How can I trigger a lambda when a log group is created in cloudwatch?

Question

How can I trigger a lambda when a log group is created in cloudwatch? What I am thinking the easiest way to do is to create a cloudwatch rule to send cloudtrail event to lambda. Is it reasonable to do? If yes, how can I filter out other events but only trigger lambda when a log group is created?

Answer 1

The only event type supported by CloudWatch Events (CWE) for CW Logs (CWL) is:

AWS API Call via CloudTrail

Therefore, you can catch the events of interests when you enabled CloudTrail (CT) trail . Once enable, API events would be available in CWE. Then, you would have to create CWE rule which captures CreateLogGroup API call. The rule would trigger your lambda function.

An example CWE rule could be:

{
  "source": [
    "aws.logs"
  ],
  "detail-type": [
    "AWS API Call via CloudTrail"
  ],
  "detail": {
    "eventSource": [
      "logs.amazonaws.com"
    ],
    "eventName": [
      "CreateLogGroup"
    ]
  }
}