EventPattern Struct
Events in Amazon CloudWatch Events are represented as JSON objects. For more information about JSON objects, see RFC 7159.
Rules use event patterns to select events and route them to targets. A pattern either matches an event or it doesn't. Event patterns are represented as JSON objects with a structure that is similar to that of events.
It is important to remember the following about event pattern matching:
For a pattern to match an event, the event must contain all the field names listed in the pattern. The field names must appear in the event with the same nesting structure.
Other fields of the event not mentioned in the pattern are ignored; effectively, there is a
"*": "*"wildcard for fields not mentioned.The matching is exact (character-by-character), without case-folding or any other string normalization.
The values being matched follow JSON rules: Strings enclosed in quotes, numbers, and the unquoted keywords true, false, and null.
Number matching is at the string representation level. For example, 300, 300.0, and 3.0e2 are not considered equal.
For custom events, some optional properties are required. For more information, see Minimum information needed for a valid custom event.
Example
const myFunctionHandler = new lambda.Function(this, 'MyFunction', {
code: lambda.Code.fromAsset('resource/myfunction'),
runtime: lambda.Runtime.NODEJS_LATEST,
handler: 'index.handler',
});
const eventRule = cloudtrail.Trail.onEvent(this, 'MyCloudWatchEvent', {
target: new targets.LambdaFunction(myFunctionHandler),
});
eventRule.addEventPattern({
account: ['123456789012'],
source: ['aws.s3'],
});
Properties
accountoptionalstring[]accountoptionaltyping.List[str]accountoptionalList<String>Accountoptionalstring[]Accountoptional*[]*string#Default: No filtering on account
detailoptional{ [key: string]: any }detailoptionaltyping.Mapping[str, Any]detailoptionalMap<String, Object>DetailoptionalIDictionary<string, object>Detailoptional*map[string]interface{}#Default: No filtering on detail
detailTypeoptionalstring[]detail_typeoptionaltyping.List[str]detailTypeoptionalList<String>DetailTypeoptionalstring[]DetailTypeoptional*[]*string#Default: No filtering on detail type
Represents the "detail-type" event field.
idoptionalstring[]idoptionaltyping.List[str]idoptionalList<String>Idoptionalstring[]Idoptional*[]*string#Default: No filtering on id
This can be helpful in tracing events as they move through rules to targets, and are processed.
regionoptionalstring[]regionoptionaltyping.List[str]regionoptionalList<String>Regionoptionalstring[]Regionoptional*[]*string#Default: No filtering on region
resourcesoptionalstring[]resourcesoptionaltyping.List[str]resourcesoptionalList<String>Resourcesoptionalstring[]Resourcesoptional*[]*string#Default: No filtering on resource
notes
Inclusion of these ARNs is at the discretion of the service.
For example, Amazon EC2 instance state-changes include Amazon EC2 instance ARNs, Auto Scaling events include ARNs for both instances and Auto Scaling groups, but API calls with AWS CloudTrail do not include resource ARNs.
sourceoptionalstring[]sourceoptionaltyping.List[str]sourceoptionalList<String>Sourceoptionalstring[]Sourceoptional*[]*string#Default: No filtering on source
notes
All events sourced from within AWS begin with "aws." Customer-generated events can have any value here, as long as it doesn't begin with "aws." We recommend the use of Java package-name style reverse domain-name strings.
To find the correct value for source for an AWS service, see the table in AWS Service Namespaces. For example, the source value for Amazon CloudFront is aws.cloudfront.
timeoptionalstring[]timeoptionaltyping.List[str]timeoptionalList<String>Timeoptionalstring[]Timeoptional*[]*string#Default: No filtering on time
If the event spans a time interval, the service might choose to report the start time, so this value can be noticeably before the time the event is actually received.
versionoptionalstring[]versionoptionaltyping.List[str]versionoptionalList<String>Versionoptionalstring[]Versionoptional*[]*string#Default: No filtering on version