Why are SAML2Response_POST events from cognito-idp.amazonaws.com not being detected by my event pattern?

Question

Hi,

I am trying to forward this event https://docs.aws.amazon.com/cognito/latest/developerguide/understanding-amazon-cognito-entries.html#cognito-cloudtrail-event-saml-post to a Cloudwatch log group.

Our current configuration is an org trail where all member account Cloudtrail events are logged, I have set up the following:

1. Event rule in the management account to try and match the above event.
2. I then have a target setup to forward the events to the default event bus in Member account A. 
3. Member account A has an IAM policy that allows the management account to forward events to its default event bus (I have confirmed this is not the issue). 
4. Member account A has an event rule on the default event bus to match these events and forward them to a log group (confirmed the forwarding to the log group does work).

I have tried all of the following patterns:

```
{
  "source": ["aws.cognito-idp"]
}

{
  "source": ["aws.cognito-idp"],
  "detail-type": ["AWS API Call via CloudTrail"],
  "detail": {
    "eventSource": ["cognito-idp.amazonaws.com"]
  }
}

{
  "source": ["aws.cognito-idp"],
  "detail-type": ["AWS API Call via CloudTrail"],
  "detail": {
    "eventSource": ["cognito-idp.amazonaws.com"]
    "eventName": ["SAML2Response_POST"]
  }
}

{
  "source": ["aws.cognito-idp"],
  "detail-type": ["AWS Service Event via CloudTrail"],
  "detail": {
    "eventSource": ["cognito-idp.amazonaws.com"]
  }
}

{
  "source": ["aws.cognito-idp"],
  "detail-type": ["AWS Service Event via CloudTrail"],
  "detail": {
    "eventSource": ["cognito-idp.amazonaws.com"]
    "eventName": ["SAML2Response_POST"]
  }
}

{
  "source": ["aws.cloudtrail"]
}

{
  "source": ["aws.cloudtrail"],
  "detail-type": ["AWS API Call via CloudTrail"],
  "detail": {
    "eventSource": ["cognito-idp.amazonaws.com"]
  }
}

{
  "source": ["aws.cognito-idp"],
  "detail-type": ["AWS API Call via CloudTrail"],
  "detail": {
    "eventSource": ["cognito-idp.amazonaws.com"]
    "eventName": ["SAML2Response_POST"]
  }
}

{
  "source": ["aws.cloudtrail"],
  "detail-type": ["AWS Service Event via CloudTrail"],
  "detail": {
    "eventSource": ["cognito-idp.amazonaws.com"]
  }
}

{
  "source": ["aws.cloudtrail"],
  "detail-type": ["AWS Service Event via CloudTrail"],
  "detail": {
    "eventSource": ["cognito-idp.amazonaws.com"]
    "eventName": ["SAML2Response_POST"]
  }
}

```

I even tried using just details:

```
{
    "detail": {
    "eventSource": ["cognito-idp.amazonaws.com"]
  }
}

{
    "detail": {
    "eventSource": ["cognito-idp.amazonaws.com"]
    "eventName": ["SAML2Response_POST"]
  }
}

{
    "detail": {
    "eventName": ["SAML2Response_POST"]
  }
}
```

I even tried just using the account where I know the cognito events originate from:

```
{
  "account": [""]
}
```

Nothing works, the event is never sent to the event bus and never makes its way to the log group.

I know the events exist as we forward our cloudtrail logs to an S3 bucket, I can see the cloudtrail event record there hence I thought doing a blanket account wide event match might do the trick and then I can try and filter in the Member account A's event pattern.

Why is no event pattern combination picking up these SAML2Response_POST events? What have I not configured properly?

Any help will be greatly appreciated!

Cheers,
Josh

re:Post Agent · Answer

Based on the information provided, there are several potential reasons why your SAML2Response_POST events from Amazon Cognito aren't being detected by your event patterns.

Looking at the example SAML2Response_POST event you're trying to capture, I notice that the eventType is "AwsServiceEvent" and not an API call. This is a key distinction for how you should structure your event pattern.

For Amazon Cognito user pools events sent to EventBridge through CloudTrail, you need to use:
- `source`: aws.cognito-idp
- `eventSource`: cognito-idp.amazonaws.com

However, the SAML2Response_POST event appears to be a service event rather than an API call. In your event pattern, you should try using:

```
{
"source": ["aws.cognito-idp"],
"detail-type": ["AWS Service Event via CloudTrail"],
"detail": {
"eventSource": ["cognito-idp.amazonaws.com"],
"eventName": ["SAML2Response_POST"]
}
}
```

Make sure there's a comma after "cognito-idp.amazonaws.com" in your JSON patterns - I noticed some of your examples were missing this comma which would make the JSON invalid.

Also, verify that:
1. Your CloudTrail trail is properly configured to log these events
2. The events are actually occurring during your testing period
3. The CloudTrail trail is enabled in the region where your Cognito user pool is configured
4. Your event rule is in the ENABLED state
5. You've allowed sufficient time for the rule to become active after creation

If you're still having issues, you might want to temporarily create a broader pattern to capture all Cognito events and then analyze what's coming through to better understand the event structure.  
**Sources**  
[Example Amazon Cognito events - Amazon Cognito](https://docs.aws.amazon.com/cognito/latest/developerguide/understanding-amazon-cognito-entries.html)  
[Why am I not receiving Cognito events in EventBridge? | AWS re:Post](https://repost.aws/questions/QUjigwwvGdT2GWmAtsStJF3Q/why-am-i-not-receiving-cognito-events-in-eventbridge)  
[Amazon Cognito user pools events - Amazon EventBridge](https://docs.aws.amazon.com/eventbridge/latest/ref/events-ref-cognito-idp.html)

Why are SAML2Response_POST events from cognito-idp.amazonaws.com not being detected by my event pattern?

Add your answer

Relevant content