ReadOnly events are not reflecting in Cloudwatch log group from Event bridge

1

Hi, I configured this event pattern

{
  "$or": [{
    "detail": {
      "eventType": ["AwsApiCall", "AwsConsoleSignIn", "AwsServiceEvent", "AwsConsoleAction", "AwsCloudTrailInsight"],
      "eventName": [{
        "anything-but": ["GetObject", "CreateLogStream"]
      }]
    }
  }, {
    "detail-type": ["Inspector2 Finding", "Inspector2 Coverage"]
  }]
}

For some reason Im not reciving read only events except a few(LookupEvents, AssumeRole, etc...) but, im not recieving any of the Describe*, List* (basically any read only management events).

Earlier, I had no issues related to read or write events. Everything was working as expected.

I also have tested the event pattern by entering a pattern from cloudwatch to test the pattern

I have a trail with all read, write, management as well as data events enabled, but still its the same issue.

I also have updated to event pattern to capture everything starts with accountID

{
  "account": ["941086XXXXXX"]
}

Even after updating, its still the same.

What I need to do to solve this problem? Thanks!

回答なし

ログインしていません。 ログイン 回答を投稿する。

優れた回答とは、質問に明確に答え、建設的なフィードバックを提供し、質問者の専門分野におけるスキルの向上を促すものです。

質問に答えるためのガイドライン

関連するコンテンツ