EventBridge rule not triggered

Question

I have an EventBridge rule with this event pattern:

```
{
  "source": ["aws.iam"],
  "detail-type": ["AWS API Call via CloudTrail"],
  "detail": {
    "eventSource": ["iam.amazonaws.com"]
  }
}
```
As I understand, this rule will be triggered when there are activities in the IAM service (create user, create role, ...)

I also set up a CloudTrail trail with a S3 bucket to capture events.

I tried creating an IAM user. I checked the CloudTrail trail log using Athena and saw the event CreateUser. But the EventBridge rule was not triggered.

Please help me fix this issue. Thanks

re:Post Agent · Accepted Answer

There are a few potential reasons why your EventBridge rule is not being triggered despite seeing the CreateUser event in CloudTrail logs. Let's go through some troubleshooting steps:

1. Rule State: Ensure that your rule is in the "ENABLED" state. If it's disabled, EventBridge won't match any events against the rule.

2. Event Bus: Verify that you've associated the rule with the correct event bus. For AWS service events like IAM actions, you should use the default event bus.

3. Region: Check if you've created the rule in the correct AWS region. Events from AWS global services like IAM are only available in the US East (N. Virginia) Region for EventBridge.

4. IAM Permissions: Make sure that EventBridge has the necessary permissions to access the events and invoke the target.

5. Target Configuration: Verify that the target for your rule is correctly configured and has the necessary permissions to be invoked by EventBridge.

6. Delay: Allow some time for the changes to take effect. Sometimes there can be a slight delay before a newly created or modified rule becomes fully operational.

7. CloudTrail Integration: Ensure that your CloudTrail trail is configured to send events to EventBridge. By default, management events should be enabled, but double-check this setting.

8. Event Pattern: Your event pattern looks correct, but you might want to try broadening it slightly to catch more events and narrow down the issue. For example:

```json
{
  "source": ["aws.iam"],
  "detail-type": ["AWS API Call via CloudTrail"]
}
```

If the issue persists after checking these points, you can use CloudWatch metrics to monitor your rule. Set up a metric for "TriggeredRules" and "FailedInvocations" to get more insight into what's happening with your rule.

Remember, EventBridge tries to deliver an event to a target for up to 24 hours, but if there are constraints or throttling on the target side, it might not retry delivery. If you're still having trouble, you might want to set up a dead-letter queue (DLQ) to capture any failed event deliveries for further analysis.  
**Sources**  
[Troubleshooting Amazon EventBridge - Amazon EventBridge](https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-troubleshooting.html)  
[Rule - Amazon EventBridge](https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_Rule.html)  
[Troubleshoot Amazon EventBridge rule with ECS | AWS re:Post](https://repost.aws/knowledge-center/troubleshoot-eventbridge-rule-ecs)

EventBridge rule not triggered

Add your answer

Relevant content