0

Well the title says it all. What I am trying to achieve:

  • Have a Cloudwatch event rule checking for PutObject event in a Bucket from AWS Account X
  • When the objects are stored in the S3 bucket, the state machine in AWS Account Y needs to be triggered

But it is not working. As far as I know, buckets are worldwide and not account wide, and accordingly the AWS documentation here https://docs.aws.amazon.com/step-functions/latest/dg/tutorial-cloudwatch-events-s3.html we should only give the bucket name in the request parameters.

The bucket already contains a policy to give full access to this account where the Step Function state machine is, because the jobs I am running consist in getting data from that bucket, and that works fine. Only the trigger is not working.

My event pattern looks like this:

{
  "source": [
        "aws.s3"
      ],
  "detail-type": [
        "AWS API Call via CloudTrail"
      ],
  "detail": {
    "eventSource": [
      "s3.amazonaws.com"
        ],
      "eventName": [
          "PutObject"
        ],
      "requestParameters": {
          "bucketName": [
            "my-bucket-name"
          ]
       }
     }
}

Do I need some extra configuration?

NEW INFO:

I was forgetting something so I followed this tutorial: https://docs.aws.amazon.com/AmazonCloudWatch/latest/events/CloudWatchEvents-CrossAccountEventDelivery.html#WritingRulesThatMatchEventsFromAnotherAccount

  • Added Cloudwatch event bus in account Y to give permissions to account X
  • Modified the Cloudwatch event rule pattern in account Y to add this

"account": ["account X number"]

  • In account X, I created a Cloudwatch event rule with the same pattern (matching the other account) but with a different target: Event bus in another AWS account. And there I put the account Y number.

But for some reason the step function in account Y is not being triggered...

  • You should configure your account to receive the events from other accounts first. Have you configured CloudWatch event bus accordingly? https://docs.aws.amazon.com/AmazonCloudWatch/latest/events/CloudWatchEvents-CrossAccountEventDelivery.html#ReceivingEventsFromAnotherAccount – Vikyol Oct 04 '19 at 11:30
  • Yes I already did that. This is why I am not understanding this behavior... – Pedro Pimenta Oct 04 '19 at 15:45

0 Answers0