Detection: EventBridge Rule Deleted
Overview
Detect when an Amazon EventBridge rule was deleted in a region. Deleting an EventBridge rule can disrupt event-driven workflows, delay processing, or prevent critical actions, potentially impacting application performance and operational continuity. Monitoring for a deleted rule ensures critical workflows are protected from unauthorized changes and accidental disruptions.
References:
Usage
Run the detection in your terminal:
powerpipe detection run aws_cloudtrail_log_detections.detection.eventbridge_rule_deletedSnapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe detection run aws_cloudtrail_log_detections.detection.eventbridge_rule_deleted --shareSQL
This detection uses a named query:
select tp_timestamp as timestamp,string_split(event_source, '.')[1] || ':' || event_name as operation,request_parameters ->> 'name' as resource,user_identity.arn as actor,tp_source_ip as source_ip,tp_index as account_id,aws_region as region,tp_id as source_id,*
from aws_cloudtrail_logwhere event_source = 'events.amazonaws.com' and event_name = 'DeleteRule' and error_code is null
order by event_time desc;