This gist contains the code to decode the CloudWatch Logs data from lambda-function.py, which is part of the blog-amazon-macie-custom-eventbridge-events repository.

blog-amazon-macie-custom-eventbridge-eventbridge_lambda-function-decode-cwlogs-data.py

def decode_cloudwatch_logs_data(event):
    """
    Decode and decompress the CloudWatch Logs data from the event.

    CloudWatch Logs sends data to the subscription filter in the following format:
    - Base64 encoded
    - Gzip compressed
    - JSON formatted

    Parameters:
        event (dict): The raw Lambda event from CloudWatch Logs

    Returns:
        dict: The decoded log data containing logGroup, logStream, and logEvents
              Returns None if decoding fails
    """
    try:
        # The CloudWatch Logs data is in the 'awslogs' -> 'data' field
        compressed_data = base64.b64decode(event["awslogs"]["data"])
        decompressed_data = gzip.decompress(compressed_data)
        log_data = json.loads(decompressed_data)

        logger.info("Successfully decoded CloudWatch Logs data")
        return log_data

    except KeyError as e:
        logger.error(f"Missing expected key in event: {str(e)}")
        return None
    except Exception as e:
        logger.error(f"Error decoding CloudWatch Logs data: {str(e)}")
        return None