EventBridge Troubleshooting

Question

Team, I'm trying to trigger an event based on the Ec2 tag  "key"  (Using EventBridge), But it fails.

{
  "source": ["aws.ec2"],
  "detail-type": ["EC2 Instance State-change Notification"],
  "detail": {
    "state": ["running"],
    }
}

This creates Event

whereas

{
  "source": ["aws.ec2"],
  "detail-type": ["EC2 Instance State-change Notification"],
  "detail": {
    "state": ["running"],
    "tags": ["Name"]
  }
}

Doesn't . I took the json based on the cloudtrail event

"tagSpecificationSet": {
            "items": [
                {
                    "resourceType": "instance",
                    "tags": [
                        {
                            "key": "Name",
                            "value": "Instance3"
                        }
                    ]
                }
            ]
        },

Question,

- I believe the problem is with event pattern matching and me not having right source
- Side note, The sample event in event change not notification doesn't have TAG. So, Is it event possible to use filter event based on TAG with the EventBridge?

Accepted Answer

The issue with your pattern is that you omitted the "Key" from there. It should be something like this (I based it on your example, did not check what the actual event looks like):
```
{
  "source": ["aws.ec2"],
  "detail-type": ["EC2 Instance State-change Notification"],
  "detail": { 
    "state": ["running"],
    "tagSpecificationSet": {
      "items": {
        "tags": {
          "key": ["Name"]
        }
      }
    }
  }
}
```

Note, the above pattern will match any tag that has a Key = Name. I assume you want to have a rule that matches Name = Instance3. This, i.e., correlating two attributes, is not supported by EventBridge Rules. If all you do is catch events regarding instances that have a tag names Name, this will work.

EventBridge Troubleshooting

Relevant content