Monitoring and Optimization · Topic 3 of 6
EventBridge, SNS and Automated Remediation
Use Amazon EventBridge rules, SNS topics, alarm actions and Systems Manager Automation to detect problems and fix them automatically, a core SOA-C03 skill.
- 4 min
- Includes a diagram
- EventBridge matches events with rules and sends them to targets. The default bus receives AWS service events.
- SNS is publish and subscribe, so one message reaches many subscribers.
- A CloudWatch alarm can notify SNS or perform actions such as EC2 recover directly.
What it is
Monitoring finds a problem, and remediation fixes it. On AWS you connect the two with events and notifications, so a human is told or a script runs without anyone logging in.
Amazon EventBridge is the event router. It receives events from AWS services, your own applications and partners, matches them against rules, and sends them to targets. Amazon SNS (Simple Notification Service) is the notification service that fans a message out to many subscribers.
How it works
EventBridge rules
An event bus receives events. Every account has a default bus that receives events from AWS services. A rule has an event pattern (what to match) or a schedule (when to fire), and one or more targets.
Typical targets are Lambda, SNS, SQS (Simple Queue Service), Step Functions and Systems Manager Automation or Run Command. This pattern matches an EC2 instance that has stopped.
{
"source": ["aws.ec2"],
"detail-type": ["EC2 Instance State-change Notification"],
"detail": { "state": ["stopped"] }
}Other useful sources are CloudWatch alarm state changes, AWS Health events and API calls recorded by CloudTrail. A rule needs a role if its target requires one, for example to start an Automation runbook.
SNS topics
A publisher sends a message to an SNS topic, and every subscriber gets a copy. Subscribers can be email, SMS (text messages), HTTP endpoints, Lambda and SQS queues.
Use SNS when people or several systems need the same alert. Email subscriptions must be confirmed by the recipient before they receive messages.
| Service | Role in remediation |
|---|---|
| CloudWatch alarm | Detects a threshold breach and can call SNS or Auto Scaling directly |
| EventBridge | Matches events and routes them to automation |
| SNS | Notifies people or fans out to many systems |
| Lambda | Runs custom code to fix or enrich |
| Systems Manager Automation | Runs a managed runbook against resources |
Remediation choices
Pick the simplest tool that does the job.
- Alarm action: for built in actions such as EC2 recover or reboot, or an Auto Scaling policy.
- EventBridge to Lambda: for custom logic, such as tagging or isolating an instance.
- EventBridge to Systems Manager Automation: to run a runbook such as
AWS-RestartEC2Instance, which keeps logic in a reviewed, reusable document. - AWS Config remediation: to fix a non compliant resource found by a Config rule. Config can run an Automation runbook for you.
Systems Manager OpsCenter
OpsCenter collects operational issues as OpsItems in one place. An alarm or EventBridge rule can create an OpsItem, which gives your team a work queue with related resource details.
Scheduled actions
EventBridge can also run on a schedule. Use it to stop development instances in the evening or to trigger a nightly job.
# AWS CLI: rule that runs every day at 18:00 UTC
aws events put-rule --name StopDevNightly \
--schedule-expression "cron(0 18 * * ? *)"Exam wording such as "automatically", "without manual intervention" or "when X happens" points at EventBridge plus a target such as Lambda or Systems Manager Automation.
What to remember for the exam
- EventBridge matches events with rules and sends them to targets. The default bus receives AWS service events.
- SNS is publish and subscribe, so one message reaches many subscribers.
- A CloudWatch alarm can notify SNS or perform actions such as EC2 recover directly.
- Systems Manager Automation runs runbooks, and EventBridge or Config can start them.
- AWS Config remediation fixes non compliant resources by running an Automation runbook.
- Rule targets that need permission use an IAM role attached to the rule.
- Schedule expressions in EventBridge use cron or rate syntax.
- Email subscribers to SNS must confirm the subscription.
Common mistakes
Using SNS where routing logic is needed. SNS delivers messages. It does not match event patterns on AWS service events. Use EventBridge for that.
Forgetting the target permission. A rule that targets Automation or another service needs a role with the right access, or the target invocation fails.
Writing a Lambda function when a managed runbook exists. Prefer a Systems Manager runbook when one already does the job, as it is easier to audit.
Looking in the wrong Region. Events are Regional, so a rule must be in the same Region as the source resource for most services.
Assuming an email works at once. Unconfirmed email subscriptions do not get alerts.
Automatic remediation can make an outage worse if it loops, for example restarting an instance that fails again. Limit retries and alert a human after repeated failures.
Check yourself
Test yourself on these.
Which service routes an EC2 state change event to a Lambda function?
Amazon EventBridge, using a rule with an event pattern and the function as target.
What is the main purpose of an SNS topic?
To deliver one published message to many subscribers such as email, SMS, SQS and Lambda.
How can a non compliant S3 bucket be fixed automatically?
Attach an AWS Config remediation action that runs a Systems Manager Automation runbook.
Topic 3 of 6 in Monitoring and Optimization
Test yourself on Monitoring and Optimization
The full AWS SOA-C03 question bank has 850 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by AWS. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.