用于区域外创建的Cloudwatch事件

Question

我正在尝试创建一个自动修复过程，该过程将停止/删除在eu-central-1区域之外创建的任何VPC、Cloudformation Stack、VPC、Lambda、Internet Gateway或EC2。我的第一步是对CloudWatch事件规则进行参数化，以检测前面提到的任何事件。

{
  "source": [
    "aws.cloudtrail"
  ],
  "detail-type": [
    "AWS API Call via CloudTrail"
  ],
  "detail": {
    "eventSource": [
      "ec2.amazonaws.com",
      "cloudformation.amazonaws.com",
      "lambda.amazonaws.com"
    ],
    "eventName": [
      "CreateStack",
      "CreateVpc",
      "CreateFunction20150331",
      "CreateInternetGateway",
      "RunInstances"
    ],
    "awsRegion": [
      "us-east-1",
      "us-east-2",
      "us-west-1",
      "us-west-2",
      "ap-northeast-1",
      "ap-northeast-2",
      "ap-south-1",
      "ap-southeast-1",
      "ap-southeast-2",
      "ca-central-1",
      "ap-south-1",
      "eu-west-1",
      "eu-west-2",
      "eu-west-3"
      "sa-east-1"
    ]
  }
}

目前，该事件应该只触发一个SNS主题，该主题将向我发送一封电子邮件，但将来会有一个lambda字体来进行修复。

不幸的是，当我在另一个地区（比如eu-west-1）创建Internet网关时，并没有发出通知。如果我想设置警报，该事件也不会出现，但它会出现在CloudWatch事件中）。

知道我的事件配置有什么问题吗？

Answer 1

好吧，我想出来了。即使通知来自CloudTrail，事件的来源也会更改。因此，“源”参数应为：

"source": [
    "aws.cloudtrail",
    "aws.ec2",
    "aws.cloudformation",
    "aws.lambda"
  ]