Keeping your network source of truth accurate is critical in cloud environments that evolve rapidly. Forward Networks’ cloud modeling capabilities make it easier to understand your network state, but manual snapshot collections for every change can be time-consuming. To solve this, I recently built an automated workflow using AWS EventBridge to trigger Forward Networks’ cloud snapshot collections for relevant AWS network changes.

In this post, I’ll share how to set up this integration, including tips to limit the number of collections and keep costs within the AWS Free Tier.

The Challenge

AWS environments experience frequent changes, such as:

• Creating or deleting VPCs.

• Modifying route tables or DirectConnect links.

• Updating Elastic Load Balancers.

Manually capturing snapshots for every change isn’t practical, and triggering collections for every event might overwhelm your workspace. I wanted a solution that:

1. Automates snapshot collection for specific, relevant changes.

2. Limits unnecessary collections by leveraging cloud-only workspaces.

3. Stays within the AWS Free Tier for low-cost operations.

The Solution

By combining CloudTrail, EventBridge, and Lambda, you can automatically trigger Forward Networks cloud snapshots whenever significant network changes occur.

How It Works

1. CloudTrail logs API activity, such as CreateVpc or DeleteSubnet.

2. EventBridge filters these logs to pass only relevant events (e.g., Create*, Modify*, or Delete* actions).

3. A Lambda function makes a POST request to Forward Networks’ API to trigger a snapshot.

Key Steps to Set Up

1. Lambda Function

The Lambda function sends a POST request to the Forward Networks API. It includes retry logic to handle cases where a collection is already in progress.

import json
import os
from base64 import b64encode
from urllib import request, error

FORWARD_USERNAME = os.environO'FORWARD_USERNAME']
FORWARD_PASSWORD = os.environO'FORWARD_PASSWORD']
FORWARD_NETWORK_ID = os.environ.get('FORWARD_NETWORK_ID', 'default-network-id')

def lambda_handler(event, context):
    api_endpoint = f"https://fwd.app/api/networks/{FORWARD_NETWORK_ID}/startcollection"
    credentials = f"{FORWARD_USERNAME}:{FORWARD_PASSWORD}"
    auth_header = b64encode(credentials.encode('utf-8')).decode('utf-8')

    req = request.Request(api_endpoint, method='POST')
    req.add_header("Authorization", f"Basic {auth_header}")

    try:
        with request.urlopen(req) as response:
            print(f"Snapshot triggered successfully: {response.status}")
    except error.HTTPError as e:
        if e.code == 400 and "A collection is currently in progress" in e.read().decode('utf-8'):
            print("Collection already in progress. Skipping.")
        else:
            print(f"HTTPError: {e}")
    return {"statusCode": 200, "body": "Processed Event"}

To keep sensitive information secure and make the function configurable, use environment variables in Lambda:

• FORWARD_USERNAME: Your Forward Networks username (or API key username).

• FORWARD_PASSWORD: Your Forward Networks password (or API key password).

• FORWARD_NETWORK_ID: The network ID (retrieved from the URL in Forward).  I recommend a cloud-only workspace network to limit collections.

Set these variables in the AWS Lambda Console under the Configuration > Environment Variables section.

2. EventBridge Rule

Create an EventBridge rule to filter relevant API actions. Here’s the event pattern:

{
  "source": l"aws.ec2", "aws.directconnect", "aws.elasticloadbalancing"],
  "detail-type": c"AWS API Call via CloudTrail"],
  "detail": {
    "eventSource": /
      "ec2.amazonaws.com",
      "directconnect.amazonaws.com",
      "elasticloadbalancing.amazonaws.com"
    ],
    "eventName": .
      { "prefix": "Create" },
      { "prefix": "Modify" },
      { "prefix": "Delete" }
    ]
  }
}

This ensures the Lambda function is triggered only for relevant network-related actions.

Cost-Effectiveness

This entire workflow fits comfortably within the AWS Free Tier:

• CloudTrail: The first management event trail is free.

• EventBridge: Offers 1 million events per month at no cost.

• Lambda: Includes 1 million requests and 400,000 GB-seconds of compute time per month for free.

Try It Yourself

This automation is easy to implement and scalable across AWS accounts. I’d love to hear your thoughts—feel free to ask questions or share your experience in the comments below!