为什么 AWS EventBridge 规则不支持后缀匹配？

Question

Unlike EventBridge, S3 Events supports both Prefix and Suffix since 2015. Reference: S3 Documents

As at 2022 August, from the documentation of EventBridge , it supports only following filter types:

• Prefix matching
• Anything-but matching
• Numeric matching
• IP address matching -Exists matching

Why does EventBridge does not support Suffix filtering OR How I filter using Suffix when I use EventBridge?

My use case: If a file with particular extension added only then I would like the events to be created. This is possible if I use S3 Events. However we can not use EventBridge as rules doe not support suffix filtering.

There are work arounds ie the consumers can ignore the messages but that seems to be the hack in my scenarios.

Answer 1

Today AWS released a much-awaited feature of content filtering by enhancing the existing capabilities of an event-driven system.

To answer your question, now I think you can use the feature of suffix matching for this particular use case.

{
  "FileName": [ { "suffix": ".png" } ]
}

You can read more about it here.
https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-event-patterns-content-based-filtering.html#eb-filtering-suffix-matching

https://aws.amazon.com/about-aws/whats-new/2022/11/amazon-eventbridge-enhanced-filtering-capabilities/

Answer 2

For a temporary workaround, you can create an S3 bucket policy that restricts file upload to files with the desired file extension(s). In doing so, any file successfully uploaded to your bucket would conform to your file type requirements and trigger the notification.

For example:

{
"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "",
        "Effect": "Allow",
        "Principal": {
            "AWS": "arn:aws:iam::YourAccountId:root"
        },
        "Action": "s3:PutObject",
        "Resource": [
            "arn:aws:s3:::YourS3Bucket/*.webm",
            "arn:aws:s3:::YourS3Bucket/*.wav",
            "arn:aws:s3:::YourS3Bucket/*.ogg",
            "arn:aws:s3:::YourS3Bucket/*.mp4",
            "arn:aws:s3:::YourS3Bucket/*.mp3",
            "arn:aws:s3:::YourS3Bucket/*.flac",
            "arn:aws:s3:::YourS3Bucket/*.amr"
        ]
    },
    {
        "Sid": "",
        "Effect": "Deny",
        "Principal": "*",
        "Action": "s3:PutObject",
        "NotResource": [
            "arn:aws:s3:::YourS3Bucket/*.webm",
            "arn:aws:s3:::YourS3Bucket/*.wav",
            "arn:aws:s3:::YourS3Bucket/*.ogg",
            "arn:aws:s3:::YourS3Bucket/*.mp4",
            "arn:aws:s3:::YourS3Bucket/*.mp3",
            "arn:aws:s3:::YourS3Bucket/*.flac",
            "arn:aws:s3:::YourS3Bucket/*.amr"
        ]
    }
]

}

NOTE: The above policy would have an explicit deny. It is VERY important that you understand what your are writing in the policy or you could accidentally lock yourself out of your own bucket . (If you do, you can log in as root, delete the bucket policy and make the necessary edits)