Event bridge trigger with cloudtrail

To create an EventBridge rule that's triggered by CloudTrail events, there are several things to check when your rule isn't working as expected:

1. Rule Configuration: Make sure your rule is properly configured with the correct event pattern. For CloudTrail events, you need to:

• Set the source to the appropriate AWS service (like "aws.ec2" for EC2 events)
• Set the detail-type to "AWS API Call via CloudTrail"
• Specify the eventSource in the detail section (like "ec2.amazonaws.com")
• Include the specific API operation you want to monitor (like "CreateImage" or "StopInstances")

2. Event Pattern Format: When defining event patterns, string matching requires arrays with square brackets. For example, use "name": ["AMI-checking"] instead of "name": "AMI-checking".

3. Region Considerations: For global services like IAM, events are only available in the US East (N. Virginia) region for EventBridge.

4. Rule State: Verify your rule is in the "ENABLED" state.

5. Event Bus: Ensure you're using the default event bus for AWS service events.

6. IAM Permissions: Check that EventBridge has the necessary permissions to access events and invoke targets.

7. Target Configuration: Confirm your target (like SNS) is correctly configured with proper permissions.

8. CloudTrail Integration: Ensure your CloudTrail trail is properly set up to send events to EventBridge with management events enabled.

9. Delay: Allow some time for changes to take effect as there can be a slight delay before a rule becomes fully operational.

If the issue persists, you can use CloudWatch metrics to monitor your rule by setting up metrics for "TriggeredRules" and "FailedInvocations" to gain more insight into what's happening.
Sources
Tutorial: Create an EventBridge rule that reacts to AWS API calls via CloudTrail - Amazon EventBridge
EventBridge rule not triggered | AWS re:Post
Eventbridge trigger with cloud trail event | AWS re:Post