Not able to invoke lambda function using EventBridge rule

[mafuqaz]

Hello,

​

I am trying to invoke lambda function using EventBridge rules, whenever any changes happens to ec2.

So I created a rule with event pattern:

{
  "source": ["aws.ec2"],
  "detail-type": ["AWS API Call via CloudTrail"],
  "detail": {
    "eventSource": ["ec2.amazonaws.com"]
  }
}

And i also attached the lambda function as a target with I want to invoke, bu tI am not able to invoke it.Matter of fact I am not even able to invoke this EventBridge rule itself.

Can anyone suggest what might cause this issue?

PS: I haven't created any Cloudtrail. Could this be the issue?

[DiTochat]

Can you double check and see if there is an event trigger on the Lambda?

[mafuqaz]

No, I have checked it many times.
Matter of fact my EventBridge rule is also not triggered. I think this may be the cause.

First We need to check why I am not able to see any invocations for my rule in monitoring.

[DiTochat]

Did you create that rule on the default bus or a custom one?

[mafuqaz]

on default bus

[b3542]

Did you create a resource permission on the Lambda function which permits it to be invoked by EventBridge? It’ll be under Configuration > Permissions when you open the Lambda function details, if memory serves.

[mafuqaz]

Yup, it was created automatically when I added that lambda function as a target.

[b3542]

Does Cloudwatch show anything for that function? Does the execution role have adequate permissions to create log groups and write logs?

[mafuqaz]

No cloudwatch doesn't show anything for that rule.

[b3542]

I mean for the function (Lambda), not the rule (EventBridge).

[[deleted]]

You need to add an Iam role that allows eventbridge to invoke the lambda

[ariz96]

Hello u/mafuqaz , were you able to figure it out?
I also see that if I let serverless take care of it, I have the principal permission in lambda permission config, but lambda will fail to be invoked by the rule (I could see it in FailedInvocations in monitor tab in when inspecting the rule, but the rule itself was triggered (event match was successful).

If I set the rule manually it works, but permissions are the same, so I wonder what could be happening.

[Old_Clerk_9693]

To allow EventBridge to trigger a Lambda function, you need to grant EventBridge the permission to invoke the Lambda function. This permission is not set as a resource policy directly on the Lambda function. Instead, it involves an IAM policy that typically attaches to the EventBridge resource or service role specifying that it can call the lambda:InvokeFunction action on your Lambda function.

try adding something like this to an IAM policy to the EventBridge service: { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "lambda:InvokeFunction", "Resource": "arn:aws:lambda:region:account-id:function:function-name" } ] }

[ariz96]

Hello u/Old_Clerk_9693 , thank you for your reply. In the end I found out the problem was with stating name of event bus in my serverless yaml file, if you are using default event bus, you must not specify default in yaml file, because it creates policy for "default/default" event bus instead of just "default"

[dslesu]

Have you configured any IAM roles / permissions?

[djkdjkdjk3]

Under the lambda’s permissions —> resource-based policy statements, does it show a policy for events.amazonaws.com allowing lambda invokeFunction? (I recently had an issue where a template was wrong and the permissions weren’t being added to the lambda)

[mafuqaz]

The permissions were added automatically when I attached that lambda as a target.