Live events

Live events keep your Port catalog up to date between scheduled resyncs. AWS records API calls as CloudTrail management events, EventBridge matches supported API calls, and forwards them to Port at {LiveEventsUrl}/integration/webhook. The integration authenticates each request with the live events API key and updates the matching catalog entity.

Live events are deployed with a separate CloudFormation stack from the integration IAM stack. They complement full resyncs but do not replace reconciliation. For how live events interact with resyncs, see Sync interactions.

CloudTrail required

Ensure CloudTrail is logging management events in the accounts and regions where you deploy live events. Without CloudTrail events, EventBridge has nothing to forward.

To deploy the live events CloudFormation stack, follow the Live events (optional) step in the installation wizard.

Supported resource kinds

The integration forwards CloudTrail management events for these resource kinds:

Resource kind	Live events
AWS::S3::Bucket	Create and delete
AWS::Lambda::Function	Create, update, and delete
AWS::DynamoDB::Table	Create, update, and delete
AWS::RDS::DBInstance	Create, update, and delete
AWS::RDS::DBCluster	Create, update, and delete
AWS::ECR::Repository	Create and delete
AWS::ECS::Cluster	Create, update, and delete
AWS::ECS::Service	Create, update, and delete
AWS::ECS::TaskDefinition	Register and deregister
AWS::EKS::Cluster	Create, update, and delete
AWS::EC2::Instance	Launch and terminate
AWS::EC2::Volume	Create, modify, and delete
AWS::ElastiCache::Cluster	Create, modify, and delete
AWS::MemoryDB::User	Create, update, and delete
AWS::CodeBuild::Project	Create, update, and delete
AWS::CodeBuild::BuildRun	Start, stop, and retry
AWS::CodeDeploy::Deployment	Create and stop
AWS::CodePipeline::Pipeline	Create, update, and delete
AWS::CodePipeline::PipelineExecution	Start and stop
AWS::SNS::Topic	Create, update, and delete
AWS::SQS::Queue	Create, update, and delete
AWS::SES::EmailIdentity	Create, update, and delete
AWS::SES::ConfigurationSet	Create, update, and delete

Unsupported resource kinds

The following kinds are ingested during resyncs but do not receive live events today:

Resource kind	Reason
AWS::Account::Info	Account metadata is synced from account-level APIs, not from regional CloudTrail CRUD events.
AWS::Organizations::Account	Organization account lifecycle events are not mapped to live events yet.
AWS::MSK::Cluster	Same CloudTrail events also map to AWS::MSK::ServerlessCluster, so the kind cannot be identified reliably.
AWS::MSK::ServerlessCluster	Same CloudTrail events also map to AWS::MSK::Cluster, so the kind cannot be identified reliably.
AWS::CodeDeploy::Application	CloudTrail exposes mutable application names, not stable ARNs.
AWS::CodeDeploy::DeploymentGroup	CloudTrail exposes mutable group names, not stable ARNs.
AWS::CodePipeline::Stage	Derived from pipeline definitions; CloudTrail has no per-stage CRUD events.
AWS::CodePipeline::Action	Derived from pipeline definitions; CloudTrail has no per-action CRUD events.
AWS::CodePipeline::ActionExecution	No CloudTrail API events; lifecycle updates use CodePipeline EventBridge state-change events not supported by live events yet.

Troubleshooting

Events not appearing in Port

• Confirm the live events API key in Port matches the LiveEventsApiKey CloudFormation parameter.
• Verify CloudTrail is enabled and logging management events in the account and region where you changed the resource.
• Check that the resource kind is in the supported list. Unsupported kinds update only during resyncs.
• For multi-account setups, confirm StackSet operations succeeded in the StackSets console.
• For self-hosted ECS or EC2 setups, confirm EnableLiveEvents is true on the Ocean stack and that your public HTTPS URL routes to Ocean on port 8000.
• For self-hosted IRSA or IAM User setups, confirm OCEAN__BASE_URL and OCEAN__INTEGRATION__CONFIG__LIVE_EVENTS_API_KEY are set and ingress routes HTTPS traffic to /integration/webhook.

Stack creation failed

• Insufficient IAM permissions: Ensure your AWS user can create CloudFormation stacks, IAM roles, EventBridge connections, and StackSets (for multi-account).
• Regions not enabled: Live events deploy only to enabled AWS regions. Enable the region in Account settings or remove it from the Regions parameter.
• Multi-account regions missing: The Regions parameter is required for multi-account live events stacks.