developersIO
I Tried the New "EventBridge State Change Events" Feature in Amazon Timestream for InfluxDB and Compared It with CloudTrail

I Tried the New "EventBridge State Change Events" Feature in Amazon Timestream for InfluxDB and Compared It with CloudTrail

Amazon Timestream for InfluxDB now publishes DB instance state change events to EventBridge. We look at events for successful create, reboot, scaling and delete operations and compare them with CloudTrail events.
Amazon TimestreamAmazon EventBridgeAWS CloudTrailデータベースAWS
suzuki.ryo
2026.07.11

This page has been translated by machine translation. View original

Introduction

Amazon Timestream for InfluxDB now publishes DB instance lifecycle events to Amazon EventBridge (announced 2026/07/09).

https://aws.amazon.com/about-aws/whats-new/2026/07/timestream-influxdb-eventbridge/

Until now, there was no event-driven mechanism to detect the completion of DB instance operations, and confirming completion required polling the DescribeDbInstances API. With this update, you can detect operation completion with EventBridge rules without relying on polling.

Item Before Now
How state changes are detected DescribeDbInstances API polling Automatic notification via EventBridge events
Supported events Only API events via CloudTrail (no state change event indicating operation completion) Create/Delete/Scaling/Parameter update/Maintenance/Reboot
Ease of automation Requires polling + conditional branching Declarative routing with EventBridge rules

This feature publishes events not only for successful completion but also for failures. In this article, I run four operations on a DB instance (create, reboot, storage scaling, delete) and examine the structure of the new state change events published on success. I also compare them with the CloudTrail-based events published for the same operations.

Verification

Preparation: Creating an EventBridge rule

I created a rule that forwards events matching the source aws.timestream-influxdb to CloudWatch Logs.

# ルール作成
aws events put-rule \
  --name "timestream-influxdb-state-change" \
  --event-pattern '{"source": ["aws.timestream-influxdb"]}' \
  --region us-west-2

# CloudWatch Logs ターゲット設定
aws events put-targets \
  --rule "timestream-influxdb-state-change" \
  --targets 'Id=cloudwatch-logs-target,Arn=arn:aws:logs:us-west-2:123456789012:log-group:/aws/events/timestream-influxdb' \
  --region us-west-2

Because this rule filters only on the source, in an environment where CloudTrail management event recording is enabled, both the CloudTrail-based events and the new state change events are captured.

The verification environment is as follows.

  • Region: us-west-2 (Oregon)
  • DB instance: db.influx.medium / 20 GiB / Single-AZ
  • Instance name: test-eventbridge-verify

Create event: Full comparison of CloudTrail and the new event

CloudTrail-based event (API call record)

The following CloudTrail-based event arrived as the record of the CreateDbInstance API call.

{
  "version": "0",
  "detail-type": "AWS API Call via CloudTrail",
  "source": "aws.timestream-influxdb",
  "time": "2026-07-11T04:51:27Z",
  "region": "us-west-2",
  "resources": [],
  "detail": {
    "eventName": "CreateDbInstance",
    "requestParameters": {
      "allocatedStorage": 20,
      "dbInstanceType": "db.influx.medium",
      "deploymentType": "SINGLE_AZ",
      "name": "test-eventbridge-verify",
      "password": "HIDDEN_DUE_TO_SECURITY_REASONS"
    },
    "responseElements": {
      "arn": "arn:aws:timestream-influxdb:us-west-2:123456789012:db-instance/4q8g1gli53",
      "id": "4q8g1gli53",
      "name": "test-eventbridge-verify",
      "status": "CREATING"
    },
    "eventType": "AwsApiCall",
    "managementEvent": true
  }
}

(Only the main fields are excerpted. See the collapsible section below for the full text)

Note that responseElements.status is CREATING (progressive form). At this point the instance is not yet available. Also, requestParameters records the main request parameters of the API call (sensitive values such as passwords and usernames are masked with HIDDEN_DUE_TO_SECURITY_REASONS).

Full CloudTrail-based event (partially masked, click to expand)
{
  "version": "0",
  "id": "4c0f036d-a6cc-dd99-56e4-92a699c2cc4f",
  "detail-type": "AWS API Call via CloudTrail",
  "source": "aws.timestream-influxdb",
  "account": "123456789012",
  "time": "2026-07-11T04:51:27Z",
  "region": "us-west-2",
  "resources": [],
  "detail": {
    "eventVersion": "1.11",
    "userIdentity": {
      "type": "AssumedRole",
      "principalId": "AROAXXXXXXXXXXXXXXXXX:session-name",
      "arn": "arn:aws:sts::123456789012:assumed-role/role-name/session-name",
      "accountId": "123456789012"
    },
    "eventTime": "2026-07-11T04:51:27Z",
    "eventSource": "timestream-influxdb.amazonaws.com",
    "eventName": "CreateDbInstance",
    "awsRegion": "us-west-2",
    "sourceIPAddress": "xxx.xxx.xxx.xxx",
    "userAgent": "aws-cli/2.35.19 ...",
    "requestParameters": {
      "allocatedStorage": 20,
      "bucket": "testbucket",
      "dbInstanceType": "db.influx.medium",
      "deploymentType": "SINGLE_AZ",
      "name": "test-eventbridge-verify",
      "organization": "testorg",
      "password": "HIDDEN_DUE_TO_SECURITY_REASONS",
      "publiclyAccessible": false,
      "username": "HIDDEN_DUE_TO_SECURITY_REASONS",
      "vpcSecurityGroupIds": ["sg-xxxxxxxx"],
      "vpcSubnetIds": ["subnet-xxxxxxxx", "subnet-yyyyyyyy"]
    },
    "responseElements": {
      "allocatedStorage": 20,
      "arn": "arn:aws:timestream-influxdb:us-west-2:123456789012:db-instance/4q8g1gli53",
      "availabilityZone": "us-west-2b",
      "dbInstanceType": "db.influx.medium",
      "dbStorageType": "InfluxIOIncludedT1",
      "deploymentType": "SINGLE_AZ",
      "id": "4q8g1gli53",
      "name": "test-eventbridge-verify",
      "networkType": "IPV4",
      "port": 8086,
      "publiclyAccessible": false,
      "status": "CREATING",
      "vpcSecurityGroupIds": ["sg-xxxxxxxx"],
      "vpcSubnetIds": ["subnet-xxxxxxxx", "subnet-yyyyyyyy"]
    },
    "requestID": "b443fc85-5c1a-420a-8b7a-6b676c0fa3b9",
    "eventID": "6d992928-cdbd-4bd7-8282-949b87f1b9ff",
    "readOnly": false,
    "eventType": "AwsApiCall",
    "managementEvent": true,
    "recipientAccountId": "123456789012",
    "eventCategory": "Management",
    "tlsDetails": {
      "tlsVersion": "TLSv1.3",
      "cipherSuite": "TLS_AES_128_GCM_SHA256",
      "clientProvidedHostHeader": "timestream-influxdb.us-west-2.amazonaws.com"
    }
  }
}

New state change event (after the operation completes)

As the event indicating creation completion, the following arrived about 8 minutes after the CloudTrail-based event.

{
  "version": "0",
  "id": "2c06834f-2e2c-06c2-caf0-eb13c9bc9d39",
  "detail-type": "Timestream InfluxDB DB Instance Event",
  "source": "aws.timestream-influxdb",
  "account": "123456789012",
  "time": "2026-07-11T04:59:20Z",
  "region": "us-west-2",
  "resources": [
    "arn:aws:timestream-influxdb:us-west-2:123456789012:db-instance/4q8g1gli53"
  ],
  "detail": {
    "EventCategories": ["creation"],
    "SourceType": "DB_INSTANCE",
    "SourceArn": "arn:aws:timestream-influxdb:us-west-2:123456789012:db-instance/4q8g1gli53",
    "Date": "2026-07-11T04:59:20.224Z",
    "Message": "InfluxDB v2 instance 'test-eventbridge-verify' created",
    "SourceIdentifier": "test-eventbridge-verify",
    "EventID": "TIDB-EVENT-11001"
  }
}

The main differences from the CloudTrail-based event are as follows.

  • detail-type is Timestream InfluxDB DB Instance Event — a new event type specific to Timestream for InfluxDB
  • resources contains the ARN of the DB instance
  • The structure of detail is simple — narrowed down to EventID, Message, EventCategories, SourceArn, etc.
  • It does not include API request/response information — it only notifies the result of "what happened"
  • time is the event publication time after the operation completes — whereas CloudTrail's is the time the API call was recorded, this one is the time of the event published after the operation completed

Reboot / storage scaling / delete events

For the remaining three operations as well, pairs of a CloudTrail event and a new event were fired. The differences are as follows.

Operation EventID EventCategories Message
Create completed TIDB-EVENT-11001 creation InfluxDB v2 instance '...' created
Reboot completed TIDB-EVENT-16001 notification InfluxDB v2 instance '...' rebooted
Storage update completed TIDB-EVENT-12002 notification InfluxDB v2 instance '...' storage updated
Delete completed TIDB-EVENT-13001 notification InfluxDB v2 instance '...' deleted

Among the four operations tried here, only creation had EventCategories of creation; the others were notification.

The correspondence between the CloudTrail eventName and the new event's EventID is as follows.

CloudTrail eventName New event EventID CloudTrail status Timing difference
CreateDbInstance TIDB-EVENT-11001 CREATING +approx. 8 min
RebootDbInstance TIDB-EVENT-16001 REBOOTING +approx. 3.5 min
UpdateDbInstance TIDB-EVENT-12002 UPDATING +approx. 6.5 min
DeleteDbInstance TIDB-EVENT-13001 DELETING +approx. 5.5 min

In the success cases of the four operations confirmed here, CloudTrail's event arrived when the API call was recorded (with the status in progressive form), and the new event arrived after successful completion.

Reboot — CloudTrail-based event
{
  "version": "0",
  "id": "c1f41506-055a-8c81-b3fa-e4a655a33b53",
  "detail-type": "AWS API Call via CloudTrail",
  "source": "aws.timestream-influxdb",
  "account": "123456789012",
  "time": "2026-07-11T05:03:47Z",
  "region": "us-west-2",
  "resources": [],
  "detail": {
    "eventName": "RebootDbInstance",
    "requestParameters": {
      "identifier": "4q8g1gli53"
    },
    "responseElements": {
      "arn": "arn:aws:timestream-influxdb:us-west-2:123456789012:db-instance/4q8g1gli53",
      "name": "test-eventbridge-verify",
      "status": "REBOOTING"
    }
  }
}

(Only the main fields are excerpted)

Reboot — New event
{
  "version": "0",
  "id": "b8104ebe-f614-b44e-747c-6fd06194edc2",
  "detail-type": "Timestream InfluxDB DB Instance Event",
  "source": "aws.timestream-influxdb",
  "account": "123456789012",
  "time": "2026-07-11T05:07:13Z",
  "region": "us-west-2",
  "resources": [
    "arn:aws:timestream-influxdb:us-west-2:123456789012:db-instance/4q8g1gli53"
  ],
  "detail": {
    "EventCategories": ["notification"],
    "SourceType": "DB_INSTANCE",
    "SourceArn": "arn:aws:timestream-influxdb:us-west-2:123456789012:db-instance/4q8g1gli53",
    "Date": "2026-07-11T05:07:13.193Z",
    "Message": "InfluxDB v2 instance 'test-eventbridge-verify' rebooted",
    "SourceIdentifier": "test-eventbridge-verify",
    "EventID": "TIDB-EVENT-16001"
  }
}
Storage scaling — CloudTrail-based event
{
  "version": "0",
  "id": "f6a213a5-ebaf-dfa8-b71c-ad11b246956a",
  "detail-type": "AWS API Call via CloudTrail",
  "source": "aws.timestream-influxdb",
  "account": "123456789012",
  "time": "2026-07-11T05:08:24Z",
  "region": "us-west-2",
  "resources": [],
  "detail": {
    "eventName": "UpdateDbInstance",
    "requestParameters": {
      "allocatedStorage": 25,
      "identifier": "4q8g1gli53"
    },
    "responseElements": {
      "allocatedStorage": 20,
      "arn": "arn:aws:timestream-influxdb:us-west-2:123456789012:db-instance/4q8g1gli53",
      "name": "test-eventbridge-verify",
      "status": "UPDATING"
    }
  }
}

(Only the main fields are excerpted. Note that responseElements.allocatedStorage returns the pre-update value of 20, not the 25 specified in the request)

Storage scaling — New event
{
  "version": "0",
  "id": "f4826fbd-cd30-3cd0-412c-26ae4a3d21d6",
  "detail-type": "Timestream InfluxDB DB Instance Event",
  "source": "aws.timestream-influxdb",
  "account": "123456789012",
  "time": "2026-07-11T05:15:01Z",
  "region": "us-west-2",
  "resources": [
    "arn:aws:timestream-influxdb:us-west-2:123456789012:db-instance/4q8g1gli53"
  ],
  "detail": {
    "EventCategories": ["notification"],
    "SourceType": "DB_INSTANCE",
    "SourceArn": "arn:aws:timestream-influxdb:us-west-2:123456789012:db-instance/4q8g1gli53",
    "Date": "2026-07-11T05:15:01.680Z",
    "Message": "InfluxDB v2 instance 'test-eventbridge-verify' storage updated",
    "SourceIdentifier": "test-eventbridge-verify",
    "EventID": "TIDB-EVENT-12002"
  }
}
Delete — CloudTrail-based event
{
  "version": "0",
  "id": "2e3121b9-11c4-3a4e-8c36-204768460501",
  "detail-type": "AWS API Call via CloudTrail",
  "source": "aws.timestream-influxdb",
  "account": "123456789012",
  "time": "2026-07-11T05:17:07Z",
  "region": "us-west-2",
  "resources": [],
  "detail": {
    "eventName": "DeleteDbInstance",
    "requestParameters": {
      "identifier": "4q8g1gli53"
    },
    "responseElements": {
      "allocatedStorage": 25,
      "arn": "arn:aws:timestream-influxdb:us-west-2:123456789012:db-instance/4q8g1gli53",
      "name": "test-eventbridge-verify",
      "status": "DELETING"
    }
  }
}

(Only the main fields are excerpted)

Delete — New event
{
  "version": "0",
  "id": "9749cf8c-8eba-7e52-e42a-d71821e7fe12",
  "detail-type": "Timestream InfluxDB DB Instance Event",
  "source": "aws.timestream-influxdb",
  "account": "123456789012",
  "time": "2026-07-11T05:22:34Z",
  "region": "us-west-2",
  "resources": [
    "arn:aws:timestream-influxdb:us-west-2:123456789012:db-instance/4q8g1gli53"
  ],
  "detail": {
    "EventCategories": ["notification"],
    "SourceType": "DB_INSTANCE",
    "SourceArn": "arn:aws:timestream-influxdb:us-west-2:123456789012:db-instance/4q8g1gli53",
    "Date": "2026-07-11T05:22:34.839Z",
    "Message": "InfluxDB v2 instance 'test-eventbridge-verify' deleted",
    "SourceIdentifier": "test-eventbridge-verify",
    "EventID": "TIDB-EVENT-13001"
  }
}

Comparison summary

Aspect CloudTrail-based event New state change event
detail-type AWS API Call via CloudTrail Timestream InfluxDB DB Instance Event
Firing timing When the API call is recorded After the operation completes (in the success cases tested here)
resources field Empty array ARN of the DB instance
Contents of detail Main request/response parameters EventID, Message, EventCategories, SourceArn, etc.
Who performed the operation Can be confirmed via userIdentity Not included
Whether the operation completed Final completion cannot be determined from a single event (status is in progressive form) In the success events confirmed here, a signal indicating successful completion of the operation

Choosing between use cases

  • CloudTrail-based events: Record "who" called the API, "when", and "with which parameters". Well suited to audit logs, security alerts, and detection of unauthorized operations
  • New state change events: Notify the result of a state change, such as successful completion or failure of an operation. The success events confirmed here are well suited to triggering follow-up processing (Slack notifications, starting Step Functions, updating dashboards)

The two are complementary, and can be used together by filtering on detail-type in EventBridge rules.

Summary

The new EventBridge events for Timestream for InfluxDB had a simple structure that notifies the result of DB instance state changes.

In the success cases confirmed here, for each of the create, reboot, storage update, and delete operations, a state change event indicating operation completion arrived after the CloudTrail-based event. While the CloudTrail-based events record the fact of the API call and the main request/response parameters, the new events concisely convey the operation result through EventID, Message, and so on.

This verification confirmed events for success cases, but events are also published on failure. I felt this is an update that makes it easy to split roles: CloudTrail for auditing API calls, and the new state change events for follow-up processing triggered by operation results.

References

Share this article

AWSのお困り事はクラスメソッドへ