I am trying to have a Lambda to trigger when a secret in aws Secrets Manager is rotated. So I am trying to use Cloudtrail for this. I am trying to follow this AWS documentation The documentation doesn't seem to…
I have an EventBridge rule that looks like this: { "source": ["redshift.amazonaws.com"], "detail-type": ["AWS API Call via CloudTrail"], "detail": { "eventSource": ["redshift.amazonaws.com"], "eventName": ["CreateCluster"], "requestParameters": { "clusterIdentifier": ["some-redshift-cluster"] } } } As you can see I want to invoke that…
My ultimate goal is to build an workflow whereby we can collect Quicksight related events and then visualize them in Quicksight itself (basically to see dashboard/user usage). This is all helpfully described on the AWS Blog (https://aws.amazon.com/blogs/big-data/building-an-administrative-console-in-amazon-quicksight-to-analyze-usage-metrics/) My question is…
I'm currently trying to monitor the EKS Node group status, sometimes my node groups show degraded and I want a CloudWatch alert whenever the status is in a Degraded state, I checked CloudWatch Metrics there are no standard metrics, and…
I'm creating a cloudtrail using terraform. The problem is my source bucket keeps changing after 3 months. Now I want to give the dynamic S3 bucket value for field_selector. I'm doing something like this: resource "aws_cloudtrail" "test" { name =…
I'm just trying to create fully functional alarm that will change state if there's any IAM Policies changes will be made. Create an S3 Bucket for Cloudtrail logs. Create trail in Cloudtrail. Add Metric filter: {($.eventName=DeleteGroupPolicy)||($.eventName=DeleteRolePolicy)||($.eventName=DeleteUserPolicy)||($.eventName=PutGroupPolicy)||($.eventName=PutRolePolicy)||($.eventName=PutUserPolicy)||($.eventName=CreatePolicy)||($.eventName=DeletePolicy)||($.eventName=CreatePolicyVersion)||($.eventName=DeletePolicyVersion)||($.eventName=AttachRolePolicy)||($.eventName=DetachRolePolicy)||($.eventName=AttachUserPolicy)||($.eventName=DetachUserPolicy)||($.eventName=AttachGroupPolicy)||($.eventName=DetachGroupPolicy)} Create Alarm for this…
I got a requirement to send an alert email when an IAM user fails to login 3 times consecutively. What is the best practice to approach this?. I did research a lot and I was getting a lot saying: "listen…
I am trying to create a trail in Cloudtrail logging to S3 bucket but I am getting following error: Error: Error creating CloudTrail: InsufficientEncryptionPolicyException: Insufficient permissions to access S3 bucket $BUCKET_NAME or KMS key arn:aws:kms:eu-west-1:$ACCOUNT_ID:key/1234567890. Terraform is able to create…