Can't Detect ListProfileObjects as an Event Trigger in Event Bridge

Question

Hello,

I am trying to get this eventname/api call from Cloudtrail or eventbride so it can trigger a Lambda but I cannot trigger the event bridge it only shows SearchProfile but no ProfileID or key included.

here is my pattern

```
{
  "source": ["profile.amazonaws.com"],
  "detail-type": ["AWS API Call via CloudTrail"],
  "detail": {
    "eventSource": ["profile.amazonaws.com"]
  }
}
```

Only SearchProfile is showing on lambda cloud watch logs but no ListProfileObjects  while on the cloud trail here is the log.

"eventTime": "2024-08-12T06:28:33Z",
    "eventSource": "profile.amazonaws.com",
    "eventName": "ListProfileObjects",
    "awsRegion": "ap-southeast-2",
    "sourceIPAddress": "connect.amazonaws.com",
    "userAgent": "connect.amazonaws.com",

![Here is the Cloudtrail Event ](/media/postImages/original/IMpoQEyXLuSo-RXlkce-LVHQ)

NARRAVULA MUNISAI TEJA · Answer

Hello,

The issue you're facing is that CloudTrail captures the` ListProfileObjects` event, but EventBridge might not have a predefined pattern for it.

**1. Use a broader pattern in EventBridge:**
* Instead of specifying` "eventName": "ListProfileObjects", `use a wildcard character` *` to match any event name starting with `"ListProfileObjects"`. This will capture all ListProfileObjects events, including variations.

**The updated pattern:**

```
{
  "source": ["profile.amazonaws.com"],
  "detail-type": ["AWS API Call via CloudTrail"],
  "detail": {
    "eventSource": ["profile.amazonaws.com"],
    "eventName": ["ListProfileObjects*"]  // Capture all ListProfileObjects events
  }
}
```

**Use code**

**2. Use CloudTrail Lake with Lambda Function:**

* If you need more granular control or want to process specific details within the `ListProfileObjects `event, consider using CloudTrail Lake.
* CloudTrail Lake stores CloudTrail events in a data lake format (e.g., S3 bucket with Parquet files).
* You can create a Lambda function triggered by changes in the S3 bucket where CloudTrail Lake stores events.
* Inside the Lambda function, you can parse the CloudTrail event data (using a library like PyArrow) and identify events based on **eventName** or other relevant fields. This allows for more flexibility in filtering and processing events.

**Referral Links: **

**EventBridge Patterns:** https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-event-patterns.html

**CloudTrail Lake:** https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-lake.html

**Using Lambda with S3:** https://docs.aws.amazon.com/lambda/latest/dg/with-s3.html

Can't Detect ListProfileObjects as an Event Trigger in Event Bridge

相關內容