Amazon EventBridge Event-Driven Architecture – SAP-C02 Study Guide

Purpose of This Lesson

Amazon EventBridge is a serverless event bus for building loosely coupled, event-driven applications. It receives events from AWS services, custom applications, and SaaS providers, evaluates them against rules, and routes matching events to targets such as AWS Lambda, Amazon SNS, Amazon SQS, and Amazon Kinesis.

The core architectural flow is:

1. An event source generates an event.
2. EventBridge receives the event on an event bus.
3. Rules inspect and filter the event.
4. Matching events are optionally transformed and delivered to one or more targets.

This pattern allows producers and consumers to evolve independently without requiring direct service-to-service integration.

Key Concepts

Event sources

EventBridge can receive events from multiple categories of producers:

• AWS services: For example, Amazon EC2 can generate an event when an instance is terminated.
• Custom applications: Applications can publish their own business or operational events.
• SaaS applications: Supported third-party SaaS integrations can publish events into EventBridge.
• AWS CloudTrail: API activity recorded by CloudTrail can be used as an event source for reacting to account and resource changes.

An event describes something that happened, such as an EC2 instance termination or an Amazon S3 bucket policy update.

Event buses

An event bus receives events and makes them available for rule evaluation.

• The default event bus is used for events generated by AWS services.
• Custom event buses can be used for custom applications and third-party or SaaS event integrations.

Separating event traffic across buses can help organize integrations and apply different routing policies.

Rules and event patterns

Rules determine which events should be routed and what should happen when a match occurs. A rule can evaluate event attributes such as the originating service, event type, and related resource or API action.

Examples include:

• Match an EC2 instance termination event.
• Match a CloudTrail event representing the PutBucketPolicy API action.
• Route only events that satisfy a specific source and event detail pattern.

Rules provide filtering at the event bus, preventing every consumer from having to process every event.

Targets

A matching event can be sent to an appropriate target, including:

• AWS Lambda for custom processing or remediation logic.
• Amazon SNS for notifications and fan-out to subscribers.
• Amazon SQS for durable queue-based processing.
• Amazon Kinesis for streaming and analytics workflows.
• Other supported AWS service targets.

The target should be selected according to the required processing model. For example, SNS is suitable for notification, while SQS is more appropriate when consumers need queued and decoupled processing.

Transformation and delivery

EventBridge can ingest, filter, transform, and deliver events. Transformation is useful when a target requires a different event shape or only a subset of the original event data.

This keeps integration-specific formatting logic in the routing layer rather than duplicating it across every event producer.

Serverless scalability

EventBridge is a managed, serverless service that scales automatically with event volume. Applications do not need to provision or manage event-bus infrastructure, which supports highly scalable event-driven designs.

Exam-Relevant Takeaways

• Use EventBridge when applications need event ingestion, filtering, routing, and loose coupling.
• AWS service events are commonly delivered through the default event bus.
• Use custom event buses to organize events from custom or third-party applications.
• EventBridge rules determine which events are sent to which targets.
• CloudTrail records API activity; EventBridge can react to selected CloudTrail events. These services have different responsibilities.
• A CloudTrail event for PutBucketPolicy can trigger Lambda remediation, SNS notification, or another target.
• Choose targets based on the consumer requirement: Lambda for code execution, SNS for notifications and fan-out, SQS for buffering and asynchronous consumption, and Kinesis for streaming workflows.
• EventBridge reduces direct dependencies between event producers and consumers, improving extensibility and operational separation.

Architecture Decision Guide

Requirement	Suitable EventBridge design	Reason
React to an AWS service event	Use the default event bus and an event rule	AWS service integrations are available out of the box
Notify operators when an EC2 instance terminates	Match the EC2 termination event and target SNS	Separates event detection from notification delivery
Perform automated remediation after an API change	Match the relevant CloudTrail event and target Lambda	CloudTrail supplies the audit event; Lambda performs the response
Process events asynchronously	Route matching events to SQS	A queue decouples producers from consumers and supports delayed processing
Integrate a custom or SaaS application	Publish to or use a custom event bus	Keeps non-AWS event sources organized separately
Stream events for downstream processing	Route events to Kinesis	Suited to streaming-oriented consumers and analytics
Deliver only selected events to a consumer	Use an event pattern in a rule	Filtering avoids unnecessary downstream processing

Common Exam Traps

• Confusing EventBridge with CloudTrail: CloudTrail audits API activity. EventBridge routes events and invokes targets. CloudTrail can provide events that EventBridge rules consume, but they are not interchangeable.
• Assuming EventBridge is only for AWS services: Custom applications and SaaS applications can also be event sources.
• Using Lambda for every target: Lambda is useful for custom logic, but SNS, SQS, and Kinesis may be more appropriate depending on whether the requirement is notification, buffering, or streaming.
• Putting filtering logic inside every consumer: EventBridge rules should filter events as early as possible when the routing requirement is known.
• Creating tightly coupled integrations: Directly connecting every producer to every consumer increases dependency and maintenance costs. Event buses and rules provide an intermediary layer.
• Treating an event as an audit record by default: EventBridge is a routing mechanism. If the requirement is a durable audit trail, use the appropriate auditing or storage service in addition to event routing.

Real-World Engineer Notes

• Design event contracts deliberately. Consumers should know which event fields are stable and which may change.
• Use meaningful event types and source identifiers so rules remain understandable and maintainable.
• Separate operational notifications from automated remediation where possible. An SNS target can notify operators, while a Lambda target can execute controlled corrective action.
• Be cautious with remediation triggered by CloudTrail events. A rule that reacts to a security-related API call can create an automation loop or undo a legitimate administrative change if the matching pattern is too broad.
• Prefer narrow event patterns over broad rules. This reduces unnecessary target invocations and makes the architecture easier to troubleshoot.
• Select the target based on delivery and processing needs rather than defaulting to Lambda. Queues and notification topics often provide better decoupling for consumers that do not require synchronous code execution.

Quick Reference Summary

• EventBridge: Serverless event bus for event-driven applications.
• Sources: AWS services, custom applications, SaaS applications, and CloudTrail-generated API activity.
• Default event bus: Commonly used for AWS service events.
• Custom event buses: Used to organize custom and third-party event traffic.
• Rules: Filter and route events; they can also support event customization.
• Targets: Lambda, SNS, SQS, Kinesis, and other supported services.
• CloudTrail relationship: CloudTrail records API calls; EventBridge can route matching CloudTrail events.
• Primary benefit: Loose coupling between event producers and consumers with managed scalability.

Flashcards

1. Q: What is Amazon EventBridge?

A: A serverless event bus that ingests, filters, transforms, and routes events to targets.

1. Q: What are common EventBridge event sources?

A: AWS services, custom applications, SaaS applications, and events derived from CloudTrail API activity.

1. Q: What is the purpose of an EventBridge event bus?

A: It receives events and provides the routing point where rules evaluate and direct them to targets.

1. Q: Which event bus is commonly used for AWS service events?

A: The default event bus.

1. Q: Why use a custom event bus?

A: To organize and route events from custom applications or third-party and SaaS integrations.

1. Q: What does an EventBridge rule do?

A: It matches event attributes or patterns and routes matching events to configured targets.

1. Q: How are CloudTrail and EventBridge different?

A: CloudTrail records API activity for auditing; EventBridge evaluates and routes events to downstream targets.

1. Q: Which target is appropriate for sending an event notification?

A: Amazon SNS.

1. Q: Which target is appropriate for queued asynchronous processing?

A: Amazon SQS.

1. Q: Which target is useful for custom remediation logic?

A: AWS Lambda.

1. Q: What architectural problem does EventBridge help solve?

A: It reduces direct coupling between event producers and consumers.

1. Q: What EC2 scenario is a common EventBridge example?

A: Matching an EC2 instance termination event and routing it to SNS or another target.

Practice Questions

Question 1

An operations team must notify administrators whenever an EC2 instance is terminated. The solution should avoid custom polling code and should use a managed, serverless service. What is the best design?

A. Configure an EventBridge rule for the EC2 termination event and send matching events to an SNS topic.

B. Run a Lambda function every minute to query the EC2 API and send email directly.

C. Store EC2 instance state in DynamoDB and use a scheduled batch process to detect deletions.

D. Configure CloudTrail to invoke administrators directly when an instance is terminated.

Correct answer: A

Explanation: EC2 can produce service events for lifecycle changes. EventBridge can match the termination event and route it to SNS for notification. CloudTrail records API activity but is not itself the event-routing mechanism.

Question 2

A security team wants to detect when someone applies an S3 bucket policy and invoke automated validation logic. Which architecture best meets the requirement?

A. Use S3 event notifications to invoke Kinesis for every object operation.

B. Use CloudTrail to record API activity, create an EventBridge rule matching PutBucketPolicy, and target Lambda.

C. Use an SNS topic as the event source and configure S3 to publish policy changes to it.

D. Poll all bucket policies from a scheduled Lambda function.

Correct answer: B

Explanation: CloudTrail records the S3 API call, and EventBridge can match the resulting event. Lambda can then inspect or remediate the bucket policy. The design reacts to the specific API action instead of repeatedly polling resources.

Question 3

A company receives events from several SaaS applications and wants to keep those integrations separate from AWS service events. Which EventBridge capability should it use?

A. A custom event bus with rules for the SaaS event patterns.

B. Only the default event bus, because EventBridge cannot receive SaaS events.

C. An SQS queue as the event bus.

D. CloudTrail as the event bus for all SaaS events.

Correct answer: A

Explanation: EventBridge supports custom and SaaS event sources. Custom event buses provide a logical boundary for those events, while rules determine their downstream routing.

Question 4

A consumer occasionally processes events slowly. The architect wants to avoid making the event producer wait and needs a target designed for asynchronous consumption. Which target is most appropriate?

A. Amazon SQS

B. Amazon SNS only

C. AWS CloudTrail

D. Amazon EC2 instance metadata

Correct answer: A

Explanation: SQS provides queue-based decoupling between the EventBridge rule and the consumer. SNS is primarily a notification and fan-out service, while CloudTrail is an auditing service rather than a processing target.

Question 5

A team is building an event-driven application in which multiple independent consumers need to react to business events. Which benefit most directly explains the use of EventBridge?

A. It eliminates the need for event schemas.

B. It lets every consumer directly poll every producer.

C. It provides a managed intermediary for filtering and routing, reducing producer-consumer coupling.

D. It guarantees that every event is stored permanently without additional services.

Correct answer: C

Explanation: EventBridge provides the event bus and rules layer between producers and consumers. This allows routing decisions and consumer integrations to change without requiring every producer to maintain direct connections. It does not eliminate schema design or automatically provide permanent storage for every event.