Setting up AWS EventBridge Notifications in Slack

Hooking up AWS EventBridge with a Slack webhook allows our team, to receive instant alerts when a wide variety of important events occur, for example if a CodeBuild pipeline fails, or an ECS task definition is updated. This real-time flow alerts not just to unexpected issues, but also slow, expected changes (such as the completion of a pipeline).

It’s very easy to setup, and can be deployed from a single cloudformation template without any code.

Getting slack ready

Before configuring AWS, you first need to prepare your Slack workspace:

Create a Slack App
- Visit api.slack.com/apps, log in, and select ‘Create New App’.
- Choose ‘Create from scratch’, select your workspace, and then pick your team.
Enable Incoming Webhooks:
- Navigate to the ‘Incoming Webhooks’ feature and enable it.
- Add a new webhook to the target channel of your workspace and copy the webhook URL.

This URL will be used by AWS EventBridge to send notifications to your Slack channel.

Responding to events

The premise is simple: When an event occurs in AWS, our eventbridgeRule will execute, the details we care about will be extracted from the event payload using an input transformer, placed into a JSON template, and sent off to the slack webhook url.

Matching events with Rules

The majority of AWS services emit events, and there are lots that you might want to alert your team on, some of these include:

Support case updates
Certificate issued
Certificate expired
Certificate action required (very useful!)
Cloudwatch alarms (configured not to match our autoscaling alarms)
ECS deployments
Codepipeline
Codebuild

We can of course configure the rules to only trigger under certain conditions, allowing us to tailor the message (and emojis) as required, for example we can dispatch different messages for succesful and failed pipeline executions.

Here’s a full list of AWS services which generate events you can hook into to keep Slack notified in real-time.

The input transformer

Key to this implementation is the input transformer.
This allows us to extract certain details from the event body as variables, which can then be inserted into a template - in this case the JSON template that Slack requires for it webhooks.

The JSON template

The json template is built using block kit which allows us to render a nice message on our slack channel, we just need to add some placeholders for the input transformers using <greater and less that>

To get something like this:

Slack Preview

We might use json like this:

{
  "blocks": [
    {
      "type": "header",
      "text": {
        "type": "plain_text",
        "text": "⚠️ CodePipeline *<state>*",
        "emoji": true
      }
    },
    {
      "type": "section",
      "text": {
        "type": "mrkdwn",
        "text": "*<pipeline>* has *<state>*"
      }
    },
    {
      "type": "context",
      "elements": [
        {
          "type": "plain_text",
          "text": "<resource>",
          "emoji": true
        }
      ]
    }
  ]
}

Deployment with Cloudformation

The cloudfomration template below is a starting point - it configures necessary resources for the webhook and the role to use it with, from the WebHookUrl parameter.
It also includes an example rule, matching codepipeline failures.
You should extend this to cover all events you wish to be notified for.

Ideally you would use AWS Stacksets to deploy it automatically accross all your accounts and regions, giving your team insight automatically to any account added to your organisation.

AWSTemplateFormatVersion: 2010-09-09
Description: Sends matching events to a slack webhook
Parameters:
  WebHookUrl:
    Type: String
    Description: Slack Webhook URL
Resources:
  CodePipelineErrorSlackWebHookRule:
    Type: AWS::Events::Rule
    Properties:
      Description: Codepipeline failed
      EventPattern:
        source:
          - aws.codepipeline
        detail-type:
          - CodePipeline Pipeline Execution State Change
        detail:
          state:
            - FAILED
      State: ENABLED
      Targets:
        - Arn: !GetAtt WebHookDestination.Arn
          Id: WebHookDestination
          RoleArn: !GetAtt EventBridgeInvokeWebHookRole.Arn
          InputTransformer:
            InputTemplate: '{	"blocks": [{"type": "header","text": {"type": "plain_text","text": "⚠️ CodePipeline *<state>*","emoji": true}},{"type": "section","text": {"type": "mrkdwn","text": "*<pipeline>* has *<state>*"}},{"type": "context","elements": [{"type": "plain_text","text": "<resource>","emoji": true}]}]}'
            InputPathsMap:
              resource: '$.resources[0]'
              pipeline: '$.detail.pipeline'
              state: '$.detail.state'
 
  EventBridgeInvokeWebHookRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub EventBridgeInvokeWebHookRole${AWS::Region}
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - events.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: /
      Policies:
        - PolicyName: EventBridgeInvokeWebHookRolePolicy
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - events:InvokeApiDestination
                Resource: [!GetAtt WebHookDestination.Arn]
 
  WebHookConnection:
    Type: AWS::Events::Connection
    Properties:
      Name: SlackWebHookConnection
      AuthorizationType: API_KEY
      AuthParameters:
        ApiKeyAuthParameters:
          ApiKeyName: x #not needed for slack
          ApiKeyValue: x
      Description: Unnecessary but required
 
  WebHookDestination:
    Type: AWS::Events::ApiDestination
    Properties:
      Name: WebHookDestination
      ConnectionArn: !GetAtt WebHookConnection.Arn
      Description: Sends messages to devops channel
      HttpMethod: POST
      InvocationEndpoint: !Ref WebHookUrl
      InvocationRateLimitPerSecond: 1

Conclusion

This article demonstrates a practical use for EventBridge api destinations - in this case to send notifications to Slack - and how using some of the more advanced functionality of AWS, such as input transformers, can perform tasks that a Lambda might typically be used for.
Bear in mind that all notifcations can have an effect on your teams focus, take care to avoid overwhelming your colleagues with notifications and ensure important alerts remain prominent.