclosed in quotation marks ("), numbers, and the keywords true, false, and null.
* For strings, EventBridge uses exact character-by-character matching without case-folding or any other string normalization.
* For numbers, EventBridge uses string representation. For example, 300, 300.0, and 3.0e2 are not considered equal.
* If multiple patterns are specified for the same JSON field, EventBridge only uses the last one.
* Be aware that when EventBridge compiles event patterns for use, it uses dot (.) as the joining character.

Are you seeing the "Events" counter increase in CloudWatch?

Riku_Kobayashi · Answer

Hello.

Are trails enabled in CloudTrail?  
If this is not enabled, EventBridge will not be able to retrieve AWS API events via CloudTrail.  
https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-log-api-call.html

Inquiries about combining the CloudWatch Logs and CloudTrail

Add your answer

Relevant content