By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post

In EventBridge rule of type "AWS API Call via CloudTrail" how to specify the specific CloudTrail trail to use?

1

I am following this tutorial https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-log-api-call.html.

{
    "source": ["aws.ec2"],
    "detail-type": ["AWS API Call via CloudTrail"]
}

I'd like to create an EventBridge rule that gets CloudTrail API Events. However, my AWS account has several different CloudTrail trails already defined, and I'd like to use a specific trail out of those. Nowhere in the documentation and tutorials it's specified how to define which specific trail the rule should use.

  1. How to define a specific trail?
  2. If there's no way to do it, can you please describe how AWS determines which trail is used when there are several different ones?

Thanks.

  • mukudzeishe_m SUPPORT ENGINEER
    2 months ago

    Hi. This is not supported yet (it could be supported in future). Eventbridge rules for CloudTrail are compared against the event itself (event data) but the event does not have data regarding the trail name/identifier, so you cant create a rule for events from a specific trail. The best you can do is to make use of any event data that is different for events in each trail i.e, what criteria did you use to differentiate your events for each trail?

Topics
ServerlessApplication IntegrationManagement & Governance
Tags
Amazon EventBridgeAWS CloudTrail
Language
English
Ori
asked 2 months ago299 views
1 Answer
1

For EventBridge service to capture events with a detail-type value of AWS API Call via CloudTrail, a CloudTrail trail with logging enabled is required. As long as there is a single trail among many trails configured in your account which has logging enabled, CloudTrail service publish events to EventBridge default event bus which can be captured via EventBridge rule with a detail-type value of AWS API Call via CloudTrail. Please refer to Accessing AWS service events via AWS CloudTrail for more information in this regard.

Answering specifically to your queries above:

  1. How to define a specific trail?
  • It is neither required nor it is part of the CloudTrail events with a detail-type value of AWS API Call via CloudTrail. Hence, you do not need to define a specific trail.
  1. If there's no way to do it, can you please describe how AWS determines which trail is used when there are several different ones?
  • As mentioned above, as long as there is a single trail among many trails configured in your account which has logging enabled, CloudTrail service publish events to EventBridge default event bus which can be captured via EventBridge rule with a detail-type value of AWS API Call via CloudTrail.
AWS
rukhjam
answered 2 months ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions

Relevant content