Capturing CloudTrail events

Question & Answer
,
1

I am trying to catch the CloudTrail events into EventBridge. I am following this article:

Which also uses this code base:

I am pretty much doing everything the same, except in TypeScript:

    Trail.onEvent(this, 'OnEvent', {
      description: 'Catch QuickSight CloudTrail events.',
      target: new aws_events_targets.CloudWatchLogGroup(new LogGroup(this, 'EventLog')),
      eventPattern: {
        source: ['aws.quicksight'],
        detail: {
          eventSource: ['quicksight.amazonaws.com'],
          eventName: ['CreateGroup'],
        },
      },
    })

Yet, I am not getting any events in my log.

I do see them in the CloudTrail UI though.

The final EventBridge rule is:

{
  "detail-type": ["AWS API Call via CloudTrail"],
  "source": ["aws.quicksight"],
  "detail": {
    "eventSource": ["quicksight.amazonaws.com"],
    "eventName": ["CreateGroup"]
  }
}
  • QuickSight and everything is in the same region
  • I am using AWS CDK, so I can almost rule out any permission issue, as all of that is handled
  • I am using the same rules as the linked codebase above, just in TS

Is there anything else that needs to be done on the account to be able to pipe these events to EventBridge?

Thanks.

1 Like
2

Hey @ying_wang since you were there author of that blog post, I thought maybe you have some ideas? Thanks!

3

Hi @m0ltar

Please update the event pattern rule like below (source first and then detail-type ) and try . And ensure you are using Custom Pattern with prefix event matching for event method.

{
“source”: [“aws.quicksight”],
“detail-type”: [“AWS API Call via CloudTrail”],
“detail”: {
“eventSource”: [“quicksight.amazonaws.com”],
“eventName”: [“CreateGroup”]
}
}

image
image1454Ă—870 73 KB

1 Like
4

@apjvinod Thank you for your suggestion. However, ordering in JSON does not matter. Also, this JSON is produced by CDK, and I have no control over it. If AWS cards about prop ordering, then I think we have a much bigger issue, and this certainly needs to be documented by CloudTrail.

5

@m0ltar You are right its works without ordering as well, think you might need to check the destination/target in eventbridge rule. Can you try changing target to SNS email topic and check by creating new QuickSight group. Just to isolate the problem is on the triggering event or at the target side .

1 Like