Lab: Automating Event-Driven Security Notifications with Amazon EventBridge

In this lab, you will build a serverless event-processing workflow that detects when a new Amazon S3 bucket is created and sends an automated notification via Amazon SNS. This follows the AWS DevOps Engineer Professional domain for managing event sources to process, notify, and take action.

---

Prerequisites

• An active AWS Account.
• AWS CLI installed and configured with Administrator credentials.
• Basic knowledge of JSON for event patterns.
• Region: Ensure you are working in us-east-1 for consistency.

[!WARNING] This lab involves creating resources that may incur costs if not deleted. Ensure you complete the Teardown section.

Learning Objectives

• Configure an Amazon SNS Topic for event fan-out.
• Create an AWS Lambda function to process event metadata.
• Implement an Amazon EventBridge Rule to capture AWS API calls from CloudTrail.
• Grant cross-service permissions for event routing.

Architecture Overview

Step-by-Step Instructions

Step 1: Create an Amazon SNS Topic

We need a destination to "fan out" our notifications.

[!IMPORTANT] You must check your email inbox and click Confirm Subscription before you can receive messages.

▶Console alternative

Navigate to

SNS > Topics > Create topic

. Select

Standard

, name it

brainybee-event-alerts

. Once created, click

Create subscription

, select

Email

, and enter your address.

Step 2: Create the Lambda Execution Role

Lambda needs permission to write logs to CloudWatch and publish to SNS.

1. Create a file named trust-policy.json:
   jsonCopy

   { "Version": "2012-10-17", "Statement": [{ "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" }, "Action": "sts:AssumeRole" }] }
2. Create the role:
   bashCopy

   aws iam create-role --role-name brainybee-lambda-event-role --assume-role-policy-document file://trust-policy.json # Attach basic execution and SNS publish policies aws iam attach-role-policy --role-name brainybee-lambda-event-role --policy-arn arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole aws iam attach-role-policy --role-name brainybee-lambda-event-role --policy-arn arn:aws:iam::aws:policy/AmazonSNSFullAccess

Step 3: Create the Lambda Processing Function

This function will parse the S3 event and send a formatted alert.

1. Create index.mjs:
   javascriptCopy

   import { SNSClient, PublishCommand } from "@aws-sdk/client-sns"; const sns = new SNSClient({}); export const handler = async (event) => { console.log("Event Received:", JSON.stringify(event, null, 2)); const bucketName = event.detail.requestParameters.bucketName; const region = event.detail.awsRegion; const message = `Security Alert: A new S3 bucket was created.\nBucket Name: ${bucketName}\nRegion: ${region}`; await sns.send(new PublishCommand({ TopicArn: process.env.SNS_TOPIC_ARN, Message: message, Subject: "S3 Security Notification" })); };
2. Zip and deploy:
   bashCopy

   zip function.zip index.mjs aws lambda create-function --function-name brainybee-s3-notifier \ --runtime nodejs18.x --role arn:aws:iam::<YOUR_ACCOUNT_ID>:role/brainybee-lambda-event-role \ --handler index.handler --zip-file fileb://function.zip \ --environment Variables={SNS_TOPIC_ARN=arn:aws:sns:us-east-1:<YOUR_ACCOUNT_ID>:brainybee-event-alerts}

Step 4: Configure the EventBridge Rule

We will create a rule that triggers whenever CloudTrail records a CreateBucket event.

Checkpoints

1. Trigger the Event: Create a dummy S3 bucket.
   bashCopy

   aws s3 mb s3://brainybee-test-event-$(date +%s)
2. Verify Logs: Check CloudWatch Logs to see if the Lambda executed.
   bashCopy

   aws logs describe-log-streams --log-group-name /aws/lambda/brainybee-s3-notifier
3. Check Email: Verify you received the "S3 Security Notification" message.

Clean-Up / Teardown

[!WARNING] Failure to delete these resources will result in ongoing (though minimal) CloudWatch Log storage costs.

Troubleshooting

Stretch Challenge

Automated Remediation: Modify the Lambda function to check if the new bucket has a specific tag (e.g., Compliance=Internal). If the tag is missing, have the Lambda function automatically apply it or delete the bucket.

Cost Estimate

Concept Review

In this lab, we utilized an Event-Driven Architecture. This design pattern is asynchronous and decoupled, meaning the S3 service doesn't need to know about the notification logic.

Comparison: EventBridge vs. S3 Event Notifications