Capturing CloudTrail events from QuickSight

0

I am trying to catch the CloudTrail events into EventBridge. I am following this article:

https://aws.amazon.com/blogs/big-data/using-administrative-dashboards-for-a-centralized-view-of-amazon-quicksight-objects/

Which also uses this code base:

https://github.com/aws-samples/amazon-quicksight-sdk-proserve/blob/master/Administrative_Dashboard/administrative_dashboard/administrative_dashboard_stack.py

I am pretty much doing everything the same, except in TypeScript:

Trail.onEvent(this, 'OnEvent', {
  description: 'Catch QuickSight CloudTrail events.',
  target: new aws_events_targets.CloudWatchLogGroup(new LogGroup(this, 'EventLog')),
  eventPattern: {
    source: ['aws.quicksight'],
    detail: {
      eventSource: ['quicksight.amazonaws.com'],
      eventName: ['CreateGroup'],
    },
  },
})

Yet, I am not getting any events in my log.

I do see them in the CloudTrail UI though.

The final EventBridge rule is:

{
  "detail-type": ["AWS API Call via CloudTrail"],
  "source": ["aws.quicksight"],
  "detail": {
    "eventSource": ["quicksight.amazonaws.com"],
    "eventName": ["CreateGroup"]
  }
}
  • QuickSight and everything is in the same region
  • I am using AWS CDK, so I can almost rule out any permission issue, as all of that is handled
  • I am using the same rules as the linked codebase above, just in TS

Is there anything else that needs to be done on the account to be able to pipe these events to EventBridge?

Thanks.

  • Have you created a Cloudtrail Trail that monitors that event?

  • @vtjean I have tried that, yes, but it had no effect. Also, the article I have linked does not indicate that this is a required step.

  • Have been trying to solve this with support since posting this question. Still no full resolution, but some updates.

    Indeed, creating a CloudTrail trail does solve the issue and does emit events to EB.

    However, the question still remains, how this works in the other (staging) account, which has no trails?

    And how did it work for that demo code that has been shared on GH, without the trail?

    My guess would be that perhaps, depending on the age of the account, trail events are automatically enabled, but for older accounts, they were not enabled retroactively for some reason.

profile picture
m0ltar
已提問 1 年前檢視次數 458 次
1 個回答
0

It was confirmed by AWS that it appears to be a bug on an individual account. They are looking into it.

profile picture
m0ltar
已回答 1 年前

您尚未登入。 登入 去張貼答案。

一個好的回答可以清楚地回答問題並提供建設性的意見回饋,同時有助於提問者的專業成長。

回答問題指南