Cloudwatch Input Transformer returning no data

0

We have a CloudWatch event monitoring for changes in Route 53 and sends to an SNS topic for email notification. All of the Route53 API calls are being logged to an S3Bucket.

When setting up the "Input Transformer" to clean up the mess of JSON it spits out we are not getting any results.

The message section in the SNS email is empty. I was able to take the Full Event from CloudTrail and parse it with JQ and return the proper information.

Input Transformer;
{"zonename":"$.responseElements.hostedZone.name"}

Input Template;
"Hosted zone is <zonename>."

From the email notification;

{
"Type" : "Notification",
"MessageId" : "27346a5e-7e4a-5f4a-bda9-3e831a084b7c",
"TopicArn" : "arn:aws:sns:us-east-1:432254711293:blaketest",
"Message" : ""Hosted zone is ."",
"Timestamp" : "2019-02-13T00:17:06.434Z",
"SignatureVersion" : "1",
"Signature" : "YgCr24cPcMNoBzV6RpjDjQi74zDHcRKIFnKkKhsIPdeUienu2W5Lww7vhSJqTF7oz2D9aQ_M53voodt1VVdOO8T2Ot44qHlDKf1MibkT4/1exZGPYBLBGfgn/cg8QtjURq0Qb6/dSjRvUWLr9xk/lUSyYvBlm1hgq9bXVGvD6toP2qCuudTzgdvZ1FJ9lAEzDi8YI_xZEnATZoa6jABMBkgca56p/Ix9NZ3gkFa4CY2WoAyr2MEAqY1RrBS/DHlVT1yQDc6WpW1mWy2bDirtNwsdVR02UY788rLoTMiTsMf1z0R8osBpNMeMd7f/Pd3+4A9R9K6W6lW1qzkooPa1PQ==",
"SigningCertURL" : "https://sns.us-east-1.amazonaws.com/SimpleNotificationService-ac565b8b1a6c5d002d285f959****.pem",
"UnsubscribeURL" : "https://sns.us-east-1.amazonaws.com/?Action=Unsubscribe&SubscriptionArn=arn:aws:sns:us-east-1:********:erictest:89551bd8-76d3-458a-a93c-8377486dde19"
}

From CloudTrail Event;

{
"eventVersion": "1.05",
"userIdentity": {
"type": "IAMUser",
"principalId": "",
"arn": "arn:aws:iam::
:user/blakes",
"accountId": "",
"accessKeyId": "
*",
"userName": "blakes",
"sessionContext": {
"attributes": {
"mfaAuthenticated": "true",
"creationDate": "2019-02-12T18:23:55Z"
}
},
"invokedBy": "signin.amazonaws.com"
},
"eventTime": "2019-02-13T00:16:25Z",
"eventSource": "route53.amazonaws.com",
"eventName": "CreateHostedZone",
"awsRegion": "us-east-1",
"sourceIPAddress": "
****",
"userAgent": "signin.amazonaws.com",
"requestParameters": {
"hostedZoneConfig": {
"privateZone": false,
"comment": "ERIC testing"
},
"callerReference": "AB354EGG09E-FC5E-046A-A6C1-8B1815375B0C",
"name": "testeric.com"
},
"responseElements": {
"changeInfo": {
"status": "PENDING",
"id": "/change/C3TJKPOO14VP6B",
"submittedAt": "Feb 13, 2019 12:16:25 AM"
},
"location": "https://route53.amazonaws.com/2013-04-01/hostedzone/Z3JK3REDKJVTQZ",
"hostedZone": {
"resourceRecordSetCount": 2,
"config": {
"privateZone": false,
"comment": "eric testing"
},
"name": "testeric.com.",
"id": "/hostedzone/Z3JKGRGERGDKJVTQZ",
"callerReference": "AB35409E-FC5EHERH-046A-A6C1-8B1815375B0C"
},
"delegationSet": {
"nameServers": [
"ns-942.awsdns-53.net",
"ns-121.awsdns-15.com",
"ns-1417.awsdns-49.org",
"ns-1927.awsdns-48.co.uk"
]
}
},
"requestID": "99c9fb95-2f24-11e9-a419-4fc3574ffweewqb5f52",
"eventID": "32bbf0ffw0e-1a95-416e-9dd5-ae2eec971b41",
"eventType": "AwsApiCall",
"apiVersion": "2013-04-01",
"recipientAccountId": "
*****"
}

Thank you,

Let me know if any additional information is needed.

Blakes
已提問 5 年前檢視次數 330 次
3 個答案
0

Can anyone provide any updates to this issue? Still having the same problem.

Even following the AWS docs and using the JSON code provided to write input transformer queries it still returns no results.

Blakes
已回答 5 年前
0

/

Blakes
已回答 4 年前
0

Hello,

An event in EventBridge has the format as defined in [1]. When you monitor an CloudTrail API call, it has the following format.

{ "id": "<required>", "account": "<required>", "source": "aws.<service>, <--- the source service "time": "<required>", "region": "<required>", "resources": "<required>", "detail-type": "AWS API Call via CloudTrail" "detail" : {

// Contains the complete cloudtrail event } }

Therefore for your use case, the actual event received by EventBridge would be:

{ "version": "0", "id": "b03f6e6c-1a74-4f69-e219-84e2498d7f20", "detail-type": "AWS API Call via CloudTrail", "source": "aws.route53", "account": "123456789012", "time": "2022-04-01T00:00:00Z", "region": "us-east-1", "resources": [], "detail": { "eventVersion": "1.05", "userIdentity": { "type": "IAMUser", "principalId": "", "arn": "arn:aws:iam:::user/blakes", "accountId": "", "accessKeyId": "", "userName": "blakes", "sessionContext": { "attributes": { "mfaAuthenticated": "true", "creationDate": "2019-02-12T18:23:55Z" } }, "invokedBy": "signin.amazonaws.com" }, "eventTime": "2019-02-13T00:16:25Z", "eventSource": "route53.amazonaws.com", "eventName": "CreateHostedZone", "awsRegion": "us-east-1", "sourceIPAddress": "", "userAgent": "signin.amazonaws.com", "requestParameters": { "hostedZoneConfig": { "privateZone": false, "comment": "ERIC testing" }, "callerReference": "AB354EGG09E-FC5E-046A-A6C1-8B1815375B0C", "name": "testeric.com" }, "responseElements": { "changeInfo": { "status": "PENDING", "id": "/change/C3TJKPOO14VP6B", "submittedAt": "Feb 13, 2019 12:16:25 AM" }, "location": "https://route53.amazonaws.com/2013-04-01/hostedzone/Z3JK3REDKJVTQZ", "hostedZone": { "resourceRecordSetCount": 2, "config": { "privateZone": false, "comment": "eric testing" }, "name": "testeric.com.", "id": "/hostedzone/Z3JKGRGERGDKJVTQZ", "callerReference": "AB35409E-FC5EHERH-046A-A6C1-8B1815375B0C" }, "delegationSet": { "nameServers": [ "ns-942.awsdns-53.net", "ns-121.awsdns-15.com", "ns-1417.awsdns-49.org", "ns-1927.awsdns-48.co.uk" ] } }, "requestID": "99c9fb95-2f24-11e9-a419-4fc3574ffweewqb5f52", "eventID": "32bbf0ffw0e-1a95-416e-9dd5-ae2eec971b41", "eventType": "AwsApiCall", "apiVersion": "2013-04-01", "recipientAccountId": "**" } }

Based on the above, to extract the hosted zone name, you can use the following input transformer.

{"hzname":"$.detail.responseElements.hostedZone.name"}

"HZ name is <hzname>"

The output:

HZ name is testeric.com.

Similarly you can extract other fields as required.

[1] https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-events.html

AWS
支援工程師
已回答 1 年前

您尚未登入。 登入 去張貼答案。

一個好的回答可以清楚地回答問題並提供建設性的意見回饋,同時有助於提問者的專業成長。

回答問題指南