I've set up an SNS topic that notifies through an email. It's working when I ask to test it through the AWS console. It sends a test email.
I've set up an EventBridge rule that should trigger when security group related actions are executed. I've set the target for that rule to be the SNS topic i described above. But when I make changes to my security groups (through the AWS console or through API calls), no emails are sent.
Can someone look into my configuration and tell me what else I can look into?
Thanks in advance!
You need to have trail enabled for EB to detect API events. From docs:
To record events with a detail-type value of AWS API Call via CloudTrail, a CloudTrail trail with logging enabled is required.
Related
I can see that an event is being fired by the doppler user, but the rule is not getting triggered for some reason I don't know how to debug.
Event fired:
Rule pattern:
I have this simple rule to catch updates to the secrets manager, I can see secrets are being updated and the event being fired, why would my rule not be fired? How could I debug this?
You are creating a rule with detail-type of AWS API Call via CloudTrail. In order for these events to be picked up, you must create a CloudTrail Trail:
Form the AWS documentation:
To record events with a detail-type value of AWS API Call via CloudTrail, a CloudTrail trail with logging enabled is required.
2 weeks back, I saw a notification in AWS saying, the one of the 3 AWS EC2 instance will be stopped because of the underlying hardware cause. I almost missed the dead line as I didn't the notification via email. Is there a way get these notification via email?
It would be much better if I can get the notifications using cloud watch to my email.
If you're on Business or Enterprise Support, AWS provides a solution named "AWS Health Aware" built on top of AWS Health API, it does exactly what you're after sends you notifications via several methods including emails regarding outages and planning maintenance that affect your account(s).
If you're on a Basic support plan you can easily built something similar yourself using based on [AWS Health events][2]
This is an example of capturing AWS Health events via EventBridge so they can be further send to a lambda or SNS
https://docs.aws.amazon.com/health/latest/ug/cloudwatch-events-health.html
What I've done in the is following:
Capturing AWS Health events via EventBridge in spoke accounts and forward them to the event bus in my hub account
In the hub account I would subscribe a lambda function for all events with source "aws.health" and then send email or slack message whatever works for you.
I think Amazon EventBridge is what you are looking for. With EventBridge you can detect and react to different events such as EC2 instances scheduled for updates. You can, for example, create a rule for detecting a specific health event and in the target section choose to receive an email through SNS or invoke a CloudWatch log group, etc. Read more here.
I'm pretty new to AWS but I did some research about my issue and I couldn't find an answer anywhere so hopefully someone can help me with this.
I would like to be notified on Slack whenever someone logs in with a Root account on any of my AWS accounts. I have set up Cloudtrail at the Organisation level to monitor cloudtrail logs on all my AWS account. I have set up a Cloudwatch alarm to trigger whenever a root account is used, the alarm is then sent to a SNS topic that sends it to a Lambda that triggers a message to Slack.
All of this is working fine. However, the message I receive from SNS is basically the following: The alarm (root_login) has been trigerred
Ideally I would want to receive the Cloudwatch event that shows me more information like the IP Address of the user, the AWS account where it occured, etc...
Basically I would like to receive the Cloudwatch event log to the lambda instead of the Cloudwatch alarm trigger. Is that something that is possible?
Thanks
Yes that is possible. Here are some instructions from the AWS site on the aws-sns-to-slack-publisher. The page contains the steps you need to take to deploy .
Here is an example of publishing a health event to slack.
You will ofcourse need to modify the code to meet your requirements.
Is there a way to find out if there is a change made to any of the IAM resources(policies, users, roles) and trigger an SNS topic other than AWS Config recording. AWS config recording is already configured to send SNS alarm to security team, and i want to have another recording just for IAM resources. please let me know.
Amazon CloudWatch Events can send notifications when particular API calls are made, and it can send Amazon SNS messages.
See: Creating a CloudWatch Events Rule That Triggers on an Event - Amazon CloudWatch Events
I am trying to receive an update when a new EC2 security group is created. Haven't had much luck. There have been a lot of resources online however they don't deal with what I'm trying to do. All I need is an SNS notification when a new security group is created for some reason this is proving harder than it should.
Any suggestions on how I may be able to get this to work?
Thanks
The AWS Config service should serve this purpose perfectly.
It allows you to 'listen' for changes on certain (or all) types of resources and perform certain actions in response.
In your situation you could set up listeners for EC2:SecurityGroup events and have these events trigger notifications being sent to an SNS endpoint of your choice.
See some of the docs on streaming AWS Config events to SNS here.
Three are two services of interest:
Amazon CloudWatch Events can use rules to trigger an action when something happens (eg a Security Group is created)
Amazon Config keeps track of historical configurations
For your use-case, I would recommend an Amazon CloudWatch Events Rule:
Service Name: EC2
Event Type: AWS API Call via CloudTrail
Specific Operation: CreateSecurityGroup
Add Target: Specify an SNS Topic to receive the notification