ReadOnly events are not reflecting in Cloudwatch log group from Event bridge

1

Hi, I configured this event pattern

{
  "$or": [{
    "detail": {
      "eventType": ["AwsApiCall", "AwsConsoleSignIn", "AwsServiceEvent", "AwsConsoleAction", "AwsCloudTrailInsight"],
      "eventName": [{
        "anything-but": ["GetObject", "CreateLogStream"]
      }]
    }
  }, {
    "detail-type": ["Inspector2 Finding", "Inspector2 Coverage"]
  }]
}

For some reason Im not reciving read only events except a few(LookupEvents, AssumeRole, etc...) but, im not recieving any of the Describe*, List* (basically any read only management events).

Earlier, I had no issues related to read or write events. Everything was working as expected.

I also have tested the event pattern by entering a pattern from cloudwatch to test the pattern

I have a trail with all read, write, management as well as data events enabled, but still its the same issue.

I also have updated to event pattern to capture everything starts with accountID

{
  "account": ["941086XXXXXX"]
}

Even after updating, its still the same.

What I need to do to solve this problem? Thanks!

No Answers

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions