s3-event-notifications-eventbridge.yaml

AWSTemplateFormatVersion: '2010-09-09'
Description: >
  S3 Event Notifications to EventBridge

Resources:
  EventBucket:
    Type: AWS::S3::Bucket
    Properties:
      NotificationConfiguration:
        # New configuration to enable EventBridge for S3 Event Notifications
        EventBridgeConfiguration:
          EventBridgeEnabled: true

  # EventBridge rule to match against S3 events and route them to CloudWatch Logs
  EventBridgeRule:
    Type: AWS::Events::Rule
    Properties:
      EventPattern:
        source:
          - aws.s3
        detail-type:
          - Object Created
      RoleArn: !GetAtt WriteToCwlRole.Arn
      Targets:
        - Id: SendEventToSecurityAnalysisRule
          Arn: !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:${EventLog}"

  # CloudWatch Log group
  EventLog:
    Type: AWS::Logs::LogGroup

  # IAM role assumed by EventBridge to make calls to CloudWatch Logs
  WriteToCwlRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - events.amazonaws.com
            Action:
              - "sts:AssumeRole"
      Path: /
      Policies:
        - PolicyName: EventBridgeWriteToCWLogs
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - "logs:CreateLogGroup"
                  - "logs:CreateLogStreams"
                  - "logs:PutLogEvents"
                Resource:
                  - !GetAtt EventLog.Arn

  # Resource policy to allow EventBridge to call CloudWatch logs.
  CWLogsResourcePolicy:
    Type: AWS::Logs::ResourcePolicy
    Properties:
      PolicyName: "EventBridgeToCWLogs"
      PolicyDocument: !Sub 
      - >
        {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Sid": "EventBridgetoCWLogsPolicy",
              "Effect": "Allow",
              "Principal": {
                "Service": [
                  "delivery.logs.amazonaws.com",
                  "events.amazonaws.com"
                ]
              },
              "Action": [
                "logs:CreateLogStream",
                "logs:PutLogEvents"
              ],
              "Resource": [
                "${logArn}"
              ]
            }
          ]
        }
      - logArn: !GetAtt EventLog.Arn