AWS Cloud Practitioner Study Notes · Part 53
Amazon EventBridge: Events, Rules, Event Buses, and Targets
AWS Cloud Practitioner study notes explaining Amazon EventBridge event routing, rules, custom events, schedules, Pipes, targets, and SNS/SQS comparisons.
Amazon EventBridge is a serverless event bus that receives events from AWS services, custom applications, and supported SaaS providers, then routes matching events to targets. It is a central building block for event-driven architectures and infrastructure automation.
This is Part 53 of the AWS Cloud Practitioner Study Notes. The shortest mental model is:
Event
↓
Rule and event pattern
↓
Target or targetsEventBridge is the traffic controller for events. AWS manages the underlying infrastructure, scaling, and service availability. You manage the event buses, rules, patterns, targets, schedules, permissions, and delivery design.
What is an event?
An event is a JSON representation of something that happened or is scheduled to happen. Examples include:
- An EC2 instance changed state.
- An S3 object was created.
- A CloudFormation stack was updated.
- A CodePipeline deployment failed.
- AWS Config marked a resource non-compliant.
- A CloudWatch alarm changed state.
- A customer application published
OrderCreated. - A scheduled time arrived.
Example EC2 event shape:
{
"source": "aws.ec2",
"detail-type": "EC2 Instance State-change Notification",
"detail": {
"state": "running"
}
}Events have a common top-level structure, but the detail fields depend on the source and event type. EventBridge uses those fields when evaluating event patterns.
Event sources
EventBridge can receive events from:
- AWS services
- Your own applications and microservices
- Supported SaaS partner applications
- Scheduled rules or EventBridge Scheduler
- CloudTrail-delivered API events
When an AWS service sends an event in your account, it normally goes to the account’s default event bus. AWS services can emit events such as EC2 state changes or CloudFormation stack changes without your application writing event-publishing code.
Your application can publish custom events with the EventBridge PutEvents API or an AWS SDK:
{
"Source": "my.company.orders",
"DetailType": "OrderCreated",
"Detail": "{\"orderId\":\"12345\",\"total\":99.95}",
"EventBusName": "orders-bus"
}The application chooses what business event to publish. EventBridge then handles routing to consumers that have matching rules.
Event buses
An event bus receives events and evaluates them against rules. Every AWS account has a default event bus for AWS service events. You can also create custom event buses for application or domain events.
Default event bus
→ AWS service events
Custom event bus
→ Application and domain eventsCustom buses can help separate domains such as orders, billing, inventory, and security. Event buses can also participate in cross-account event routing when the required resource policies and permissions are configured.
A source sends an event to a bus. The bus evaluates every rule associated with it. One event can match multiple rules, and an event that matches no rules can be ignored or handled by another design such as an archive.
Rules and event patterns
Rules define what EventBridge should do with events arriving at a bus. An event-pattern rule selects events based on fields such as source, detail type, and values inside detail.
Example: match only EC2 termination events:
{
"source": ["aws.ec2"],
"detail-type": ["EC2 Instance State-change Notification"],
"detail": {
"state": ["terminated"]
}
}If an event matches the pattern, EventBridge sends it to the rule’s target or targets. If an EC2 instance starts or stops, this particular rule does nothing.
EventBridge event patterns are content-based filters. Use precise patterns to avoid invoking a target for irrelevant events. The EventBridge Sandbox can help test a pattern against sample event JSON before deploying it.
Targets
A target is the destination that receives a matching event. Common targets include:
- AWS Lambda
- Amazon SNS
- Amazon SQS
- AWS Step Functions state machines
- Amazon ECS tasks
- AWS Batch jobs
- Kinesis streams
- API destinations
- Another event bus
- Systems Manager Automation and other supported AWS actions
EC2 terminated
↓
EventBridge rule
├── Lambda creates a ticket
├── SNS notifies the operations team
├── SQS buffers a cleanup task
└── Archive stores the event for replayEventBridge needs permission to invoke or send to the target. A rule can have multiple targets, and target delivery is managed by the EventBridge service.
Example: S3 object created
An image-processing workflow can be event-driven:
User uploads image.jpg to S3
↓
S3 event
↓
EventBridge rule
↓
Lambda function
↓
Resize image and write thumbnailS3 can also send events directly through S3 Event Notifications. EventBridge is especially useful when you want centralized routing, content-based filtering, multiple targets, cross-account routing, or a consistent event bus for several sources.
Example: AWS Config remediation
AWS Config can produce compliance state events:
S3 bucket becomes non-compliant
↓
AWS Config event
↓
EventBridge rule
↓
Systems Manager Automation
↓
Apply approved remediation or notify securityEventBridge routes the event; AWS Config evaluates compliance; Systems Manager performs the operational procedure.
Example: CloudWatch alarm state change
CloudWatch evaluates metrics and alarms. EventBridge can react when an alarm changes state:
CPU metric crosses threshold
↓
CloudWatch alarm enters ALARM
↓
EventBridge rule matches the state change
↓
Lambda, SNS, or incident workflowCloudWatch creates the alarm and evaluates the threshold. EventBridge routes the resulting state-change event. EventBridge is not a replacement for a CloudWatch metric alarm when the requirement is threshold evaluation.
Scheduled rules and EventBridge Scheduler
EventBridge can start work on a schedule instead of waiting for an incoming event:
Every day at 2:00 AM
↓
Schedule
↓
Lambda cleanup functionScheduled rules are useful for simple recurring tasks. EventBridge Scheduler is a dedicated scheduling capability with additional scheduling features and a broader set of target API operations. For new scheduling designs, compare the current Scheduler documentation with legacy scheduled rules.
Common scheduled workloads include:
- Delete expired temporary files
- Start or stop development environments
- Run a daily report
- Trigger a Step Functions workflow
- Invoke an ECS task
- Send a recurring notification
AWS manages the scheduling infrastructure; you configure the schedule, target, input, retry behavior, and execution role.
Custom business events and decoupling
EventBridge is often used by an application as an integration component. Consider an order service that directly calls every downstream feature:
Order service
├── Send email
├── Update inventory
├── Start payment
├── Generate invoice
├── Notify analytics
└── Update loyalty pointsThe order service becomes tightly coupled to every consumer. With EventBridge:
Order service
↓ publishes OrderCreated
EventBridge
├── Email workflow
├── Inventory queue
├── Payment Step Functions workflow
├── Analytics consumer
└── Loyalty serviceThe producer does not need to know every consumer. A new consumer can be added with a new rule and target without changing the order service’s core workflow.
This is the main architectural value of EventBridge: decoupled producers and consumers with content-based routing.
EventBridge Pipes
EventBridge Pipes are designed for point-to-point integrations. A pipe connects one source to one target and can filter, transform, or enrich the event before delivery.
One event source
↓
EventBridge Pipe
↓
Filter, enrich, or transform
↓
One targetUse an event bus when many producers and consumers need flexible fan-out and routing. Use Pipes when a direct source-to-target integration needs managed filtering, enrichment, or transformation.
Archive and replay
EventBridge event archives can retain matching events. Event replay can send archived events back through a bus to reprocess them after a consumer is fixed or a new rule is added.
Event
↓
Archive
↓ later replay
Event bus and rules
↓
Updated consumer workflowReplay is useful for recovery, testing, backfilling, and adding a new consumer to historical events. Design consumers to be idempotent because event delivery is at least once and a replay can cause an event to be processed again.
EventBridge and CloudTrail
CloudTrail records API activity, and EventBridge can match CloudTrail-delivered events. For example, you can create a rule that reacts when someone deletes an IAM role or changes a security group.
User or service calls AWS API
↓
CloudTrail event
↓
EventBridge rule
↓
Security Lambda or SNS notificationCloudTrail answers “who called the API?” EventBridge answers “what should happen when this event pattern appears?”
CloudTrail-delivered API events use event fields such as detail-type: AWS API Call via CloudTrail, eventSource, and eventName. Use the API operation name when building a precise pattern.
EventBridge versus related services
| Service | Main purpose | Example |
|---|---|---|
| EventBridge | Content-based event routing | EC2 terminated → Lambda and SNS |
| SNS | Pub/sub fan-out and notifications | Alarm → email, Lambda, SQS |
| SQS | Durable message buffering and pull-based processing | Order queue → worker |
| CloudWatch | Metrics, logs, alarms, and observability | CPU > 80% → alarm |
| CloudTrail | API activity auditing | Who deleted the role? |
| AWS Config | Resource configuration and compliance | Is the bucket public? |
EventBridge events are for routing and reaction. SQS is the better fit when a consumer needs durable buffering, back-pressure, ordering with FIFO, or explicit queue-based processing. SNS is the simpler choice for notification fan-out.
Do you manage EventBridge?
You manage the configuration, not the servers:
- Event buses
- Event patterns
- Rules
- Targets
- Schedules
- Archives and replays
- Permissions and IAM roles
- Retry and failure behavior
AWS manages the underlying service infrastructure, scaling, and availability. You still need to design for duplicate delivery, target failures, permissions, dead-letter handling where supported, and idempotent consumers.
Should every application use EventBridge?
No. A small application with one backend and one database may not need an event bus. Adding EventBridge can introduce unnecessary operational and architectural complexity.
EventBridge becomes more valuable when an organisation has:
- Multiple microservices
- Multiple teams or domains
- Many independent consumers
- Frequent new integrations
- AWS infrastructure events requiring automation
- A need to decouple producers from downstream workflows
Use it when the benefits of decoupling and routing outweigh the additional event schemas, observability, retries, and operational design.
Common exam questions
Run a Lambda function whenever a file is uploaded to S3.
Use an EventBridge rule targeting Lambda when centralized routing, filtering, or multiple targets are needed. S3 Event Notifications can also invoke Lambda directly for simpler cases.
Run a Lambda function every night at 2:00 AM.
Use an EventBridge schedule or EventBridge Scheduler.
React when an EC2 instance is terminated.
Use an EventBridge event-pattern rule targeting Lambda, SNS, SQS, or another workflow.
React when AWS Config marks a resource non-compliant.
Use an EventBridge rule with a remediation or notification target.
Route one event to different services based on event content.
Use EventBridge rules with content-based event patterns.
Buffer work until a consumer is ready.
Use SQS, possibly with EventBridge as the event router in front of the queue.
Send an email to many subscribers.
Use SNS, often as an EventBridge target.
Final memory map
CloudWatch
→ Monitor metrics, logs, and alarms
CloudTrail
→ Audit API calls
AWS Config
→ Evaluate resource configuration
EventBridge
→ Route matching events
SNS
→ Notify and fan out
SQS
→ Buffer messagesThe one-sentence takeaway is: EventBridge receives events, filters them with rules, and routes them to one or more targets so infrastructure workflows and application services can stay decoupled.