CloudWatch EventBridge输入转换异常：WAF事件通知仅时间有效

为了在WAF规则更新时接收通知，已创建CloudTrail管理事件，并在CloudWatch EventBridge中配置规则，事件模式如下：

{
  "source": ["aws.waf", "aws.wafv2"],
  "detail-type": ["AWS API Call via CloudTrail"],
  "detail": {
    "eventSource": ["waf.amazonaws.com", "wafv2.amazonaws.com"],
    "eventName": ["UpdateWebACL", "CreateWebACL", "DeleteWebACL", "UpdateRule", "CreateRule", "DeleteRule", "UpdateRuleGroup", "CreateRuleGroup", "DeleteRuleGroup"]
  }
}

目标设置为SNS主题，同时配置了以下输入转换：

{
    "eventName": "$.details.eventName",
    "timestamp": "$.time",
    "user": "$.details.userIdentity.userName",
    "webACLName": "$.details.requestParameters.name"
}

以及模板：

"EventName: <eventName>"
"WebACL: <webACLName>"
"Time: \"<timestamp>\""
"User: <user>"

触发WebACL更新时能收到通知，但除时间外其他字段均为空。在“AWS事件”下无法找到API Trail，但选择“匹配事件的一部分”并指定$.details时，能看到完整事件详情（示例如下）：

{
    "eventVersion": "1.08",
    "userIdentity": {
        "type": "IAMUser",
        "principalId": "xxxxxx",
        "arn": "arn:aws:iam::xxx:user/test",
        "accountId": "xxxx",
        "accessKeyId": "xxxx",
        "userName": "test",
        "sessionContext": {
            "sessionIssuer": {},
            "webIdFederationData": {},
            "attributes": {
                "creationDate": "2024-09-03T17:45:01Z",
                "mfaAuthenticated": "false"
            }
        }
    },
    "eventTime": "2024-09-04T05:44:42Z",
    "eventSource": "wafv2.amazonaws.com",
    "eventName": "CreateWebACL",
    "awsRegion": "us-east-1",
    "sourceIPAddress": "xx.xx.xx.xx",
    "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36",
    "requestParameters": {
        "name": "testwaf",
        "scope": "REGIONAL",
        "defaultAction": {
            "allow": {}
        },
        "rules": [
            {
                "name": "AWS-AWSManagedRulesCommonRuleSet",
                "priority": 0,
                "statement": {
                    "managedRuleGroupStatement": {
                        "vendorName": "AWS",
                        "name": "AWSManagedRulesCommonRuleSet",
                        "excludedRules": [],
                        "ruleActionOverrides": [
                            {
                                "name": "CrossSiteScripting_BODY",
                                "actionToUse": {
                                    "count": {}
                                }
                            },
                            {
                                "name": "UserAgent_BadBots_HEADER",
                                "actionToUse": {
                                    "count": {}
                                }
                            }
                        ]
                    }
                },
                "overrideAction": {
                    "none": {}
                },
                "visibilityConfig": {
                    "sampledRequestsEnabled": true,
                    "cloudWatchMetricsEnabled": true,
                    "metricName": "AWS-AWSManagedRulesCommonRuleSet"
                }
            }
        ],
        "visibilityConfig": {
            "sampledRequestsEnabled": true,
            "cloudWatchMetricsEnabled": true,
            "metricName": "testwaf"
        },
        "associationConfig": {}
    },
    "responseElements": {
        "summary": {
            "name": "testwaf",
            "id": "xxxe",
            "description": "",
            "lockToken": "xxxx",
            "aRN": "arn:aws:wafv2:us-east-1:xxxx:regional/webacl/testwaf/xxx"
        }
    },
    "requestID": "xxx",
    "eventID": "xxx",
    "readOnly": false,
    "eventType": "AwsApiCall",
    "apiVersion": "2019-04-23",
    "managementEvent": true,
    "recipientAccountId": "xxx",
    "eventCategory": "Management",
    "tlsDetails": {
        "tlsVersion": "TLSv1.3",
        "cipherSuite": "TLS_AES_128_GCM_SHA256",
        "clientProvidedHostHeader": "wafv2.us-east-1.amazonaws.com"
    },
    "sessionCredentialFromConsole": "true"
}

询问是否有直接的转换方式提取事件值，还是需要使用Lambda编写自定义逻辑。

不需要使用Lambda，直接修正输入转换里的JSON路径即可，问题出在路径拼写和字段定位错误：

• 路径拼写错误：输入转换里写的$.details是错误的，EventBridge中CloudTrail事件的相关内容实际在$.detail字段下（单数形式，而非复数）。
• 时间字段错误：时间字段应取$.detail.eventTime，而非$.time。

修正后的输入转换如下：

{
    "eventName": "$.detail.eventName",
    "timestamp": "$.detail.eventTime",
    "user": "$.detail.userIdentity.userName",
    "webACLName": "$.detail.requestParameters.name"
}

模板可保持不变，也可调整为更简洁的格式：

EventName: <eventName>
WebACL: <webACLName>
Time: <timestamp>
User: <user>

修正后，SNS通知就能正确提取所有字段的值。

内容的提问来源于stack exchange，提问作者user14013917