EventBridge events for IPAM Pool CIDR Allocation

There are a couple of important points to consider here that may help you solve this more effectively:

1. Fix the source Field in Your EventBridge Rule

Your event pattern has "source": ["aws.cloudtrail"], but for CloudTrail-based API call events in EventBridge, the source field should match the service that made the API call, not CloudTrail itself. Since IPAM is part of the EC2 service, update your pattern to:

{
  "source": ["aws.ec2"],
  "detail-type": ["AWS API Call via CloudTrail"],
  "detail": {
    "eventSource": ["ec2.amazonaws.com"],
    "eventName": ["AllocateIpamPoolCidr", "ReleaseIpamPoolAllocation"]
  }
}

2. LZA May Not Call IPAM APIs Directly

When LZA creates a VPC with an IPAM pool association, the actual CIDR allocation may happen implicitly as part of the CreateVpc or AssociateVpcCidrBlock API call, rather than as a separate AllocateIpamPoolCidr call.

Check your CloudTrail logs (CloudTrail Console > Event History, filter by event source ec2.amazonaws.com) for the exact eventName that appears when a VPC is created through LZA. You may find that you need to match on:

"eventName": ["CreateVpc", "AssociateVpcCidrBlock"]

The allocated CIDR information will be available in detail.responseElements, which your Lambda can parse and forward to the on-prem IPAM.

3. Alternative: Polling-Based Approach

If EventBridge-based real-time capture proves unreliable, consider a polling architecture instead:

• Use EventBridge Scheduler (e.g., every 5 minutes) to invoke a Lambda function.
• In the Lambda, call the GetIpamPoolAllocations API for each IPAM pool to retrieve current allocations.
• Track already-synced allocations in a DynamoDB table and only push deltas to the on-prem IPAM.

This approach is more resilient since you won't miss allocations due to event delivery issues.

4. Alternative: AWS Config Change Tracking

AWS Config tracks VPC CIDR changes as configuration items. You can set up:

• AWS Config to monitor AWS::EC2::VPC resource changes.
• A custom Config rule with a Lambda function that triggers whenever a VPC's CIDR configuration changes.

The configuration item will include the CIDR block details, which you can then push to your on-prem IPAM. This approach is more reliable because it operates on the actual resource state rather than depending on specific API call names.