EventBridge Rule for Logging to CloudWatch Logs

gistfile1.txt

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: EventBridge Rule Test

Resources:
  CFNLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      RetentionInDays: 3
      LogGroupName: '/aws/events/eventbridgeLog'

  MyALLRule:
    Type: AWS::Events::Rule
    Properties: 
      Description: Collects everything
      EventPattern:
        account: 
        - "123412341234"
      RoleArn: !GetAtt EBAllRole.Arn
      Targets:
        - Id: 'CloudwatchLogsTarget'
          Arn: !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:${CFNLogGroup}"
          
  EBAllRole:
    Type: "AWS::IAM::Role"
    Properties: 
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - 
            Effect: "Allow"
            Principal:
              Service: "events.amazonaws.com" 
            Action: 
              - "sts:AssumeRole"
      Policies: 
        - PolicyName: AllowAllEventsToBeLogged
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              Effect: Allow
              Action:
              - logs:CreateLogStream
              - logs:PutLogEvents
              Resource: '*'

This creates an EventBridge rule with permission to log everything from a single AWS account - update the account # on line 18 before deploying. Questions? Contact @jbesw.

Hi mate,

Hope you are doing well !!

I am trying achieve exact configuration using terraform but getting an error Error: Updating CloudWatch Event Target failed: ValidationException: RoleArn is not supported for target . It seems it doesn't understand Role ARN, any idea why?

Hi! I don't believe it's supported in Terraform yet, but looking at this issue, it seems support could be coming by the end of the month: hashicorp/terraform-provider-aws#9330.

Hi all, I am trying to do the same as @RawQD -- recreate this setup in terraform -- I tried setting the RoleArn on the terraform rule rather than the target also, after getting a similar error -- no joy :-/

Any suggestions would be gratefully appreciated.

Hi @jbesw! I'm trying to do this with a Rule with a specific EventBusName, but it doesn't seem to be working (no log streams created, no logs).

Is there something different about how custom buses work that affects log delivery? Is the custom bus the reason you're using an AWS::Logs::ResourcePolicy here instead of this Role-based permission ☝️ ?