Tutorial: Monitor important changes to your organization with Amazon EventBridge

Sign in to AWS as an administrator of the organization's management account and then open the CloudTrail console at https://console.aws.amazon.com/cloudtrail/.

On the navigation bar in the upper-right corner of the console, choose the US East (N. Virginia) Region. If you choose a different region, AWS Organizations doesn't appear as an option in the Amazon EventBridge configuration settings, and CloudTrail doesn't capture information about AWS Organizations.

In the navigation pane, choose Trails.

Choose Create trail.

For Trail name, enter My-Test-Trail.

Perform one of the following options to specify where CloudTrail is to deliver its logs:

Choose Next.

On the Choose log events page, in the Management events section, choose Read and Write.

Choose Next.

Review your selections and choose Create trail.

Open the AWS Lambda console at https://console.aws.amazon.com/lambda/.

If you are new to Lambda, choose Get Started Now on the welcome page; otherwise, choose Create function.

On the Create function page, choose Use a blueprint.

From the Blueprints search box, enter hello for the filter and choose the hello-world blueprint.

Choose Configure.

On the Basic information page, do the following:

1. For the Lambda function name, enter LogOrganizationEvents in the Name text box.

2. For Role, choose Create a new role with basic Lambda permissions. This role grants your Lambda function permissions to access the data it requires and to write its output log.

Edit the Lambda function code, as shown in the following example.

console.log('Loading function');

exports.handler = async (event, context) => {
    console.log('LogOrganizationsEvents');
    console.log('Received event:', JSON.stringify(event, null, 2));
    return event.key1;  // Echo back the first key value
    // throw new Error('Something went wrong');
};

This sample code logs the event with a LogOrganizationEvents marker string followed by the JSON string that makes up the event.

Choose Create function.

Open the Amazon SNS console at https://console.aws.amazon.com/sns/v3/.

In the navigation pane, choose Topics.

Choose Create new topic.

1. For Topic name, enter OrganizationsCloudWatchTopic.

2. For Display name, enter OrgsCWEvnt.

3. Choose Create topic.

Now you can create a subscription for the topic. Choose the ARN for the topic that you just created.

Choose Create subscription.

1. On the Create subscription page, for Protocol, choose Email.

2. For Endpoint, enter your email address.

3. Choose Create subscription. AWS sends an email to the email address that you specified in the preceding step. Wait for that email to arrive, and then choose the Confirm subscription link in the email to verify that you successfully received the email.

4. Return to the console and refresh the page. The Pending confirmation message disappears and is replaced by the now valid subscription ID.

Open the Amazon EventBridge console at https://console.aws.amazon.com/events/.

Set the console to the US East (N. Virginia) Region or information about Organizations is not available. On the navigation bar in the upper-right corner of the console, choose the US East (N. Virginia) Region.

For instructions on creating rules, see Getting started with Amazon EventBridge in the Amazon EventBridge user guide.

Open the CloudWatch console at https://console.aws.amazon.com/cloudwatch/.

In the navigation page, choose Logs.

Under Log Groups, choose the group that is associated with your Lambda function: /aws/lambda/LogOrganizationEvents.

Each group contains one or more streams, and there should be one group for today. Choose it.

View the log. You should see rows similar to the following.

Select the middle row of the entry to see the full JSON text of the received event. You can see all the details of the API request in the requestParameters and responseElements pieces of the output.

2017-03-09T22:45:05.101Z 0999eb20-051a-11e7-a426-cddb46425f16 Received event:
{
    "version": "0",
    "id": "123456-EXAMPLE-GUID-123456",
    "detail-type": "AWS API Call via CloudTrail",
    "source": "aws.organizations",
    "account": "123456789012",
    "time": "2017-03-09T22:44:26Z",
    "region": "us-east-1",
    "resources": [],
    "detail": {
        "eventVersion": "1.04",
        "userIdentity": {
            ...
        },
        "eventTime": "2017-03-09T22:44:26Z",
        "eventSource": "organizations.amazonaws.com",
        "eventName": "CreateOrganizationalUnit",
        "awsRegion": "us-east-1",
        "sourceIPAddress": "192.168.0.1",
        "userAgent": "AWS Organizations Console, aws-internal/3",
        "requestParameters": {
            "parentId": "r-exampleRootId",
            "name": "TestCWEOU"
        },
        "responseElements": {
            "organizationalUnit": {
                "name": "TestCWEOU",
                "id": "ou-exampleRootId-exampleOUId",
                "arn": "arn:aws:organizations::1234567789012:ou/o-exampleOrgId/ou-exampleRootId-exampeOUId"
            }
        },
        "requestID": "123456-EXAMPLE-GUID-123456",
        "eventID": "123456-EXAMPLE-GUID-123456",
        "eventType": "AwsApiCall"
    }
}

Check your email account for a message from OrgsCWEvnt (the display name of your Amazon SNS topic). The body of the email contains the same JSON text output as the log entry that is shown in the preceding step.

Use the CloudTrail console to delete the trail named My-Test-Trail that you created in step 1.

If you created an Amazon S3 bucket in step 1, use the Amazon S3 console to delete it.

Use the Lambda console to delete the function named LogOrganizationEvents that you created in step 2.

Use the Amazon SNS console to delete the Amazon SNS topic named OrganizationsCloudWatchTopic that you created in step 3.

Use the CloudWatch console to delete the EventBridge rule named OrgsMonitorRule that you created in step 4.

Finally, use the Organizations console to delete the OU named TestCWEOU that you created in step 5.