We may fail to create a custom event pattern for the CloudWatch event rule when we try to capture certain events for AWS services with an Amazon CloudWatch event rule.

Here, at Bobcares, we assist our customers with several AWS queries as part of our AWS Support Services.

Today, let us see how to create a custom CloudWatch event pattern.

Create a custom event pattern for the CloudWatch event rule

In order to begin, our Support Techs recommend the most recent AWS CLI version.

Generally, events generate in a predefined JSON format and sent to Amazon CloudWatch Events by AWS services.

We can create rules that use event patterns to filter incoming events and then trigger a target.

Determine the JSON format of the incoming event

1. Initially, we create a CloudWatch Events rule with a simple event pattern. It must match all events for a specific service.

For Event Source, we can select Event Pattern.

For example, we can see all events by Amazon EC2 service using:

{
"source": [ "aws.ec2" ]
}

2. We attach a target to the rule, either with an SNS topic or CloudWatch Logs. As a result, we will receive all matched events through the SNS topic or CloudWatch Logs.

We receive the exact JSON event that was sent by a particular AWS service.  With it, we can create a custom event pattern.

In addition, we need to ensure we use the default setting for the input transformer of the CloudWatch Rule.

Create an event pattern in the same JSON format as the incoming event

In order to create a valid matching event pattern, we need to apply the following rules:

1. Any fields that we don’t specify in the event pattern will match automatically.
2. To match fields that are one level down in the JSON structure, we use curly brackets { }.
3. The string to match from the JSON event must be in square brackets [ ].

For example, here’s how to trigger an event based on every event sent by Amazon EC2 or Amazon DynamoDB:

{
"source": [ "aws.ec2", "aws.dynamodb" ]
}

To notify when a Type A record is created for a specific Amazon Route 53 hosted zone, we run:

The event sent by Route 53 to CloudWatch Events:

{
"version": "0",
"id": "d857ae5c-cc83-3742-ab88-d825311ee4e9",
"detail-type": "AWS API Call via CloudTrail",
"source": "aws.route53",
"account": "756022511916",
"time": "2019-12-05T16:50:53Z",
"region": "us-east-1",
"resources": [

],
"detail": {
"eventVersion": "1.05",
"userIdentity": {
"type": "AssumedRole",
"principalId": "AROAIVOJE6CTAWGSJQUP2:patsusha-Isengard",
"arn": "arn:aws:sts::756022511916:assumed-role/Admin/patsusha-Isengard",
"accountId": "756022511916",
"accessKeyId": "ASIA3ABTUBEWCHWLUGFI",
"sessionContext": {
"sessionIssuer": {
"type": "Role",
"principalId": "AROAIVOJE6CTAWGSJQUP2",
"arn": "arn:aws:iam::756022511916:role/Admin",
"accountId": "756022511916",
"userName": "Admin"
},
"webIdFederationData": {

},
"attributes": {
"mfaAuthenticated": "false",
"creationDate": "2019-12-05T16:28:27Z"
}
}
},
"eventTime": "2019-12-05T16:50:53Z",
"eventSource": "route53.amazonaws.com",
"eventName": "ChangeResourceRecordSets",
"awsRegion": "us-east-1",
"sourceIPAddress": "72.21.196.66",
"userAgent": "console.amazonaws.com",
"requestParameters": {
"hostedZoneId": "Z1RP9G2VYLRY8V",
"changeBatch": {
"changes": [
{
"action": "CREATE",
"resourceRecordSet": {
"type": "A",
"tTL": 300,
"resourceRecords": [
{
"value": "4.4.4.4"
}
],
"name": "test4.sushantpatil.us."
}
}
]
}
},
"responseElements": {
"changeInfo": {
"status": "PENDING",
"id": "/change/C271P4WIKN511J",
"submittedAt": "Dec 5, 2019 4:50:53 PM"
}
},
"additionalEventData": {
"Note": "Do not use to reconstruct hosted zone"
},
"requestID": "bbbf9847-96cb-45ef-b617-d535b9fe83d8",
"eventID": "74e2d2c8-7497-4292-94d0-348272dbc4f7",
"eventType": "AwsApiCall",
"apiVersion": "2013-04-01"
}
}

Event filter pattern to notify when a Type A record is created for the hosted zone:

{
"source": ["aws.route53"],
"detail": {
"eventSource": ["route53.amazonaws.com"],
"eventName": ["ChangeResourceRecordSets"],
"requestParameters": {
"hostedZoneId": ["Z1RP9G2VYLRY8V"],
"changeBatch": {
"changes":
{
"action": ["CREATE"],
"resourceRecordSet": {
"type": ["A"]
}
}
}
}
}
}

Test the event pattern using the AWS CLI

We can confirm the event pattern matches if the result is true when we run the test-event-pattern command.

Hence, we can identify the JSON events sent by the AWS service and facilitate the custom event pattern to capture specific events.

[Need help with the fix? We are here for you]

Conclusion

In short, we saw how our Support Techs go about creating a custom event pattern.