Skip to content

Instantly share code, notes, and snippets.

@jbesw
Last active July 22, 2022 08:19
Show Gist options
  • Save jbesw/08469b18bc45eed1f4b2c0783d132f5d to your computer and use it in GitHub Desktop.
Save jbesw/08469b18bc45eed1f4b2c0783d132f5d to your computer and use it in GitHub Desktop.
EventBridge Rule for Logging to CloudWatch Logs
AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: EventBridge Rule Test
Resources:
CFNLogGroup:
Type: AWS::Logs::LogGroup
Properties:
RetentionInDays: 3
LogGroupName: '/aws/events/eventbridgeLog'
MyALLRule:
Type: AWS::Events::Rule
Properties:
Description: Collects everything
EventPattern:
account:
- "123412341234"
RoleArn: !GetAtt EBAllRole.Arn
Targets:
- Id: 'CloudwatchLogsTarget'
Arn: !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:${CFNLogGroup}"
EBAllRole:
Type: "AWS::IAM::Role"
Properties:
AssumeRolePolicyDocument:
Version: "2012-10-17"
Statement:
-
Effect: "Allow"
Principal:
Service: "events.amazonaws.com"
Action:
- "sts:AssumeRole"
Policies:
- PolicyName: AllowAllEventsToBeLogged
PolicyDocument:
Version: '2012-10-17'
Statement:
Effect: Allow
Action:
- logs:CreateLogStream
- logs:PutLogEvents
Resource: '*'
@jbesw
Copy link
Author

jbesw commented Oct 2, 2020

This creates an EventBridge rule with permission to log everything from a single AWS account - update the account # on line 18 before deploying. Questions? Contact @jbesw.

@RawQD
Copy link

RawQD commented Oct 8, 2020

Hi mate,

Hope you are doing well !!

I am trying achieve exact configuration using terraform but getting an error Error: Updating CloudWatch Event Target failed: ValidationException: RoleArn is not supported for target . It seems it doesn't understand Role ARN, any idea why?

@jbesw
Copy link
Author

jbesw commented Oct 8, 2020

Hi! I don't believe it's supported in Terraform yet, but looking at this issue, it seems support could be coming by the end of the month: hashicorp/terraform-provider-aws#9330.

@bradwood
Copy link

bradwood commented Apr 3, 2022

Hi all, I am trying to do the same as @RawQD -- recreate this setup in terraform -- I tried setting the RoleArn on the terraform rule rather than the target also, after getting a similar error -- no joy :-/

Any suggestions would be gratefully appreciated.

@blinkylights23
Copy link

Hi @jbesw! I'm trying to do this with a Rule with a specific EventBusName, but it doesn't seem to be working (no log streams created, no logs).

Is there something different about how custom buses work that affects log delivery? Is the custom bus the reason you're using an AWS::Logs::ResourcePolicy here instead of this Role-based permission ☝️ ?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment