How can I pass the instance id to Lambda function

Question

I'm developing a workflow in AWS. The scenario is: whenever I get a suspicious log entry in a log group like lot's of 403 errors. I want the instance to be isolated from the environment. Currently the flow is like this: Log group -> Metric filter -> Alarm -> Eventbridge Rule/ SNS -> Lambda. The problem is, to isolate the instance I need to pass the instance id to the lambda function either by SNS or through Eventbridge rule but nothing is working. The logs that are getting ingested have the instance id but how can I fetch that from the logs and send it to the lambda?

I tried it through SNS but for that the message should include the instance id in JSON which should look like this: { "instance_i": "i-xxxx" }

But not getting a way to do that. Same is through Eventbridge rule. How can I fetch the instance id and send it to the lambda function? Can you please help me with that?

There's no good way to do this. The middle part of your solution is a CloudWatch Alarm. That alarm does not get the log info, and has no idea what the actual log message is that caused it to be triggered, it only knows that a threshold was crossed and that it should be in an alarm state. So the log message itself is lost during the alarm triggering process. AWS provides an example solution here: github.com/awslabs/cloudwatch-logs-customize-alarms/blob/master/… where you can see they actually have the Lambda query the logs for a specific time period. — Mark B
– Mark B, Commented Dec 16, 2024 at 14:51
Use the lambda to look through recent logs, and identify all instances with 403s above your specified threshold. — Wayne Workman
– Wayne Workman, Commented Dec 18, 2024 at 1:14

jigle · Accepted Answer · 2024-12-17 11:03:16Z

0

What about using a subscription filter in the log group (filtered by those 403 errors) that invokes your lambda? If the instance id is present in the log then it will be present in the lambda's event object.

Check:

answered Dec 17, 2024 at 11:03

jigle

915 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

user28806390 Over a year ago

Then the Lambda will be triggered on every log event that matches the filter pattern i.e. with the very single 403 error?

jigle Over a year ago

That is correct.

Collectives™ on Stack Overflow

How can I pass the instance id to Lambda function

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related