Event pattern for retrieving secret values


I would like to get notified when someone retrieves a secret value. I created an event rule (see below) and set an SNS topic as a target, to which I had subscribed. However, it does not appear to be working. Is there anything I need to do in the event pattern to make it work?

{ "source": ["aws.secretsmanager"], "detail-type": ["AWS API Call via CloudTrail"], "detail": { "eventSource": ["secretsmanager.amazonaws.com"], "eventName": ["GetSecretValue"] } }

1 Answer
Accepted Answer


The following documentation may be helpful.

Perhaps the rule you created does not have "ENABLED_WITH_ALL_CLOUDTRAIL_MANAGEMENT_EVENTS" enabled.
Please run the following AWS CLI command to enable it.

aws events put-rule --name "rule-name" --event-pattern "{ \"source\": [\"aws.secretsmanager\"], \"detail-type\": [\"AWS API Call via CloudTrail\"], \"detail\": { \"eventName\": [\"GetSecretValue\"] } }" --state ENABLED_WITH_ALL_CLOUDTRAIL_MANAGEMENT_EVENTS

In addition to the above, you also need to set up a trail for your account in CloudTrail.

profile picture
answered 4 months ago
  • Works like a charm. Thank you so much!

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions