AWS EventBridge Event Sources, Rules, Event Patterns, and Targets

Purpose of This Lesson

This lesson explains how Amazon EventBridge detects events from AWS services, custom applications, and SaaS applications, then routes matching events to configured targets. The key operational skill is recognizing the event source, selecting the relevant event pattern, and choosing an appropriate response target.

EventBridge was previously known as Amazon CloudWatch Events. Although related functionality may still appear in CloudWatch contexts, EventBridge is now a separate service.

Key Concepts

• Event source: The service or application that produces an event. Sources may include AWS services, custom applications, or SaaS applications.
• Event: Something that occurred, such as an EC2 instance terminating or an API call being made.
• Event bus: The EventBridge component that receives events from event sources.
• Rule: A condition that matches incoming events according to an event pattern and determines what should happen next.
• Target: The destination to which a matching event is sent. Examples in this lesson include Amazon SNS, AWS Lambda, and Amazon DynamoDB.
• Event pattern: The structured filter used by a rule to select only relevant events, such as EC2 termination events or a specific CloudTrail API call.

The general flow is:

Event source → Event bus → Rule and event pattern → Target

EventBridge Event Matching and Routing

EventBridge rules evaluate incoming event data. A rule can match broad conditions, such as any EC2 instance state change, or narrow conditions, such as a termination event for one or more specified instance IDs.

The EventBridge console provides default filtering options for common AWS service events. For example, an EC2 rule can be configured with:

• Service type: EC2
• Event type: EC2 instance state-change notification
• State: Terminated
• Resource scope: Any instance or specified instance IDs

The console settings generate an event pattern automatically. That pattern can also be edited directly when more precise matching is required.

Example: Detecting an EC2 Termination

An EC2 instance termination event is published to the event bus. A rule matches the instance state-change notification where the state is terminated. The rule can then send the event to Amazon SNS, which can notify a manager or operations team.

The event data can include information such as:

• AWS Region, such as us-west-1
• Event timestamp
• Event source, such as EC2
• Detailed event type, such as an instance state-change notification
• The affected EC2 instance ID

The instance ID in the event allows downstream handling or notification to identify exactly which resource was terminated.

Example: Detecting an S3 Bucket Policy API Call

CloudTrail can act as the event source for EventBridge. If someone uses the Amazon S3 PutBucketPolicy API operation, CloudTrail records the API activity and the event can be evaluated by an EventBridge rule.

Relevant event data includes:

• The detail type, such as an AWS API call via CloudTrail
• The event source, such as cloudtrail.amazonaws.com
• The event name, PutBucketPolicy

A rule could route a matching event to a notification target, allowing the organization to react when a bucket policy is changed.

Exam- or Assessment-Relevant Takeaways

• Recognize EventBridge as the service that receives events, evaluates rules, and routes matching events to targets.
• Distinguish the event source from the target. EC2 and CloudTrail can produce events, while SNS, Lambda, and DynamoDB can receive the resulting actions.
• For an EC2 termination notification, select an EC2 instance state-change event pattern and filter for the terminated state.
• Use resource-specific matching when the response should apply only to one critical instance or a defined set of instance IDs.
• CloudTrail events are useful for reacting to AWS API activity, such as an S3 PutBucketPolicy call.
• EventBridge does not itself represent the final notification or remediation action; the rule routes the event to a target that performs or delivers that action.

Tool / Feature Decision Guide

Requirement	Suitable EventBridge approach	Reason
Notify staff when an EC2 instance terminates	Match an EC2 instance state-change event and route it to SNS	SNS supports notification delivery for the matching event
Record termination events for later application use	Match the EC2 termination event and route it to Lambda, which can write to DynamoDB	Lambda can process the event before storing a record
Monitor changes to an S3 bucket policy	Use a CloudTrail-based rule matching the S3 PutBucketPolicy event name	The activity is an AWS API call rather than an EC2 resource-state event
React to all matching resources	Leave the resource filter broad, such as any EC2 instance	The rule applies to every event that meets the other conditions
React only to a critical instance	Add the relevant instance ID or IDs to the event pattern	Resource-specific filtering reduces unrelated alerts
Handle conditions not covered by console defaults	Edit the generated event pattern directly	Custom patterns provide more precise matching

Common Traps / Misconceptions

• Confusing EventBridge with CloudWatch Events: CloudWatch Events is the former name. EventBridge is the current separate service discussed here.
• Treating CloudTrail as the target: In the S3 example, CloudTrail is the event source because it supplies AWS API activity. A target would be something such as SNS or Lambda.
• Assuming every EC2 event means termination: EC2 instance state-change notifications can represent states such as starting or stopped. The rule must explicitly filter for terminated when termination is the intended trigger.
• Ignoring resource scope: A rule for any instance may generate responses for many resources. Use instance IDs when only specific instances matter.
• Assuming the event pattern is fixed: Console selections generate a pattern, but the pattern can be edited for more precise matching.
• Confusing event detection with remediation: EventBridge matches and routes the event. The selected target is responsible for notifying, processing, or storing the information.

Real-World Engineer / Analyst Notes

• Begin troubleshooting with the event flow: verify the source produced the expected event, confirm the event reached the event bus, inspect the rule pattern, and then verify the target path.
• Include resource-specific filters for high-value assets to reduce alert noise and make notifications actionable.
• For security-sensitive API activity, such as an S3 bucket policy change, match the CloudTrail event name and source rather than looking for a resource-state notification.
• Choose targets based on the required outcome: SNS for notification, Lambda for programmable processing, and DynamoDB for storing an application-readable record.
• Preserve the affected resource identifier in downstream notifications or records so operators can identify what changed without manually correlating events.

Quick Reference Summary

• EventBridge receives events through an event bus.
• Events may originate from AWS services, custom applications, or SaaS applications.
• Rules use event patterns to determine which events should be processed.
• Targets receive matching events and perform the required notification, processing, or storage action.
• EC2 termination monitoring uses an instance state-change event filtered to terminated.
• CloudTrail can provide API activity events, including an S3 PutBucketPolicy call.
• SNS, Lambda, and DynamoDB are example targets presented in this lesson.
• Event patterns may be generated from console choices and edited manually.

Flashcards

Q: What is the basic EventBridge processing flow?

A: An event source publishes an event to an event bus, a rule evaluates the event pattern, and a matching event is sent to a target.

Q: A team wants an email notification whenever any EC2 instance is terminated. Which event should the rule match?

A: Match an EC2 instance state-change notification with the state set to terminated, then route it to SNS for notification delivery.

Q: When should an EC2 EventBridge rule filter by instance ID instead of matching any instance?

A: Use instance IDs when only one critical instance or a defined group of instances should trigger the response. Matching any instance is broader and may create unnecessary alerts.

Q: What is the difference between an EventBridge event source and target?

A: The source produces the event, such as EC2 or CloudTrail. The target receives a matching event, such as SNS, Lambda, or DynamoDB.

Q: What role does CloudTrail play in an EventBridge rule that detects PutBucketPolicy?

A: CloudTrail is the event source for the AWS API activity. The rule matches the CloudTrail event name and can route it to a notification or processing target.

Q: Which event details can identify the EC2 resource affected by a termination event?

A: The event data includes the affected EC2 instance ID, along with details such as the Region, timestamp, source, and event type.

Q: When would SNS be preferred over Lambda as an EventBridge target in this lesson’s examples?

A: Use SNS when the primary requirement is to notify people or subscribers. Use Lambda when the event requires programmable processing, such as transforming or storing data.

Q: When would Lambda and DynamoDB be used together after an EventBridge event?

A: Lambda can process the matching event and write a record, such as an EC2 termination record, into DynamoDB.

Q: What does an EventBridge rule determine?

A: It determines which incoming events match a specified pattern and which target should receive each matching event.

Q: What is the operational difference between an EC2 state-change event and a CloudTrail API event?

A: An EC2 state-change event reports a resource state transition, such as termination. A CloudTrail event reports API activity, such as someone calling S3 PutBucketPolicy.

Q: What is the trap in selecting the EC2 instance state-change event without selecting a state?

A: The rule may match multiple states, such as starting or stopped, rather than only the termination condition that the alert requires.

Q: Can an EventBridge event pattern created through the console be customized?

A: Yes. The console selections generate an event pattern, and the pattern can be edited directly for more precise matching.

Practice Questions

Question 1

A production EC2 instance must trigger an alert only when it is terminated. Which configuration is most appropriate?

A. Match all CloudTrail events and send them to DynamoDB
B. Match EC2 instance state-change notifications with state terminated and target SNS
C. Match all EC2 events and target Lambda without filtering
D. Match S3 PutBucketPolicy events and target SNS

Correct answer: B

The decisive clues are the EC2 resource-state event, the required terminated state, and the need for a notification target.

Question 2

An organization wants to be notified whenever someone applies a policy to an S3 bucket. Which event pattern is the best fit?

A. EC2 instance state-change notification with state stopped
B. Any event from Amazon SNS
C. A CloudTrail event with event name PutBucketPolicy
D. A DynamoDB record insertion event

Correct answer: C

The requirement concerns an AWS API call. CloudTrail supplies the event, and PutBucketPolicy identifies the relevant operation.

Question 3

An operations team wants to retain a structured record of every EC2 termination for later application use. Which target design best fits the requirement?

A. SNS only
B. Lambda that processes the event and writes to DynamoDB
C. CloudTrail as the target
D. An EC2 state-change notification with no target

Correct answer: B

Lambda provides programmable processing and can store the termination record in DynamoDB. SNS alone is primarily suited to notification.

Question 4

A rule generated by the EventBridge console matches EC2 instance state-change notifications, but it triggers for both stopped and terminated instances. What should be changed?

A. Replace the event bus with CloudTrail
B. Remove the EC2 event source
C. Add or edit the event pattern so the state is terminated
D. Change the target from SNS to DynamoDB

Correct answer: C

The issue is event filtering, not the event bus or target. The rule must restrict the state field to terminated.

WordPress Metadata

Suggested Slug:
aws-eventbridge-event-sources-rules-targets-cloudtrail

Meta Description:
Study how AWS EventBridge receives events from AWS services and CloudTrail, matches event patterns, and routes matching events to targets such as SNS, Lambda, and DynamoDB.

Tags:
AWS EventBridge, Amazon CloudTrail, Amazon EC2, Amazon S3, Amazon SNS, AWS Lambda, Amazon DynamoDB, event-driven architecture, event patterns, CloudOps