Introduction

Use the downloaded CloudFormation templates to set up secure and scalable event forwarding from your AWS account(s) to OpsRamp. This automated approach is recommended for configuring the AWS Event Collector, as it ensures consistency across accounts and regions while minimizing manual effort.

Deployment Scenarios

Choose the deployment scenario that matches your AWS environment.

Single Account, Single Region Setup

This is the most common deployment scenario.

1. Sign in to the AWS Management Console.
2. Navigate to CloudFormation > Stacks > Create stack > With new resources (standard).
3. Select Upload a template file, click Choose file, and select awseventcollector-setup.yaml from the downloaded ZIP file.
4. Select Next.

Stack Parameters

Provide the following values when prompted:

5. Select Next.

Create the Stack

1. On the Configure stack options page, retain the default settings.
2. Review the configuration.
3. Select I acknowledge that AWS CloudFormation might create IAM resources with custom names.
4. Select Submit.

5. Wait until the stack status changes to CREATE_COMPLETE (typically 2–3 minutes).

Resources Created

The CloudFormation template automatically provisions the following AWS resources:

• Amazon Kinesis Data Firehose delivery stream
• Amazon S3 backup bucket
• Amazon CloudWatch log group
• Custom Amazon EventBridge event bus
• EventBridge rules
• Required IAM roles

Copy the CustomEventBusArn value from the Outputs tab. This value is required for multi‑region and multi‑account deployments.

Verify the AWS Resources

After stack creation, verify the following resources in the AWS Console:

Amazon Data Firehose > Firehose streams

• Confirm that the Firehose delivery stream (for example, opsramp-events-to-firehose) is in Active status.

Amazon EventBridge > Event buses

• Confirm that the custom event bus (for example, opsramp-events-collector) is listed.

Amazon EventBridge > Rules

• Confirm that the following rules exist:
  • forward-to-opsramp-events-collector on the default event bus
  • opsramp-events-collector-to-firehose on the custom event bus

Amazon S3

• Confirm that the backup bucket (for example, opsramp-events-to-firehose-backup-<account-id>) exists.

Multi‑Region Setup (Single Account)

To collect events from additional AWS regions in the same account:

1. Deploy awseventcollector-setup.yaml in the primary region.

2. From the Outputs tab of the created stack, copy the CustomEventBusArn.

3. In each additional region:

   • Create a new CloudFormation stack.
   • Upload awseventcollector-forwarding-rule.yaml.
   • Set the TargetEventBusArn parameter to the copied ARN.
   • Complete stack creation.

   

   

Multi‑Account Setup (AWS Organization)

To collect events from multiple AWS accounts within an organization:

1. Deploy awseventcollector-setup.yaml in the main account and primary region.

2. Provide all required parameter values.

3. Set OrganizationId to your AWS Organization ID (format: o-xxxxxxxxxx).

   Note: You can find the Organization ID in AWS Console > AWS Organizations > Dashboard, or by running aws organizations describe-organization --query Organization.Id.

4. Copy the CustomEventBusArn from the Outputs tab.

5. In each child account, create a CloudFormation stack using awseventcollector-forwarding-rule.yaml and set TargetEventBusArn to the copied ARN.

Multi‑Account, Multi‑Region Setup

For environments spanning multiple AWS accounts and regions:

1. Deploy awseventcollector-setup.yaml in the main account primary region with OrganizationId set.
2. Copy the CustomEventBusArn from the Outputs tab.
3. Deploy awseventcollector-forwarding-rule.yaml:
   • In each additional region of the main account
   • In every region of each child account

Verify Event Ingestion

Generate a test event

Perform any AWS action (for example, start or stop an EC2 instance, or create a security group).

Check Firehose metrics

In the AWS Console, go to Amazon Data Firehose > Monitoring and review Incoming records and HTTP endpoint delivery success metrics. Event delivery may be delayed by the 60‑second buffer interval.

Check OpsRamp

Navigate to Alerts to confirm alert generation. If Store as Searchable Logs is enabled, navigate to Logs to verify event ingestion.

Delete the Setup

To stop event collection:

1. Delete all stacks created using awseventcollector-forwarding-rule.yaml in child accounts and additional regions.
2. Delete the stack created using awseventcollector-setup.yaml in the main account.
3. Manually delete the S3 backup bucket. The bucket is retained by default to prevent accidental data loss.

AWS Configuration — Manual Setup (Without CloudFormation)

This option describes manual creation of AWS resources using the AWS Console. If possible, use the CloudFormation templates described earlier for automated and consistent setup.

Prerequisites

• AWS Event Collector app installed in OpsRamp
• Event Ingestion URL and Event Ingestion Token retrieved from the installed integration
• AWS Console access with permissions to create Kinesis Firehose streams and EventBridge resources

Resources Required

Create the Kinesis Data Firehose Stream

1. Navigate to Amazon Kinesis Data Firehose > Create Firehose stream.
2. Configure the source and destination:

Destination Settings

Provide the following HTTP endpoint details:

HTTP Endpoint Request Parameters

Under HTTP endpoint request configuration, add the following parameter:

Buffer Configuration

Retry Settings

S3 Backup Settings

Service Access

CloudWatch Error Logging

3. Click Create Firehose stream.
4. Wait for the stream status to change to Active.

The S3 backup bucket, CloudWatch log group, and IAM role are created automatically as part of the Firehose stream creation.

Create the Custom EventBridge Event Bus

1. Navigate to Amazon EventBridge > Event buses > Create event bus.
2. Enter the event bus name: opsramp-events-collector
3. Click Create.

(Multi‑Account only) Add a Resource Policy to the Custom Event Bus

If you are collecting events from multiple AWS accounts in the same AWS Organization, add a resource policy to the custom EventBridge bus.

1. Open the custom event bus and go to Permissions.
2. Click Manage permissions and add the following policy. Replace the placeholders:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowOrganizationAccountsPutEvents",
      "Effect": "Allow",
      "Principal": "*",
      "Action": "events:PutEvents",
      "Resource": "<custom-event-bus-arn>",
      "Condition": {
        "StringEquals": {
          "aws:PrincipalOrgID": "<your-org-id>"
        }
      }
    }
  ]
}

Create the EventBridge Rule (Custom Bus → Firehose)

This rule routes matching events from the custom event bus to the Kinesis Data Firehose stream.

1. Navigate to Amazon EventBridge > Rules > Create rule.
2. Configure the rule:

3. Click Next and set the Event pattern:

{
  "source": [{"prefix": "aws."}]
}

This default pattern captures all AWS events. Narrow it down based on your needs (see Customizing Event Patterns).

4. Click Next and configure the Target:

5. Click Next, skip tags, and click Create rule.

Create the EventBridge Rule (Default Bus → Custom Bus)

This rule forwards matching events from the default event bus to the custom event bus.

1. Navigate to Amazon EventBridge > Rules > Create rule.
2. Configure the rule:

3. Click Next and use the same Event pattern used in the custom bus rule:

{
  "source": [{"prefix": "aws."}]
}

4. Click Next and configure the Target:

5. Click Next, skip tags, and click Create rule.

Verification

After creating all required resources, verify the setup:

Firehose stream

• Confirm the stream status is Active in Amazon Data Firehose.

EventBridge rules

• Confirm both rules are in Enabled state.

Generate a test event

• Perform any AWS action (for example, create a security group) and verify:
  • Firehose Monitoring shows incoming records
  • OpsRamp shows ingested data in Alerts or Logs (based on your integration settings)

Multi‑Region / Multi‑Account Forwarding

To forward events from additional regions or child accounts:

In each additional region or child account:

1. Create an EventBridge rule on the default event bus.
2. Use the same event pattern as the main rule.
3. Set the target as:
   • Target type: EventBridge event bus
   • Target: Paste the custom event bus ARN from the primary region/main account
4. Create an execution role for this rule as prompted.

Cleanup

To remove the manual setup, delete resources in reverse order:

1. Delete EventBridge rules (both rules)
2. Delete the custom event bus
3. Delete the Kinesis Data Firehose stream
4. Delete the S3 backup bucket (empty it first, if required by AWS)

Customizing Event Patterns

By default, the templates and rules capture all AWS service events using this pattern:

{"source":[{"prefix":"aws."}]}

To reduce volume and cost, narrow the pattern to only the event types you need.

{
  "source": [{"prefix": "aws."}],
  "$or": [
    {
      "detail-type": ["AWS API Call via CloudTrail"],
      "detail": {
        "eventName": [
          {"prefix": "Create"},
          {"prefix": "Delete"},
          {"prefix": "Run"},
          {"prefix": "Start"},
          {"prefix": "Stop"},
          {"prefix": "Terminate"},
          {"prefix": "Reboot"},
          {"prefix": "Allocate"},
          {"prefix": "Release"},
          {"prefix": "Register"},
          {"prefix": "Deprecate"},
          {"prefix": "Request"},
          {"prefix": "Cancel"},
          {"prefix": "Activate"},
          {"prefix": "Add"},
          {"prefix": "Remove"},
          {"prefix": "Update"}
        ]
      }
    },
    {
      "detail-type": [
        "CloudWatch Alarm State Change",
        "EC2 Instance State-change Notification",
        "EC2 Instance Launch Successful",
        "EC2 Instance Launch Unsuccessful",
        "EC2 Instance Terminate Successful",
        "EC2 Instance Terminate Unsuccessful",
        "ECS Task State Change",
        "ECS Container Instance State Change",
        "EBS Volume Notification",
        "EBS Snapshot Notification",
        "EBS Multi-Volume Snapshots Completion Status",
        "Backup Job State Change",
        "AWS Health Event",
        "RDS DB Instance Event",
        "RDS DB Cluster Event",
        "RDS DB Snapshot Event",
        "RDS DB Cluster Snapshot Event",
        "Redshift Cluster State Change",
        "Config Configuration History Delivery Status",
        "Config Configuration Item Change",
        "Config Rules Compliance Change"
      ]
    }
  ]
}

Updating the Event Pattern After Deployment

To modify event filtering after deployment:

In the main region/account

• Go to the custom event bus (for example, opsramp-events-collector) and edit the rule (for example, opsramp-events-collector-to-firehose). Update the EventPattern JSON and save.

In forwarding regions/accounts

• Go to Amazon EventBridge > Rules, select the forwarding rule (for example, forward-to-opsramp-events-collector), update the Event pattern JSON, and save.