ReadOnly events are not reflecting in Cloudwatch log group from Event bridge

1

Hi, I configured this event pattern

{
  "$or": [{
    "detail": {
      "eventType": ["AwsApiCall", "AwsConsoleSignIn", "AwsServiceEvent", "AwsConsoleAction", "AwsCloudTrailInsight"],
      "eventName": [{
        "anything-but": ["GetObject", "CreateLogStream"]
      }]
    }
  }, {
    "detail-type": ["Inspector2 Finding", "Inspector2 Coverage"]
  }]
}

For some reason Im not reciving read only events except a few(LookupEvents, AssumeRole, etc...) but, im not recieving any of the Describe*, List* (basically any read only management events).

Earlier, I had no issues related to read or write events. Everything was working as expected.

I also have tested the event pattern by entering a pattern from cloudwatch to test the pattern

I have a trail with all read, write, management as well as data events enabled, but still its the same issue.

I also have updated to event pattern to capture everything starts with accountID

{
  "account": ["941086XXXXXX"]
}

Even after updating, its still the same.

What I need to do to solve this problem? Thanks!

已提问 3 个月前411 查看次数
没有答案

您未登录。 登录 发布回答。

一个好的回答可以清楚地解答问题和提供建设性反馈,并能促进提问者的职业发展。

回答问题的准则

相关内容