EventBridge Event Routing

What it is

Amazon EventBridge is a serverless event bus. Services and applications publish events (small JSON documents describing something that happened), and rules match events and send them to targets.

This is the backbone of event driven operations on AWS. An instance changes state, a pipeline fails or a GuardDuty finding arrives, and a rule routes it to a function, a runbook or a notification, with no polling.

How it works

Buses and sources

Common AWS event sources include EC2 state changes, Auto Scaling lifecycle actions, CodePipeline and CodeBuild state changes, ECS task state changes, AWS Health, AWS Config compliance changes, GuardDuty findings and CloudWatch alarm state changes. Any API call recorded by CloudTrail can also become an event with the detail type AWS API Call via CloudTrail, which makes a very wide range of actions observable.

Rules and patterns

A rule has either an event pattern or a schedule. A pattern is JSON that names the fields to match, and any field you omit is ignored.

{
  "source": ["aws.ec2"],
  "detail-type": ["EC2 Instance State-change Notification"],
  "detail": {"state": ["terminated"]}
}

Patterns support content filtering: prefix matching, anything-but, numeric comparisons, exists and others. Match on as much as you can in the rule, so targets only run for events that matter.

Targets

A rule can have up to five targets. Typical targets are Lambda functions, Step Functions state machines, Systems Manager Automation and Run Command, SNS topics, SQS queues, Kinesis streams, CodePipeline pipelines, ECS tasks, API destinations (external HTTP endpoints) and other event buses. An input transformer reshapes the event before it reaches the target.

aws events put-rule --name ec2-terminated --event-pattern file://pattern.json
aws events put-targets --rule ec2-terminated \
  --targets "Id=1,Arn=arn:aws:lambda:us-east-1:111122223333:function:notify"
aws lambda add-permission --function-name notify --statement-id eb-ec2 \
  --action lambda:InvokeFunction --principal events.amazonaws.com \
  --source-arn arn:aws:events:us-east-1:111122223333:rule/ec2-terminated

The permission step matters. For Lambda, SNS and SQS targets, the target's own resource policy must allow EventBridge to call it.

For most other targets, the target definition names an IAM role that EventBridge assumes. The console adds the Lambda permission for you, but the CLI and CloudFormation do not.

Schedules

A rule can run on a rate or a cron expression, but EventBridge Scheduler is the newer, richer option. It supports one time and recurring schedules at large scale, with time zones, flexible time windows and retries, and it can call many service APIs directly.

Cross account and cross Region

To send events to another account, the target account's bus needs a resource policy that allows the source account (or the whole organization) to put events. The source rule then names that bus as a target. The same mechanism works across Regions.

This pattern collects events from every account in a central security or operations account, which is the standard design for organization wide automation.

Reliability features

• Retries: EventBridge retries failed deliveries for up to 24 hours by default, and you can shorten that with a retry policy.
• Dead letter queue: a target can have an SQS queue that stores events that could not be delivered.
• Archive and replay: an archive stores events from a bus, and a replay sends them again to the bus, which helps recover after a bug in a consumer.
• At least once delivery: a target may receive the same event twice, so handlers must be idempotent.

EventBridge Pipes

Pipes connect a source such as SQS, Kinesis or DynamoDB Streams to a target, with optional filtering and enrichment in the middle. They suit point to point integrations where a bus with many rules is more than you need.

Choosing between services