Eventbridge trigger with cloud trail event

In EventBridge event patterns, string matching is done with arrays, with the square bracket syntax [ ]. You also seem to have JSON syntax inside a json_encode() function call, but I believe the purpose of the function is to be able to describe the structure as a Terraform object and to have the function convert it to JSON syntax.

I'd suggest starting with formatting the rule and json_encode() function call in the way that is shown in the documentation examples: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_rule#example-usage

You'll need to make sure that the string literals you want the pattern to match are provided as arrays.

One of the comparisons would be, for example,

name = ["AMI-checking"]

instead of without square brackets that an array would require as:

name = "AMI-checking"

or in JSON notation:

"name": "AMI-checking"

I haven't got Terraform set up to test this, but I think the rule would look something like this:

resource "aws_cloudwatch_event_rule" "ami_creation_rule" {
  name        = "detect-ami-creation"
  description = "Detects the creation of AMIs with the name AMI-checking"
  event_pattern = jsonencode({
    source = ["aws.ec2"]
    detail-type = ["AWS API Call via CloudTrail"]
    detail = {
      eventSource = ["ec2.amazonaws.com"]
      eventName = ["CreateImage"]
      requestParameters {
        name = ["AMI-checking"]
      }
    }
  })
}

Hi,

you have a full example for another service (SQS CreateQueue) in this article: https://repost.aws/knowledge-center/automate-eventbridge-rule-cloudtrail-api

Best,

Didier