I have eventBridge triggering a lambda which generates Jira tickets when critical findings are found in AWS Inspector scans.
I would like to limit this to events that are found in the last 24 if possible, to ensure that duplicate tickets are not created. The event trigger JSON that is working for all critical events is:
{
"source": ["aws.inspector2"],
"detail-type": ["Inspector2 Finding"],
"detail": {
"severity": ["CRITICAL"],
"status": ["ACTIVE"]
}
}
From reading up on this, I am not certain that I could add firstObservedAt to detail with some now()-24 hours logic as,
"firstObservedAt": "2023-12-08T15:22:39.524Z",
I have also looked at using Maximum age of event under select targets in the eventBridge rule, however I don't believe this will work as this value determines the amount of time an event will remain in the event queue for re-processing, if it fails initially. https://aws.amazon.com/about-aws/whats-new/2019/11/aws-lambda-supports-max-retry-attempts-event-age-asynchronous-invocations/
Is it possible for eventBridge to trigger targets from events, only if the firstObservedAt date is within the last 24 hours? Or is there another way I could tackle this?
I think you are right with respect to the standalone Eventbridge solution.
You would need to build custom logic inside the lambda using the event's time attribute or firstObservedAt in combination with some form of caching (file, database, SQS, etc.) outside the lambda for previous invocations if the event is recurring.