Event bridge not triggering for cloudtrail

Question

i have a eventbridge rule to trigger stat machine

```
{
  "detail-type": ["AWS API Call via CloudTrail"],
  "source": ["aws.sso"],
  "detail": {
    "eventSource": ["sso.amazonaws.com", "sso-directory.amazonaws.com"],
    "eventName": ["DisableUser"]
  }
}
```

1.I have one trail with management events enabled
I can show the evnt in cloudtrail
but it not triggered the rule.
Also in the monitroing tab of the eventbridge rule i cant see any invocation.
So the rule is not triggered why 
how to fix

is the above one correct or below onw
whats the difference

```
{
  "source": ["aws.sso-directory"],
  "detail-type": ["AWS API Call via CloudTrail"],
  "detail": {
    "eventSource": ["sso-directory.amazonaws.com"]
    "eventName": ["DisableUser"]
  }
}
```

Jesus Bernal · Answer

These are a few checks you could run:
* AWS services send events to EventBridge on the default bus.
* Is the trail in logging status?
* Are you using the region where you configured Identity Center?

re:Post Agent · Answer

There are several potential reasons why your EventBridge rule isn't triggering for CloudTrail events. Here are the key issues to check and fix:

1. Rule State: Ensure your rule is in the "ENABLED" or "ENABLED_WITH_ALL_CLOUDTRAIL_MANAGEMENT_EVENTS" state. The latter is specifically required for AWS management events delivered through CloudTrail.

2. Region Consideration: For global AWS services like IAM and SSO, events are only available in the US East (N. Virginia) region (us-east-1) for EventBridge. Make sure your rule is created in us-east-1 if you're monitoring SSO events.

3. CloudTrail Integration: Verify that your CloudTrail trail is properly configured to send events to EventBridge. While you mentioned you have management events enabled, double-check that there are no filters excluding the specific events you're interested in.

4. Event Bus: Confirm that your rule is associated with the correct event bus. For AWS service events, you should be using the default event bus.

5. IAM Permissions: Ensure EventBridge has the necessary permissions to access the events and invoke your state machine target.

6. Event Pattern: Your event pattern looks correct, but verify that the exact format of the events coming from SSO matches what you're expecting. The source and detail-type fields are particularly important.

7. Delay: Allow some time for the changes to take effect, as there can sometimes be a slight delay before a rule becomes fully operational.

To troubleshoot further, you could set up CloudWatch metrics to monitor your rule by tracking "TriggeredRules" and "FailedInvocations" metrics, which would give you more insight into what's happening with your rule.  
**Sources**  
[EventBridge rule not triggered | AWS re:Post](https://repost.aws/questions/QUP55fugBBRXyLyfCHQxybpw/eventbridge-rule-not-triggered)  
[EventBridge rule not working | AWS re:Post](https://repost.aws/questions/QUJHuAX-KcTcmQfsGyhlGZqg/eventbridge-rule-not-working)  
[Rule - Amazon EventBridge](https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_Rule.html)

James S · Answer

The second one looks correct to me. The DisableUser API is handled by the `sso-directory` endpoint, not `sso`. You probably don't need the `detail.eventSource` item in there as matching on the `source` should be enough. You mentioned you can see the event in CloudTrail, so you can compare against the event content there if needed.

Your first one is wrong because the `source` has the wrong value in it, so that won't match even though `detail.eventSource` would.

Check the little example at the end of https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-service-event-cloudtrail-management.html

Event bridge not triggering for cloudtrail

Add your answer

Relevant content