如何为 AssumeRole 事件配置 AWS Cloudwatch Events（以触发 SNS 通知）

Question

I am trying to configure a Cloudwatch Event Rule (to trigger an SNS notification) for whenever someone assumes a particular role:

{
  "detail": {
    "eventName": [
      "AssumeRole"
    ],
    "eventSource": [
      "sts.amazonaws.com"
    ],
    "requestParameters": {
      "roleArn": [
        "arn:aws:iam::0000:role/the_role_name"
      ]
    }
  },
  "detail-type": [
    "AWS API Call via CloudTrail"
  ]
}

Where 0000 is the account id and the_role_name is the role I want to alert on.

This is failing to trigger any notification, however when I search in Cloudtrail Insights for the events:

filter eventName = 'AssumeRole'
| filter requestParameters.roleArn =~ 'the_role_name'
| sort @timestamp desc
| display @timestamp, requestParameters.roleSessionName, eventName, requestParameters.roleArn, userAgent, sourceIPAddress

I DO get results that SHOULD have triggered the rule:

requestParameters.roleSessionName eventName   requestParameters.roleArn
my_username                       AssumeRole  arn:aws:iam::0000:role/the_role_name
...

For the sake of trying to dumb things down and catch a broader set of events, I also tried the following Rule (which would catch all AssumeRole events to any role):

{
  "detail": {
    "eventName": [
      "AssumeRole"
    ]
  },
  "detail-type": [
    "AWS API Call via CloudTrail"
  ]
}

This rule also is failing to trigger.

Does anyone have ideas on how to configure Cloudwatch Event Rules to trigger on AssumeRole events?

I read through this related question (which is trying to achieve something similar), but it did not have a solution: AWS CloudWatch Events trigger SNS on STS role assuming for cross account

Answer 1

First of all make sure whether the event is invoked or not by checking the monitoring metrics for the rule. It is possible that it is triggered, but it fails to invoke the target. In this case, you should check your IAM policies.

If it is not triggered, there could be issues with trail delivery to Cloudwatch Logs. Make sure that you created a trail in the same region, which delivers events to Cloudwatch Logs.

I've the following rule in us-east-1 region, which works fine:

{
  "detail-type": [
    "AWS API Call via CloudTrail"
  ],
  "detail": {
    "eventSource": [
      "sts.amazonaws.com"
    ],
    "eventName": [
      "AssumeRole"
    ]
  },
  "source": [
    "aws.sts"
  ]
}