CODEWITHSUNDEEP
amazon-web-servicesamazon-s3aws-lambdaaws-event-bridge
SamuelCook
SamuelCook

Reputation: 58

Why is this EventBridge rule not filtering out events which do not match the prefix?

I have the below EventBridge rule (I changed the exact bucket name and key but the pattern remains the same) set up to invoke a lambda function. However, the 'prefix' portion of the rule appears to be ignored when filtering S3 Put events (i.e., keys that do not match the prefix are invoking the lambda). The 'suffix' portion of the rule appears to be filtering results as intended.

EventBridge Rule:

{
  "source": ["aws.s3"],
  "detail-type": ["Object Created"],
  "detail": {
    "bucket": {
      "name": ["some-bucket-20-uat-not-important"]
    },
    "object": {
      "key": [{
        "prefix": "in/Shared/Apps/Report Gen/ClientAnalytic - Upload & Download/"
      }, {
        "suffix": ".csv"
      }]
    }
  }
}

An example of a key which invoked the lambda function but should not have would be "in/Shared/Apps/IIC/some_file.csv".

As you can see the first portion of the key matches, but the second half does not, I assume partial matches for a prefix are not allowed? Or could it perhaps relate to the spaces or non-alphanumeric characters in the rule prefix?

Any ideas would be much appreciated, thanks!

I have played around with reformatting the EventBridge rule (e.g., declaring rules for ['detail']['object']['key'] separately, not in a list) but to no avail.

UPDATE 20/12/2023 - Removing the suffix resolves the issue, it appears that the rule is interpreted as having the key match the prefix OR the suffix not AND.

Upvotes: 0

Views: 858

Answers (1)

MANISH
MANISH

Reputation: 451

If prefix and suffix are mentioned separately in the Event Bridge rule, AWS will execute the rule if either of the condition matches. The solution is to use wildcard filtering in Event Bridge rule if there is a need to match both prefix and suffix together.

   {
   "source":[
      "aws.s3"
   ],
   "detail-type":[
      "AWS API Call via CloudTrail"
   ],
   "detail":{
      "eventSource":[
         "s3.amazonaws.com"
      ],
      "eventName":[
         "CompleteMultipartUpload",
         "CopyObject",
         "PutObject"
      ],
      "requestParameters":{
         "bucketName":[
            "some-bucket-20-uat-not-important"
         ],
         "key":[
            {
               "wildcard":"in/Shared/Apps/Report Gen/ClientAnalytic - Upload & Download/*.csv"
            }
         ]
      }
   }
}

Upvotes: 2

Related Questions