Cloudwatch Event Rule not supporting IAM events

user_9327437 0
Viewed 361

I'm attempting to set up a Cloudwatch Event Rule to notify on any AWS IAM actions like DeleteUser or CreateUser. But when I tried to create an event pattern I couldn't find IAM in the service Name list even though when I searched in the AWS documentation i cant's find a mention of IAM not being supported by Cloudwatch event rules. So I tried to create a custom event but i didn't receive any email from SNS (my target), and yes I made sure cloudwatch has permissions to invoke SNS as we already have other working events, any idea on why this is not working ?

{
   "source":[
      "aws.iam"
   ],
   "detail-type":[
      "AWS API Call via CloudTrail"
   ],
   "detail":{
      "eventSource":[
         "iam.amazonaws.com"
      ],
      "eventName":[
         "CreateUser",
         "DeleteUser"
      ]
   }
}
amazon-cloudtrail amazon-iam aws-event-bridge amazon-web-services
4 Answers

I figure it out, IAM emits cloudtrail events only in us-eas-1 and I'm using a different region, it worked when I created the Cloudwatch event in N. Virgenia

user_93274370

The source parameter needs to be "aws.cloudtrail" not "aws.iam".

user_130700

IAM policy is a global service. It can only report in US-East-1(N.Virginia).

user_66355130

I have same exact config and the region is same as well but creating a new user still don't trigger the event as there is event in clouldtrail as well as in the monitoring of the event rule created. I see that they say in document that cloudtrail has to be enabled but when I create a rule for security group modification which is ec2 events then it is working fine but not with iam one. Is there any permission that I am missing for aws events to send logs to clould trail , if so how did you guys resolved it.

user_99754530
Related