Integrating Terraform Events w/ AWS EventBridge

Plenty of DevOps teams use Terraform to manage AWS EventBridge. Going the other way, using EventBridge to watch Terraform events, comes up far less often. This post walks through how Scalr's native integration with EventBridge lets you build event-driven workflows that react to Terraform events.

Want to see it in action first? Watch the video walkthrough: Scalr Integration w/ AWS EventBridge for Terraform & OpenTofu

AWS EventBridge Interface

AWS EventBridge Overview

First, a quick look at what AWS EventBridge is:

AWS EventBridge is a serverless event bus that connects your applications with data from different event sources. It takes real-time data from SaaS applications and AWS services and routes it to targets like AWS CloudWatch or Lambda. EventBridge is a common building block for event-driven architectures on AWS.

Key concepts in EventBridge include:

• Event Buses: The "pipeline" that receives events from a source and routes them to a target.
• Rules: Definitions for filtering and routing events to specific targets based on an event pattern.
• Targets: Destinations for events, such as Lambda functions, SNS topics, SQS queues, CloudWatch log groups, etc.
• EventBridge Pipes: Allows you to filter, transform, and enrich events before passing them to a target.

EventBridge integrates with over 90 AWS services as event sources, including CloudWatch, EC2, S3, and CodeCommit, and integrates with many third-party tools. It enables you to easily build event-driven workflows that react to state changes.

Terraform Overview

Terraform is an infrastructure-as-code tool that enables you to provision and manage your AWS and other providers, infrastructure, and resources through declarative configuration files. Terraform and OpenTofu support the AWS provider with resources for managing EventBridge components.

Here are a few examples of the provider and module usage, but full documentation can be found in library.tf.

In this example, we'll create an EventBridge bus with the supported module, create a rule, and then send it to a target, in this case, AWS CloudWatch:

Use EventBridge to Monitor Terraform

With both tools covered, here's how you can use AWS EventBridge to build an event-driven workflow off a Terraform event, like a Terraform apply that fails. The Scalr native integration with AWS EventBridge is what makes this possible.

Common Use Cases

Scalr is a Terraform automation and collaboration tool that runs your Terraform code remotely and integrates with many third-party tools. Because the runs execute in Scalr, Scalr can log events and trigger actions based on them. Two common use cases come up with events sent from Scalr to EventBridge:

Monitoring and Alerting

The Scalr-EventBridge integration lets teams automate work across their tooling. You design EventBridge rules that fire specific actions in response to Scalr and Terraform events. A successful Terraform run could kick off additional resource provisioning. A failed run in a critical environment could page the operations team right away, and finishing a large infrastructure update might trigger an automated test suite.

Audit Logging

Scalr can also stream user activity to EventBridge, not just run events, which gives you a detailed audit log of every account action. That tracking covers resource changes across Scalr services. Teams use the audit trail for a few things:

1. Ensuring compliance with regulatory requirements
2. Troubleshooting issues by reviewing historical actions
3. Analyzing patterns and trends in Scalr usage over time

This visibility into who did what helps with security and makes day-to-day operations easier to reason about.

How Does the Integration Work

Terraform Run Events

Scalr has a pre-built event bus in AWS that can be used for this. The integration is started from the Scalr UI:

AWS EventBridge Configuration in Scalr

After any Terraform run event in Scalr, Scalr will automatically send information about the run to EventBridge. Here is a sample event:

An EventBridge bus captures the information, and a rule is created in AWS to determine what to do with the information. A common use case is to forward this information to an AWS CloudWatch log group so that teams can set up alerts based on Terraform run event failures.

Scalr Audit Logs

Scalr also provides the option to send audit logs to AWS EventBridge. Rather than run events, users can create EventBridge rules based on actions taken in Scalr such as a Terraform workspace deletion, a run being approved, and more. Here is an example of an audit log that is sent to EventBridge and then likely forwarded to CloudWatch or a SaaS solution such as Datadog:

See it in Action

Prefer a demo? The video below walks through integrating Scalr with AWS EventBridge to send audit logs and run events:

Scalr Integration w/ AWS EventBridge for Terraform & OpenTofu

Summary

Terraform and Amazon EventBridge work well together, whether you use Terraform to create EventBridge resources or use EventBridge to drive a workflow off Terraform events. Scalr was the missing piece between them, the part that gets your Terraform run events into EventBridge in the first place. This is now available on both free and paid plans; give it a try in Scalr today.