Amazon EventBridge: Event Buses, Rules, Patterns, and Targets

Purpose of This Lesson

Amazon EventBridge provides an event-driven way to detect activity from AWS services, custom applications, and SaaS applications, then route matching events to configured targets. For the AWS Certified CloudOps Engineer Associate SOA-C03 context, focus on recognizing the event source, identifying the event pattern, and selecting the appropriate target for notification or remediation.

EventBridge was formerly known as Amazon CloudWatch Events. Some related functionality may still appear in CloudWatch, but EventBridge is now a separate service.

Key Concepts

• Event source: The service or application that produces an event. Sources can include AWS services, custom applications, and SaaS applications.
• Event: A record describing something that happened, such as an EC2 instance terminating or an API call being made.
• Event bus: The channel through which events are received and made available for rule evaluation.
• Rule: A configuration that evaluates incoming events against an event pattern and determines what should happen when a match occurs.
• Event pattern: The filtering criteria that identify relevant events. Patterns can be created using console selections or edited directly.
• Target: The destination or action invoked when a rule matches an event. Examples in this lesson include Amazon SNS, AWS Lambda, and Amazon DynamoDB workflows.

The basic flow is:

Event source → Event bus → Rule and event pattern → Target

EventBridge Event Routing and Monitoring Context

EC2 instance termination notification

An Amazon EC2 event source can report an EC2 instance state change notification. A rule can filter for the terminated state and route matching events to an Amazon SNS target. SNS can then be used to notify an interested person, such as a manager, that an instance was terminated.

The rule can be broad or narrow:

• Match termination events for any instance.
• Match a specific instance ID.
• Match multiple specified instance IDs.

An event can include details such as the AWS Region, event timestamp, source, detail type, and the resource involved. For an EC2 state-change event, the resource identifies the affected instance.

Detecting an S3 bucket policy API call

AWS CloudTrail can be the event source when the requirement is to react to API activity. For example, a rule can match the S3 PutBucketPolicy API event. The event data identifies that the event was an AWS API call recorded through CloudTrail, includes CloudTrail as the source, and identifies the API operation through the event name.

This pattern is different from an EC2 state-change rule: the trigger is not a resource state transition but an API call made in the account. A matching rule could route the event to a notification target or another processing workflow.

Exam- or Assessment-Relevant Takeaways

• EventBridge is the modern successor to CloudWatch Events; recognize both names when interpreting AWS documentation or console references.
• Separate the four major components: source, event bus, rule/pattern, and target.
• Use an EC2 state-change event pattern when responding to instance lifecycle changes such as termination.
• Use CloudTrail-backed event matching when responding to API activity, such as an S3 bucket policy being applied.
• SNS is an appropriate target when the desired result is a notification.
• Lambda is a suitable target when the event should trigger custom processing; the lesson also gives a Lambda-and-DynamoDB workflow as an example for recording a termination event.
• Event patterns can be narrowed by event type, state, and resource or instance ID.
• The console’s selections can generate an event pattern automatically, but the pattern can also be edited directly.

Tool / Feature Decision Guide

Requirement	Event source or pattern	Useful target or workflow	Decisive reason
Notify someone when an EC2 instance terminates	EC2 instance state change notification filtered to terminated	Amazon SNS	The requirement is direct notification.
Record an EC2 termination for later use	EC2 instance state change notification filtered to terminated	Lambda processing that writes to DynamoDB	The event needs application logic and persistence rather than only an alert.
Detect that an S3 bucket policy API operation occurred	CloudTrail event matching the S3 PutBucketPolicy event name	Notification or another processing target	CloudTrail exposes account API activity as events.
Match only selected EC2 resources	EC2 state-change pattern filtered by one or more instance IDs	Any appropriate target	Resource filtering reduces unrelated event matches.
Match all relevant resources	EC2 state-change pattern without a specific instance restriction	Any appropriate target	Broader matching is useful when every matching lifecycle event matters.

Common Traps / Misconceptions

• Confusing the event bus with the rule: The event bus receives events; the rule evaluates them and determines the target action.
• Treating every event as an API call: An EC2 instance state-change notification describes a lifecycle event, while the S3 example is an API call observed through CloudTrail.
• Assuming EventBridge only handles AWS services: Custom applications and SaaS applications can also act as event sources.
• Filtering only by service: Selecting EC2 is not necessarily enough. The event type, state, and resource scope may need additional filtering.
• Assuming the console-generated pattern is immutable: The console can create a starting pattern, and that pattern can be edited directly.
• Choosing SNS for processing logic: SNS is appropriate for notification. A Lambda target is more suitable when custom logic is required.
• Ignoring resource scope: A rule that matches any instance may produce more notifications than one limited to specific instance IDs.

Real-World Engineer / Analyst Notes

• Start with the operational question: “What happened, and where did the event originate?” This helps distinguish an EC2 state change from a CloudTrail API activity event.
• Define the narrowest event pattern that still satisfies the requirement. Filtering by state and resource reduces unnecessary downstream actions.
• Use notification targets for awareness and processing targets for automation. A termination event may require both—for example, an SNS alert and a Lambda workflow that records the event in DynamoDB.
• Inspect the event fields before designing the rule. Region, timestamp, source, detail type, and resource identifiers determine what can be filtered and what information can be passed to a target.
• Treat event-driven workflows as operational controls: a rule can notify personnel about potentially significant activity, such as an unexpected instance termination or bucket policy change.

Quick Reference Summary

• Former name: Amazon CloudWatch Events.
• Sources: AWS services, custom applications, and SaaS applications.
• Core path: Source → event bus → rule/pattern → target.
• EC2 example: Match an EC2 instance state change notification with state terminated.
• CloudTrail example: Match the S3 PutBucketPolicy API event.
• Notification target: Amazon SNS.
• Processing and persistence example: Lambda processes the event and writes a record to DynamoDB.
• Filtering options discussed: Event type, state, any resource, one instance ID, or multiple instance IDs.
• Pattern creation: Console selections can generate a pattern, which can then be edited.

Flashcards

Q: What is the basic processing flow in Amazon EventBridge?
A: An event source sends an event to an event bus; a rule evaluates the event pattern and routes matching events to a target.

Q: A team wants an email-style notification when any EC2 instance is terminated. Which EventBridge design fits?
A: Use an EC2 instance state change notification rule filtered to terminated, with Amazon SNS as the target.

Q: When would you choose Lambda instead of SNS as an EventBridge target?
A: Choose Lambda when the event requires custom processing, such as transforming the event or writing a termination record to DynamoDB. SNS is better for direct notification.

Q: How do an EC2 state-change event and a CloudTrail event differ in the examples?
A: The EC2 example represents a resource lifecycle event, while the CloudTrail example represents an API call—S3 PutBucketPolicy—made in the account.

Q: What EventBridge source should be examined when the requirement is to react to an S3 bucket policy API operation?
A: Use CloudTrail as the event source and match the relevant event name, S3 PutBucketPolicy.

Q: What is the role of an EventBridge event bus?
A: It receives events from event sources and makes them available for rules to evaluate; it does not itself define the filtering or final action.

Q: How can an EC2 termination rule be narrowed to avoid matching every instance?
A: Filter the event pattern by one specific instance ID or by multiple instance IDs, in addition to matching the terminated state.

Q: What is the difference between an event pattern and a target?
A: The event pattern defines which incoming events match; the target is the destination or action invoked after a match.

Q: What information can an EventBridge event include in the EC2 example?
A: It can include the Region, timestamp, source, detail type, and the instance ID of the affected resource.

Q: Why might an engineer edit a console-generated event pattern directly?
A: The console provides a convenient starting point, but direct editing allows the filtering criteria to be customized more precisely.

Q: What was Amazon EventBridge previously called?
A: It was previously called Amazon CloudWatch Events, although EventBridge is now a separate service.

Q: Can EventBridge receive events only from AWS services?
A: No. The lesson identifies AWS services, custom applications, and SaaS applications as possible event sources.

Practice Questions

Question 1

A CloudOps team must alert a manager whenever a production EC2 instance is terminated, but should not alert on terminations of other instances. Which configuration is most appropriate?

A. Match all CloudTrail API events and send them to Lambda
B. Match EC2 instance state change notifications for terminated, filtered to the production instance ID, and send them to SNS
C. Match all EC2 state changes and write them to DynamoDB
D. Match S3 PutBucketPolicy events and send them to SNS

Correct answer: B

The decisive clues are the EC2 lifecycle event, the terminated state, the need to limit the rule to a specific instance, and the notification requirement.

Question 2

An organization wants to detect whenever someone applies an S3 bucket policy. Which event information should the EventBridge rule use?

A. EC2 instance state change with state stopped
B. An SNS delivery event
C. A CloudTrail event with the S3 PutBucketPolicy event name
D. A DynamoDB record insertion event

Correct answer: C

The requirement concerns an API call, and the example identifies CloudTrail as the source and S3 PutBucketPolicy as the event name.

Question 3

An EC2 termination event must be stored in DynamoDB for later operational analysis, and custom logic is needed before the record is written. Which target workflow best fits?

A. Send the event directly to SNS only
B. Send the event to Lambda, which records it in DynamoDB
C. Send the event to an EC2 instance state change notification
D. Use CloudTrail as the target

Correct answer: B

Lambda provides the processing step, while DynamoDB provides the example persistence destination described in the lesson.

Question 4

An engineer selects AWS service = EC2, event type = instance state change notification, and state = terminated in the EventBridge console. What does the console selection produce?

A. An automatically generated event pattern that can be edited
B. A target that always sends email
C. A CloudTrail trail that records the event
D. A DynamoDB table containing all EC2 instances

Correct answer: A

The console selections automatically create an event pattern, and the pattern can be edited directly if needed.

WordPress Metadata

Suggested Slug:
amazon-eventbridge-event-buses-rules-patterns-targets-soa-c03

Meta Description:
Study how Amazon EventBridge routes AWS, custom, and SaaS events through event buses, rules, event patterns, and targets for monitoring and remediation workflows.

Tags:
Amazon EventBridge, AWS CloudOps, CloudWatch Events, EventBridge rules, Event buses, Event patterns, Amazon EC2, AWS CloudTrail, Amazon SNS, Amazon S3