Introduction
This is the third part of my attempt to create scripts for collecting evidence about AWS resources. EventBridge is often enabled in multiple regions. In that case, collecting evidence region by region is tedious, so I created the script below.
This script has been confirmed to work only in CloudShell.
Script
#!/bin/bash
# Get a list of all regions
regions=$(aws ec2 describe-regions --query 'Regions[].RegionName' --output text)
for region in $regions; do
echo -e "\n Region: $region"
# Create folders for each region
mkdir -p "$region"
# Get EventBridge rules for each region
rules=$(aws events list-rules --region $region --query 'Rules[]' --output json)
if [ -z "$rules" ]; then
echo "No EventBridge rules found"
else
# Get detailed information for each rule
echo "$rules" | jq -c '.[]' | while read -r rule; do
name=$(echo $rule | jq -r '.Name')
description=$(echo $rule | jq -r '.Description')
event_bus=$(echo $rule | jq -r '.EventBusName')
state=$(echo $rule | jq -r '.State')
event_pattern=$(echo $rule | jq -r '.EventPattern')
rule_arn=$(echo $rule | jq -r '.Arn')
targets=$(aws events list-targets-by-rule --rule $name --region $region --query 'Targets[]' --output json)
tags=$(aws events list-tags-for-resource --resource-arn $rule_arn --region $region --query 'Tags[]' --output json)
echo "Rule name: $name"
echo "Description: $description"
echo "Event bus: $event_bus"
echo "Rule state: $state"
echo "Event pattern: $event_pattern"
if [ -z "$targets" ]; then
echo "No targets found"
else
echo "$targets" | jq -c '.[]' | while read -r target; do
target_id=$(echo $target | jq -r '.Id')
target_arn=$(echo $target | jq -r '.Arn')
input_path=$(echo $target | jq -r '.InputTransformer.InputPathsMap')
input_transformer=$(echo $target | jq -r '.InputTransformer.InputTemplate')
echo "Target ID: $target_id"
echo "Target ARN: $target_arn"
echo "Input path: $input_path"
echo "Input transformer: $input_transformer"
done
fi
if [ -z "$tags" ]; then
echo "No tags found"
else
echo "Tags:"
echo "$tags" | jq -c '.[]' | while read -r tag; do
key=$(echo $tag | jq -r '.Key')
value=$(echo $tag | jq -r '.Value')
echo " $key: $value"
done
fi
echo -e "\n"
# File output
echo "$rule" > "$region/list-rules_$name.json"
echo "$targets" > "$region/list-targets-by-rule_$name.json"
echo "$tags" > "$region/list-tags-for-resource_$name.json"
done
fi
doneHow to use
Run the script with the command below.
sh get-eventbridge.shUse redirection if you want to save the script execution log as a file.
sh get-eventbridge.sh > get-eventbridge.logOutput
The standard output looks like this. You can check the settings at a glance.
Region: ap-northeast-1
Rule name: XXXXXXXX-XXXXXXXXXXXXXX
Description: XXXXXXXXXXXXXXXXXXXXX
Event bus: default
Rule state: ENABLED
Event pattern: { "source": ["aws.cloudwatch"], "detail-type": ["CloudWatch Alarm State Change"], "resources": ["arn:aws:cloudwatch:ap-northeast-1:XXXXXXXXXXXX:XXXXXXXX-XXXXXXXXXXXXX"], "detail": { "state": { "value": ["ALARM"] } } }
Target ID: XXXXXXXX-XXXXXXXXXXXXXX
Target ARN: arn:aws:sns:ap-northeast-1:XXXXXXXXXXXX:XXXXXXXX-XXXXXXXXXXXXX
Input path: {
"Account": "$.account",
"AlarmName": "$.detail.alarmName",
"MetricsName": "$.detail.configuration.metrics[0].metricStat.metric.name",
"Reason": "$.detail.state.reason",
"Time": "$.time",
"source": "$.source",
"version": "$.version"
}
Input transformer: "The following alarms have been issued."
"AWS Account ID : <Account> "
"Time of occurrence: <Time>"
"Alarm Name: <AlarmName>"
"Occurrence Metrics: <MetricsName>"
"Reason: <Reason>"
Tags:
Name: XXXXXXXX-XXXXXXXXXXXXX
--- Omitted ---A directory will be created for each region as shown below.
[cloudshell-user@ip-XX-XXX-XXX-XXX ~]$ ls -l
total 112
drwxr-xr-x. 2 cloudshell-user cloudshell-user 4096 Jun 4 08:01 ap-northeast-1
drwxr-xr-x. 2 cloudshell-user cloudshell-user 4096 Jun 4 08:01 ap-northeast-2
drwxr-xr-x. 2 cloudshell-user cloudshell-user 4096 Jun 4 08:01 ap-northeast-3
drwxr-xr-x. 2 cloudshell-user cloudshell-user 4096 Jun 4 08:01 ap-south-1
drwxr-xr-x. 2 cloudshell-user cloudshell-user 4096 Jun 4 08:01 ap-southeast-1
drwxr-xr-x. 2 cloudshell-user cloudshell-user 4096 Jun 4 08:01 ap-southeast-2
drwxr-xr-x. 2 cloudshell-user cloudshell-user 4096 Jun 4 08:01 ca-central-1
drwxr-xr-x. 2 cloudshell-user cloudshell-user 4096 Jun 4 08:01 eu-central-1
drwxr-xr-x. 2 cloudshell-user cloudshell-user 4096 Jun 4 08:01 eu-north-1
drwxr-xr-x. 2 cloudshell-user cloudshell-user 4096 Jun 4 08:01 eu-west-1
drwxr-xr-x. 2 cloudshell-user cloudshell-user 4096 Jun 4 08:01 eu-west-2
drwxr-xr-x. 2 cloudshell-user cloudshell-user 4096 Jun 4 08:01 eu-west-3
-rw-r--r--. 1 cloudshell-user cloudshell-user 13037 Jun 4 08:01 get-eventbridge.log
-rw-r--r--. 1 cloudshell-user cloudshell-user 3008 Jun 4 08:01 get-eventbridge.sh
-rw-r--r--. 1 cloudshell-user cloudshell-user 21999 Jun 4 08:02 get-eventbridge.zip
drwxr-xr-x. 2 cloudshell-user cloudshell-user 4096 Jun 4 08:01 sa-east-1
drwxr-xr-x. 2 cloudshell-user cloudshell-user 4096 Jun 4 08:01 us-east-1
drwxr-xr-x. 2 cloudshell-user cloudshell-user 4096 Jun 4 08:01 us-east-2
drwxr-xr-x. 2 cloudshell-user cloudshell-user 4096 Jun 4 08:01 us-west-1
drwxr-xr-x. 2 cloudshell-user cloudshell-user 4096 Jun 4 08:01 us-west-2
[cloudshell-user@ip-XX-XXX-XXX-XXX ~]$ JSON will be saved in the region directory as shown below.
[cloudshell-user@ip-XX-XXX-XXX-XXX ~]$ ls -l ap-northeast-1/
total 60
-rw-r--r--. 1 cloudshell-user cloudshell-user 574 Jun 4 08:01 list-rules_XXXXXXXX-XXXXXXXXXXXXX.json
-rw-r--r--. 1 cloudshell-user cloudshell-user 228 Jun 4 08:01 list-tags-for-resource_XXXXXXXX-XXXXXXXXXXXXX.json
-rw-r--r--. 1 cloudshell-user cloudshell-user 850 Jun 4 08:01 list-targets-by-rule_XXXXXXXX-XXXXXXXXXXXXX.json
[cloudshell-user@ip-XX-XXX-XXX-XXX ~]$