developersIO
I tried the new "EventBridge state change events" feature of Amazon Timestream for InfluxDB and compared it with CloudTrail

I tried the new "EventBridge state change events" feature of Amazon Timestream for InfluxDB and compared it with CloudTrail

Amazon Timestream for InfluxDB Now Publishes DB Instance State Change Events to EventBridge. We will verify the events published upon successful completion of create, reboot, scaling, and delete operations, and compare the differences in structure and timing with events routed through CloudTrail.
Amazon TimestreamAmazon EventBridgeAWS CloudTrailデータベースAWS
2026.07.11

This page has been translated by machine translation. View original

Introduction

Amazon Timestream for InfluxDB now publishes DB instance lifecycle events to Amazon EventBridge (announced on 2026/07/09).

https://aws.amazon.com/about-aws/whats-new/2026/07/timestream-influxdb-eventbridge/

Previously, there was no event-driven mechanism to detect the completion of DB instance operations, and polling the DescribeDbInstances API was required to confirm completion. With this update, you can now detect operation completion using EventBridge rules without relying on polling.

Item Before Now
State change detection method DescribeDbInstances API polling Automatic notification via EventBridge events
Supported events API events via CloudTrail only (no state change events indicating operation completion) Creation / deletion / scaling / parameter update / maintenance / reboot
Ease of automation Polling + conditional branching required Declarative routing with EventBridge rules

This feature publishes events not only for successful completion but also for failures. In this article, we perform four operations on a DB instance (create, reboot, storage scaling, and delete) and examine the structure of the new state change events published upon success. We also compare the differences with CloudTrail-based events published by the same operations.

Verification Details

Preparation: Creating an EventBridge Rule

We created a rule to forward events matching the source aws.timestream-influxdb to CloudWatch Logs.

# Create rule
aws events put-rule \
  --name "timestream-influxdb-state-change" \
  --event-pattern '{"source": ["aws.timestream-influxdb"]}' \
  --region us-west-2

# Configure CloudWatch Logs target
aws events put-targets \
  --rule "timestream-influxdb-state-change" \
  --targets 'Id=cloudwatch-logs-target,Arn=arn:aws:logs:us-west-2:123456789012:log-group:/aws/events/timestream-influxdb' \
  --region us-west-2

Since this rule filters only by source, in environments where CloudTrail management event recording is enabled, both CloudTrail-based events and new state change events will be captured.

The verification environment is as follows.

  • Region: us-west-2 (Oregon)
  • DB instance: db.influx.medium / 20 GiB / Single-AZ
  • Instance name: test-eventbridge-verify

Creation Event: Full Comparison of CloudTrail and New Event

CloudTrail-Based Event (API Call Record)

The following CloudTrail-based event arrived as a record of the CreateDbInstance API call.

{
  "version": "0",
  "detail-type": "AWS API Call via CloudTrail",
  "source": "aws.timestream-influxdb",
  "time": "2026-07-11T04:51:27Z",
  "region": "us-west-2",
  "resources": [],
  "detail": {
    "eventName": "CreateDbInstance",
    "requestParameters": {
      "allocatedStorage": 20,
      "dbInstanceType": "db.influx.medium",
      "deploymentType": "SINGLE_AZ",
      "name": "test-eventbridge-verify",
      "password": "HIDDEN_DUE_TO_SECURITY_REASONS"
    },
    "responseElements": {
      "arn": "arn:aws:timestream-influxdb:us-west-2:123456789012:db-instance/4q8g1gli53",
      "id": "4q8g1gli53",
      "name": "test-eventbridge-verify",
      "status": "CREATING"
    },
    "eventType": "AwsApiCall",
    "managementEvent": true
  }
}

(Only major fields are shown. See the collapsible section below for the full text.)

As a key point, note that responseElements.status is CREATING (in progress). At this point, the instance is not yet in an available state. Also, requestParameters records the main request parameters at the time of the API call (sensitive values such as passwords and usernames are masked with HIDDEN_DUE_TO_SECURITY_REASONS).

Full CloudTrail-based event (partially masked, click to expand)
{
  "version": "0",
  "id": "4c0f036d-a6cc-dd99-56e4-92a699c2cc4f",
  "detail-type": "AWS API Call via CloudTrail",
  "source": "aws.timestream-influxdb",
  "account": "123456789012",
  "time": "2026-07-11T04:51:27Z",
  "region": "us-west-2",
  "resources": [],
  "detail": {
    "eventVersion": "1.11",
    "userIdentity": {
      "type": "AssumedRole",
      "principalId": "AROAXXXXXXXXXXXXXXXXX:session-name",
      "arn": "arn:aws:sts::123456789012:assumed-role/role-name/session-name",
      "accountId": "123456789012"
    },
    "eventTime": "2026-07-11T04:51:27Z",
    "eventSource": "timestream-influxdb.amazonaws.com",
    "eventName": "CreateDbInstance",
    "awsRegion": "us-west-2",
    "sourceIPAddress": "xxx.xxx.xxx.xxx",
    "userAgent": "aws-cli/2.35.19 ...",
    "requestParameters": {
      "allocatedStorage": 20,
      "bucket": "testbucket",
      "dbInstanceType": "db.influx.medium",
      "deploymentType": "SINGLE_AZ",
      "name": "test-eventbridge-verify",
      "organization": "testorg",
      "password": "HIDDEN_DUE_TO_SECURITY_REASONS",
      "publiclyAccessible": false,
      "username": "HIDDEN_DUE_TO_SECURITY_REASONS",
      "vpcSecurityGroupIds": ["sg-xxxxxxxx"],
      "vpcSubnetIds": ["subnet-xxxxxxxx", "subnet-yyyyyyyy"]
    },
    "responseElements": {
      "allocatedStorage": 20,
      "arn": "arn:aws:timestream-influxdb:us-west-2:123456789012:db-instance/4q8g1gli53",
      "availabilityZone": "us-west-2b",
      "dbInstanceType": "db.influx.medium",
      "dbStorageType": "InfluxIOIncludedT1",
      "deploymentType": "SINGLE_AZ",
      "id": "4q8g1gli53",
      "name": "test-eventbridge-verify",
      "networkType": "IPV4",
      "port": 8086,
      "publiclyAccessible": false,
      "status": "CREATING",
      "vpcSecurityGroupIds": ["sg-xxxxxxxx"],
      "vpcSubnetIds": ["subnet-xxxxxxxx", "subnet-yyyyyyyy"]
    },
    "requestID": "b443fc85-5c1a-420a-8b7a-6b676c0fa3b9",
    "eventID": "6d992928-cdbd-4bd7-8282-949b87f1b9ff",
    "readOnly": false,
    "eventType": "AwsApiCall",
    "managementEvent": true,
    "recipientAccountId": "123456789012",
    "eventCategory": "Management",
    "tlsDetails": {
      "tlsVersion": "TLSv1.3",
      "cipherSuite": "TLS_AES_128_GCM_SHA256",
      "clientProvidedHostHeader": "timestream-influxdb.us-west-2.amazonaws.com"
    }
  }
}

New State Change Event (After Operation Completion)

The following event arrived approximately 8 minutes after the CloudTrail-based event, indicating creation completion.

{
  "version": "0",
  "id": "2c06834f-2e2c-06c2-caf0-eb13c9bc9d39",
  "detail-type": "Timestream InfluxDB DB Instance Event",
  "source": "aws.timestream-influxdb",
  "account": "123456789012",
  "time": "2026-07-11T04:59:20Z",
  "region": "us-west-2",
  "resources": [
    "arn:aws:timestream-influxdb:us-west-2:123456789012:db-instance/4q8g1gli53"
  ],
  "detail": {
    "EventCategories": ["creation"],
    "SourceType": "DB_INSTANCE",
    "SourceArn": "arn:aws:timestream-influxdb:us-west-2:123456789012:db-instance/4q8g1gli53",
    "Date": "2026-07-11T04:59:20.224Z",
    "Message": "InfluxDB v2 instance 'test-eventbridge-verify' created",
    "SourceIdentifier": "test-eventbridge-verify",
    "EventID": "TIDB-EVENT-11001"
  }
}

The main differences from the CloudTrail-based event are as follows.

  • detail-type is Timestream InfluxDB DB Instance Event — a new event type specific to Timestream for InfluxDB
  • resources contains the ARN of the DB instance
  • The detail structure is simple — limited to fields such as EventID, Message, EventCategories, and SourceArn
  • API request/response information is not included — only the result of what happened is notified
  • time is the event publication time after operation completion — whereas CloudTrail records the time of the API call, this is the time the event was published after operation completion

Reboot / Storage Scaling / Deletion Events

CloudTrail + new event pairs also fired for the remaining 3 operations. The differences are as follows.

Operation EventID EventCategories Message
Creation complete TIDB-EVENT-11001 creation InfluxDB v2 instance '...' created
Reboot complete TIDB-EVENT-16001 notification InfluxDB v2 instance '...' rebooted
Storage update complete TIDB-EVENT-12002 notification InfluxDB v2 instance '...' storage updated
Deletion complete TIDB-EVENT-13001 notification InfluxDB v2 instance '...' deleted

Among the four operations tested this time, only creation had EventCategories as creation; the others were notification.

The correspondence between eventName on the CloudTrail side and EventID on the new event side is as follows.

CloudTrail eventName New event EventID CloudTrail status Timing difference
CreateDbInstance TIDB-EVENT-11001 CREATING +approx. 8 min
RebootDbInstance TIDB-EVENT-16001 REBOOTING +approx. 3.5 min
UpdateDbInstance TIDB-EVENT-12002 UPDATING +approx. 6.5 min
DeleteDbInstance TIDB-EVENT-13001 DELETING +approx. 5.5 min

In the four successful operation cases confirmed this time, CloudTrail arrived at the time of the API call record (with status in progress), while the new events arrived after successful completion.

Reboot — CloudTrail-based event
{
  "version": "0",
  "id": "c1f41506-055a-8c81-b3fa-e4a655a33b53",
  "detail-type": "AWS API Call via CloudTrail",
  "source": "aws.timestream-influxdb",
  "account": "123456789012",
  "time": "2026-07-11T05:03:47Z",
  "region": "us-west-2",
  "resources": [],
  "detail": {
    "eventName": "RebootDbInstance",
    "requestParameters": {
      "identifier": "4q8g1gli53"
    },
    "responseElements": {
      "arn": "arn:aws:timestream-influxdb:us-west-2:123456789012:db-instance/4q8g1gli53",
      "name": "test-eventbridge-verify",
      "status": "REBOOTING"
    }
  }
}

(Only major fields are shown.)

Reboot — New event
{
  "version": "0",
  "id": "b8104ebe-f614-b44e-747c-6fd06194edc2",
  "detail-type": "Timestream InfluxDB DB Instance Event",
  "source": "aws.timestream-influxdb",
  "account": "123456789012",
  "time": "2026-07-11T05:07:13Z",
  "region": "us-west-2",
  "resources": [
    "arn:aws:timestream-influxdb:us-west-2:123456789012:db-instance/4q8g1gli53"
  ],
  "detail": {
    "EventCategories": ["notification"],
    "SourceType": "DB_INSTANCE",
    "SourceArn": "arn:aws:timestream-influxdb:us-west-2:123456789012:db-instance/4q8g1gli53",
    "Date": "2026-07-11T05:07:13.193Z",
    "Message": "InfluxDB v2 instance 'test-eventbridge-verify' rebooted",
    "SourceIdentifier": "test-eventbridge-verify",
    "EventID": "TIDB-EVENT-16001"
  }
}
Storage Scaling — CloudTrail-based event
{
  "version": "0",
  "id": "f6a213a5-ebaf-dfa8-b71c-ad11b246956a",
  "detail-type": "AWS API Call via CloudTrail",
  "source": "aws.timestream-influxdb",
  "account": "123456789012",
  "time": "2026-07-11T05:08:24Z",
  "region": "us-west-2",
  "resources": [],
  "detail": {
    "eventName": "UpdateDbInstance",
    "requestParameters": {
      "allocatedStorage": 25,
      "identifier": "4q8g1gli53"
    },
    "responseElements": {
      "allocatedStorage": 20,
      "arn": "arn:aws:timestream-influxdb:us-west-2:123456789012:db-instance/4q8g1gli53",
      "name": "test-eventbridge-verify",
      "status": "UPDATING"
    }
  }
}

(Only major fields are shown. Note that responseElements.allocatedStorage returns the pre-update value of 20, not the 25 specified in the request.)

Storage Scaling — New event
{
  "version": "0",
  "id": "f4826fbd-cd30-3cd0-412c-26ae4a3d21d6",
  "detail-type": "Timestream InfluxDB DB Instance Event",
  "source": "aws.timestream-influxdb",
  "account": "123456789012",
  "time": "2026-07-11T05:15:01Z",
  "region": "us-west-2",
  "resources": [
    "arn:aws:timestream-influxdb:us-west-2:123456789012:db-instance/4q8g1gli53"
  ],
  "detail": {
    "EventCategories": ["notification"],
    "SourceType": "DB_INSTANCE",
    "SourceArn": "arn:aws:timestream-influxdb:us-west-2:123456789012:db-instance/4q8g1gli53",
    "Date": "2026-07-11T05:15:01.680Z",
    "Message": "InfluxDB v2 instance 'test-eventbridge-verify' storage updated",
    "SourceIdentifier": "test-eventbridge-verify",
    "EventID": "TIDB-EVENT-12002"
  }
}
Deletion — CloudTrail-based event
{
  "version": "0",
  "id": "2e3121b9-11c4-3a4e-8c36-204768460501",
  "detail-type": "AWS API Call via CloudTrail",
  "source": "aws.timestream-influxdb",
  "account": "123456789012",
  "time": "2026-07-11T05:17:07Z",
  "region": "us-west-2",
  "resources": [],
  "detail": {
    "eventName": "DeleteDbInstance",
    "requestParameters": {
      "identifier": "4q8g1gli53"
    },
    "responseElements": {
      "allocatedStorage": 25,
      "arn": "arn:aws:timestream-influxdb:us-west-2:123456789012:db-instance/4q8g1gli53",
      "name": "test-eventbridge-verify",
      "status": "DELETING"
    }
  }
}

(Only major fields are shown.)

Deletion — New event
{
  "version": "0",
  "id": "9749cf8c-8eba-7e52-e42a-d71821e7fe12",
  "detail-type": "Timestream InfluxDB DB Instance Event",
  "source": "aws.timestream-influxdb",
  "account": "123456789012",
  "time": "2026-07-11T05:22:34Z",
  "region": "us-west-2",
  "resources": [
    "arn:aws:timestream-influxdb:us-west-2:123456789012:db-instance/4q8g1gli53"
  ],
  "detail": {
    "EventCategories": ["notification"],
    "SourceType": "DB_INSTANCE",
    "SourceArn": "arn:aws:timestream-influxdb:us-west-2:123456789012:db-instance/4q8g1gli53",
    "Date": "2026-07-11T05:22:34.839Z",
    "Message": "InfluxDB v2 instance 'test-eventbridge-verify' deleted",
    "SourceIdentifier": "test-eventbridge-verify",
    "EventID": "TIDB-EVENT-13001"
  }
}

Comparison Summary

Aspect CloudTrail-based event New state change event
detail-type AWS API Call via CloudTrail Timestream InfluxDB DB Instance Event
Trigger timing When the API call is recorded In the successful cases verified this time, after operation completion
resources field Empty array ARN of the DB instance
detail content Main request/response parameters EventID, Message, EventCategories, SourceArn, etc.
Who performed the operation Can be confirmed via userIdentity Not included
Whether the operation completed Cannot determine final completion from a single event (status is in progress) In the successful events verified this time, a signal indicating successful completion of the operation

Use Case Differentiation

  • CloudTrail-based events: Records "who," "when," and "with what parameters" an API was called. Suited for audit logs, security alerts, and unauthorized operation detection.
  • New state change events: Notifies the result of state changes such as successful completion or failure of operations. The successful events verified this time are suited for triggering subsequent processing (Slack notifications, Step Functions invocation, dashboard updates).

The two are complementary and can be used together by filtering on detail-type in EventBridge rules.

Summary

The new EventBridge events for Timestream for InfluxDB had a simple structure that notifies the result of DB instance state changes.

In the successful cases verified this time, for each of the create, reboot, storage update, and delete operations, a state change event indicating operation completion arrived after the CloudTrail-based event. While the CloudTrail-based event records the fact of the API call and the main request/response parameters, the new event concisely communicates the operation result via fields such as EventID and Message.

This verification confirmed successful events, but failure cases are also published. I found this to be an easy-to-use update, where CloudTrail is used for API call auditing and the new state change events are used to trigger subsequent processing based on operation results.

Share this article

AWSのお困り事はクラスメソッドへ