Invoking AWS CloudWatch Event Rule by some event

Question

I have an EventBridge rule that looks like this:

{
  "source": ["redshift.amazonaws.com"],
  "detail-type": ["AWS API Call via CloudTrail"],
  "detail": {
    "eventSource": ["redshift.amazonaws.com"],
    "eventName": ["CreateCluster"],
    "requestParameters": {
      "clusterIdentifier": ["some-redshift-cluster"]
    }
  }
}

As you can see I want to invoke that rule on the Cluster Creation event. The problem is the rule above doesn't want to be invoked so it won't trigger specific Lambda that is set as a target of the rule.

As an experiment I've created a mock event on default event bus and sent it. EventBridge rule matches with this event, which looks like this:

{
  "version": "0",
  "id": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
  "detail-type": "AWS API Call via CloudTrail",
  "source": "redshift.amazonaws.com",
  "account": "xxxxxxxxxxxx",
  "time": "2023-07-04T10:13:01Z",
  "region": "us-east-1",
  "resources": [],
  "detail": {
    "eventVersion": "1.08",
    "userIdentity": {
      "type": "IAMUser",
      "principalId": "xxxxxxxxxxxxxxxxxxxxx",
      "arn": "arn:aws:iam::xxxxxxxxxxxx:user/[email protected]",
      "accountId": "xxxxxxxxxxxx",
      "accessKeyId": "xxxxxxxxxxxxxxxxxxxx",
      "userName": "[email protected]"
    },
    "eventTime": "2023-07-04T07:03:13Z",
    "eventSource": "redshift.amazonaws.com",
    "eventName": "CreateCluster",
    "awsRegion": "us-east-1",
    "sourceIPAddress": "xx.xx.xx.xxx",
    "userAgent": "xxx",
    "requestParameters": {
      "dBName": "xxx",
      "clusterIdentifier": "some-redshift-cluster",
      "clusterType": "single-node",
      "nodeType": "dc2.large",
      "masterUsername": "xxxxxxxxx",
      "masterUserPassword": "HIDDEN_DUE_TO_SECURITY_REASONS",
      "vpcSecurityGroupIds": [
        "xx-xxxxxxxxxxxxxxxxx"
      ]
}

I've changed each sensitive data to x sign. There is much more info in detail key but I've skipped it.

Value of this detail key is an Event Record content from the CreateCluster event located in an Event History in the CloudTrail after the Redshit Cluster is created. The are no keys like version, id, source etc. on the higher level and I think that's the reason why that rule can't match event of Cluster Creation. How can I edit this rule to make it work on real CreateCluster event that happens while Cluster is created?

Edit: I tried with this pattern for redshift

{
  "source": ["aws.redshift"],
  "detail-type": ["AWS API Call via CloudTrail"],
  "detail": {
    "eventSource": ["redshift.amazonaws.com"],
    "eventName": ["CreateCluster"],
    "requestParameters": {
      "clusterIdentifier": ["some-redshift-cluster"]
    }
  }
}

and it doesn't work too. I created even a rule triggered on S3 bucket creation:

{
  "source": ["aws.s3"],
  "detail": {
    "eventSource": ["s3.amazonaws.com"],
    "eventName": ["CreateBucket"],
    "requestParameters": {
      "bucketName": ["some-bucket"]
    }
  }
}

Even for S3 rule has no triggers.

Answer 1

The problem was with a lack of a Trail in CloudTrail. I've read some texts where was said EventBridge rules don't need the Trail enabled for a proper work. I had no better ideas, so made one and now rule matches event and successfully invokes targets.

It's a weird solutions, that I don't really understand, because in this project I have a lambda being invoked on different EventBridge rule and this one worked well (source of this rule is aws.redshift-data). Perhaps, there are events that can be matched with patterns only with an enabled trail?