Setting Up AWS EventBridge for Cross-Region IAM Event Notifications

AWS EventBridge is a serverless event bus service that simplifies event-driven architectures. In this guide, we’ll explore how to leverage EventBridge with a cross-region event bus to overcome the regional limitations associated with IAM (Identity and Access Management) events. This setup will enable you to capture and respond to IAM events seamlessly across AWS regions.

Use Case: Cross-Region IAM Event Notifications with AWS EventBridge

AWS CloudWatch Events are powerful, but they are region-specific, posing challenges when attempting to capture IAM events. It’s essential to note that IAM is a global service, and the IAM events are only available in the us-east-1 region. By using AWS EventBridge with a cross-region event bus, we can create a scalable and efficient solution for cross-region IAM event notifications.

Challenge:

• CloudWatch Events are limited to the region in which they are created.

• IAM events are only available in the us-east-1 region, posing challenges for cross-region event management.

Solution:

• Utilize AWS EventBridge with a cross-region event bus for seamless IAM event notifications across regions.

Prerequisites

1. AWS Account: Ensure you have an AWS account and the necessary permissions to set up EventBridge, Lambda functions, and SNS topics.

2. Lambda Function: Create a Lambda function that will be triggered by EventBridge and will be responsible for sending SNS email notifications.

3. SNS Topic: Set up an SNS topic that will be used to send email notifications.

4. CloudTrail: The CloudTrail must be enabled in us-east-1 region.

Step 1: Create a Lambda Function

Create a Lambda function at any region that you want. For this example, the Lambda function is deployed in ap-southeast-1. This Lambda will invoke an SNS topic at the same region to notify through email.

NOTE: You can refer to this page to use the same Lambda code used in this article.

Step 2: Create an SNS Topic

Create an SNS Topic at the same region where the Lambda function is deployed. You must also create an email subscription and confirm the email address endpoint that will receive the notification:

Step 3: Set Up EventBridge Rule in N. Virginia

For the event pattern, make sure that it is for the intended event only. In this case, we are only triggering the rule when there is an API call for the CreateUser IAM event.

Select Event bus in a different account or Region on the target page. Paste the ARN of the event bus. In this solution, we are using the default event bus of the ap-southeast-1 region.

Step 4: Set up the EventBridge rule invoking the Lambda

Create an event rule to the same region as your Lambda or, in this case, ap-southeast-1.

On the target page, select the Lambda created from step 1.

Step 5: Test the Setup

Create a test IAM user and confirm if an email about the event is received.

Conclusion

By utilizing AWS EventBridge with a cross-region event bus, you’ve successfully established a scalable solution for cross-region IAM event notifications. This approach allows you to capture and respond to IAM events seamlessly across different AWS regions, providing flexibility and centralized management.

References:

Send a notification when an IAM user is created – AWS Prescriptive Guidance

Sending and receiving Amazon EventBridge events between AWS Regions – Amazon EventBridge