LakeFormation GetDataAccess event not captured by Eventbridge

To capture AWS Lake Formation GetDataAccess events in EventBridge, there are a few important points to understand about how these events flow through AWS services.

Lake Formation events are sent to EventBridge through AWS CloudTrail. However, this requires that you have CloudTrail trails configured to capture these events. Without properly configured trails, the API calls won't be delivered to EventBridge.

For capturing Lake Formation events specifically, you should create an EventBridge rule with an event pattern that includes:

• source: aws.lakeformation
• eventSource: lakeformation.amazonaws.com
• eventName: ["GetDataAccess"] (to specifically target this API call)

If you're able to capture PutDataLakeSettings events but not GetDataAccess events, there are a few possible explanations:

1. The GetDataAccess events might not be included in your CloudTrail configuration. Verify that your trails are configured to capture all management events.

2. CloudTrail delivers events to EventBridge on a "best effort" basis, so there could be delivery inconsistencies.

3. You can verify if these events are being captured by CloudTrail by querying CloudTrail Lake with a query like:

SELECT eventTime, userIdentity.onBehalfOf.userid, requestParameters, serviceEventDetails
FROM your_event_data_store_id
WHERE eventName='GetDataAccess'
ORDER BY eventTime DESC

If the events appear in CloudTrail but not in EventBridge, double-check your event pattern configuration and ensure your CloudTrail is properly set up to deliver events to EventBridge.
Sources
What EventBridge gets from CloudTrail? | AWS re:Post
AWS Lake Formation events - Amazon EventBridge
Simplify data lake access control for your enterprise users with trusted identity propagation in AWS IAM Identity Center, AWS Lake Formation, and Amazon S3 Access Grants | AWS Big Data Blog