AWS Cloudwatch不会在API调用上触发

Question

I am trying to make a rule trigger on any API call for creation, but I haven't had any success.

I have another rule that triggers whenever and ec2 instance is running which works, but this rule does not trigger for RunInstances although I see the cloudtrail logs with RunInstances in the API log.

I have made a CloudWatch log from the cloudtrail and see the events that should be triggering it, but they don't. Is there a step I am missing? What are the necessary components to have CloudWatch properly trigger on API calls?

The rule mentioned:

 {
      "source": [
        "aws.cloudtrail"
      ],
      "detail-type": [
        "AWS API Call via CloudTrail"
      ],
      "detail": {
        "eventSource": [
          "cloudtrail.amazonaws.com"
        ],
        "eventName": [
          "CreateUserPool",
          "CreateImage",
          "CreateCacheCluster",
          "RunInstances",
          "CreateActivation",
          "RunJobFlow ",
          "CreateVault",
          "CreateDeliveryStream",
          "CreateStream",
          "CreateCluster",
          "CreateDBInstance",
          "CreateHostedZone",
          "CreateBucket",
          "CreateLaunchConfiguration",
          "CreateStack",
          "CreateEnvironment",
          "CreateWorkspaces"
        ]
      }
    }

To add more detail here is the other rule I used to test CloudWatch

{
  "source": [
    "aws.ec2"
  ],
  "detail-type": [
    "EC2 Instance State-change Notification"
  ],
  "detail": {
    "state": [
      "running"
    ]
  }
}

This is the log of the startInstances and the following Lambda function running.

Cloudtrail of the the lambda function specifically which functions normally.

Here is the API call which should also initiate it according to the rule, but it does not.

Hopefully these images make it clearer as to what I am having trouble with.

PS I didn't know how much info I should consider confidential, so I over censored

Answer 1

I misunderstood the rule I created. I thought "AWS API calls from Cloudtrail" when using the cloudtrail Service meant all the information stored in Cloudtrail. That does not seem to be the case.

As I mention in my comment, I am looking for other solutions for my problem, but I will make a separate question for that. Thanks!