Cloudwatch 事件规则侦听具有特定键路径的 s3 存储桶

Question

Is there a way to listen to an s3 bucket but only inside a specific "folder" so for instance if i had a folder named input i would say listen on "s3://bucket-name/folder1/*"? Right now it seems that you can only listen to the entire bucket.My issue is that I want to use the same bucket to trigger CloudWatch based on specific key path, and of course all cloudwatch rules will be triggered. This is my flow: CloudTrail (monitor s3://bucket/path) -> CloudWatch (will have an Event Rule for any PUT in that s3://bucket/path) trigger-> StepFunction-> LambdaFunctions I also tried to restrict this from CloudWatch role to give permissions only to that specific S3 bucket path without luck. This is my event rule:

{ "source": [ "aws.s3" ], "detail-type": [ "AWS API Call via CloudTrail" ], "detail": { "eventSource": [ "s3.amazonaws.com" ], "eventName": [ "PutObject" ], "requestParameters": { "bucketName": [ " bucketname" ] } } }

Is there any workaround?

Answer 1

As of the date of this writing, I do not currently know of a way to accomplish ON THE RULE. There could be a workaround on the rule but I have not found it...

...HOWEVER: This can be accomplished by using CloudTrail .

1. Remove the key from the event rule object you have, and keep the bucket name
2. Go to CloudTrail. If all data events are turned on, disable them and created your own trail.
3. In CloudTrail, create a new Trail. Specify object or bucket level operations
4. Enable S3 Data events - ASSUMING you want to listen for putObject or similar
5. specify your bucket, AND when it says Individual bucket selection, type in the bucket name AND the path you want to monitor. bucketname/folder1/folder2
6. specify whether you want read and write actions to be logged to the trail.

Now you have a log trail for that path only. The cloudwatch rule, or eventBridge rule, can now specify the bucket, and whatever operations you want to monitor.

Answer 2

try adding

"requestParameters": { "bucketName": [ " bucketname" ],"key":["folder1"] }

could be work.