3.3.1.3. Integrating AWS Event Sources (AWS Health, EventBridge, CloudTrail)

3.3.1.3. Integrating AWS Event Sources (AWS Health, EventBridge, CloudWatch)

Integrating event sources means building a unified incident detection pipeline where any anomaly — infrastructure, security, or application — routes to the right responder.

Unified event pipeline architecture:

AWS Health Events      ─┐
CloudWatch Alarms      ─┤
GuardDuty Findings     ─┤→ EventBridge ─→ Step Functions (Incident Router)
Config Compliance      ─┤                  ├→ PagerDuty (P1 incidents)
CloudTrail Events      ─┤                  ├→ Slack (P2 notifications)
Custom App Events      ─┘                  ├→ Lambda (auto-remediation)
                                           └→ S3 (incident archive)

EventBridge rule patterns for incident classification:

{
  "source": ["aws.guardduty"],
  "detail-type": ["GuardDuty Finding"],
  "detail": {
    "severity": [{"numeric": [">=", 7]}]
  }
}

Cross-account event aggregation: EventBridge supports forwarding events between accounts. Application accounts forward events to a central operations account where all alerting and automation runs. The pieces: a rule in each source account whose target is the central bus ARN, with an IAM role on that target allowing events:PutEvents to the bus (required for cross-account bus targets created since March 2, 2023; the console creates it), and a resource-based policy on the central bus allowing events:PutEvents from those accounts (or the whole org via aws:PrincipalOrgID). If events from some accounts never arrive, check that policy first. A rule can have up to five targets, so one rule can send to a security bus and an analytics bus in parallel. A rule sends every matching event to all of its targets, so when sources (or severity tiers) need different responses, use one rule per pattern, each with its own targets.

AWS Health + EventBridge integration: Health events arrive automatically in EventBridge. Create rules to:

• Alert on service issues affecting your region
• Trigger DR failover when your primary region has issues
• Notify teams of upcoming maintenance windows

Exam Trap: EventBridge rules match events based on the event pattern — and the matching is exact unless you use prefix, suffix, or numeric matching. A rule matching "source": ["aws.ec2"] will NOT match "source": ["aws.ec2.spot"]. These are different sources. If the exam describes a rule that isn't firing, check whether the source and detail-type values match exactly.