AWS Event Poller
As an alternative to the Event Handler, Guardrails offers a polling mechanism for obtaining relevant events from AWS and updating its CMDB. This mechanism is easy to configure and will not require sending events to a public webhook endpoint (i.e. AWS API Gateway). While it is possible to configure both polling and event handlers, Guardrails highly recommends using AWS Event Handlers. Event Pollers and Event Handlers should never be enabled at the same time.
- Choose Polling for ease of configuration. This is the pull method.
- Choose Event Handlers for efficiency and timeliness. This is the push method.
The Guardrails AWS Poller control will query CloudTrail for relevant event on a schedule and forward them to the router for processing.
Guardrails Policies for AWS Poller
The following policies will need to be configured to enable AWS Polling
|AWS > Turbot > Event Poller||Enable/ Disable polling|
|AWS > Turbot > Event Poller > Interval||The polling interval - how often to poll|
|AWS > Turbot > Event Poller > Window||The polling window - This policy determines the oldest events the event poller will retrieve. For example, setting the window to '15 minutes' will cause the poller to retrieve all events from the previous 15 minutes every time it runs.|
Relevant policy schema
AWS > Turbot > Event Poller
description: |Configure the AWS Event Poller. When set to Enabled, the poller will run at the interval specified to retrieve the latest events and forward them to the Turbot Router.Note: The Event Poller and Turbot Event Handler are different mechanisms for sending information to Turbot. You should enable one or the other, but not both.targets: AWS Accountschema:type: Stringenum:- Enabled- Disableddefault: Disabled
AWS > Turbot > Event Poller > Interval
description: |The polling interval. This policy determines how often the event poller will run.targets: AWS Accountschema:type: Stringenum:- Every 1 minute- Every 2 minutes- Every 3 minutes- Every 4 minutes- Every 5 minutes- Every 6 minutes- Every 7 minutes- Every 8 minutes- Every 9 minutes- Every 10 minutesdefault: Every 2 minutes
AWS > Turbot > Event Poller > Window
description: |The polling window, in minutes. This policies determines the oldest events the event poller will retrieve. For example, setting the window to '15 minutes' will cause the poller to retrieve all events from the previous 15 minutes every time it runs.The Window must be greater than the Interval, and it is recommended to be at least twice the Interval. For example, if the Interval is 'Every 5 Minutes', the Window should be at least '10 Minutes'.targets: AWS Accountschema:type: Stringenum:- 5 minutes- 6 minutes- 7 minutes- 8 minutes- 9 minutes- 10 minutes- 11 minutes- 12 minutes- 13 minutes- 14 minutes- 15 minutes- 16 minutes- 17 minutes- 18 minutes- 19 minutes- 20 minutesdefault: 5 minutes