Receiving read-only management events from Amazon services - Amazon EventBridge
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Receiving read-only management events from Amazon services

You can set up rules on your default or custom event bus to receive read-only management events from Amazon services via CloudTrail. Management events provide visibility into management operations that are performed on resources in your Amazon account. These are also known as control plane operations. For more information, see Logging management events in the CloudTrail User Guide.

For each rule on the default or custom event buses, you can set the rule state to control the types of events to receive:

  • Disable the rule so that EventBridge does not match events against the rule.

  • Enable the rule so that EventBridge matches events against the rule, except for read-only Amazon management events delivered through CloudTrail.

  • Enable the rule so that EventBridge matches all events against the rule, including read-only management events delivered through CloudTrail.

Partner event buses do not receive Amazon events.

Some things to consider when deciding whether to receive read-only management events:

  • Certain read-only management events, such as Amazon Key Management Service GetKeyPolicy and DescribeKey, or IAM GetPolicy and GetRole events, occur at a much higher volume than typical change events.

  • You may already be receiving read-only management events, if those events don't start with Describe, Get, or List. For example, events from the following Amazon STS APIs are change events, even thought they start with the verb Get:

    • GetFederationToken

    • GetSessionToken

    For a list of read-only management events that do not adhere to the Describe, Get, or List naming convention, by Amazon services, see Management events generated by Amazon services in EventBridge.

To create a rule that receives read-only management events using the Amazon CLI

  • Use the put-rule command to create or update the rule, using parameters to:

    • Specify that the rule belongs on the default event bus, or a specific custom event bus

    • Set rule state as ENABLED_WITH_ALL_CLOUDTRAIL_MANAGEMENT_EVENTS

    aws events put-rule --name "ruleForManagementEvents" --event-bus-name "default" --state "ENABLED_WITH_ALL_CLOUDTRAIL_MANAGEMENT_EVENTS"

Note

Enabling a rule for CloudWatch management events is supported through the Amazon CLI and Amazon CloudFormation templates only.

The following example illustrates how to match against specific events. Best practice is to define a dedicated rule for matching specific events, for clarity and ease of editing.

In this case, the dedicated rule matches the AssumeRole management event from Amazon Security Token Service. 

{
    "source" : [ "aws.sts" ],
    "detail-type": ["AWS API Call via CloudTrail"],
    "detail" : {
        "eventName" : ["AssumeRole"]
    }
}