Study guide
Technical reference and lesson notes
Purpose of This Lesson
Amazon EventBridge is AWS’s event-driven routing service. It receives events from AWS services, custom applications, and software-as-a-service (SaaS) providers, evaluates those events against rules, and sends matching events to configured targets.
EventBridge was formerly known as Amazon CloudWatch Events. The older CloudWatch Events functionality remains accessible through parts of the CloudWatch console, but EventBridge is the primary service and console for current event-routing features.
This lesson provides a focused refresher before using EventBridge with AWS CloudTrail events.
Key Concepts
Event sources
An event source produces a state change or operational notification. Common source categories include:
- AWS services, such as CloudTrail and other managed services
- Custom applications, which can publish application-defined events
- SaaS applications, which can integrate with EventBridge and publish events
Events generally contain structured information describing what happened, where it happened, and when it happened. Rules use this event content to determine whether the event should be routed.
Event buses
An event bus receives events from producers and makes them available for rule evaluation. It provides the central routing point between event sources and downstream processing services.
The basic flow is:
Event source → Event bus → Rule evaluation → Target
The event bus decouples producers from consumers. A source does not need to know whether a matching event will invoke Lambda, publish to SNS, or be delivered elsewhere.
Rules
An EventBridge rule defines which events should be selected and what should happen when they match. Rules can filter events based on their content, such as the service that generated the event or the type of state change.
A single event bus can support multiple rules. This allows different consumers to respond to the same event without requiring the producer to implement separate integrations.
Targets
A rule sends matching events to one or more configured targets. Examples include:
- AWS Lambda for custom processing or automation
- Amazon SNS for notification fan-out
- Amazon Kinesis for streaming or downstream event processing
The target is selected based on the required response. For example, use Lambda when the event requires code-driven remediation, SNS when it should notify multiple subscribers, or Kinesis when it should enter a streaming pipeline.
EventBridge and CloudTrail
AWS CloudTrail generates events related to API activity and account operations. EventBridge can process those events and trigger responses based on selected activity.
A common pattern is:
CloudTrail event → EventBridge event bus → Matching rule → Lambda, SNS, or Kinesis
This enables near-real-time reactions to selected API or resource events rather than relying only on periodic log analysis.
Exam-Relevant Takeaways
- EventBridge is the successor to CloudWatch Events. Older references to CloudWatch Events generally describe the same core event-routing capability.
- The central components are event sources, event buses, rules, and targets.
- Rules filter events and determine which targets receive matching events.
- EventBridge is appropriate when an architecture must respond to state changes or service events without tightly coupling the producer to the consumer.
- Common targets include Lambda, SNS, and Kinesis.
- EventBridge can receive events from AWS services, custom applications, and SaaS applications.
- CloudTrail events can be routed through EventBridge for automated monitoring, notification, or remediation.
- EventBridge is an event-routing service; it is not itself a general-purpose log storage or long-term audit repository.
Architecture Decision Guide
| Requirement | Suitable EventBridge design | Primary target example |
|---|---|---|
| Run code when a specific AWS event occurs | Create an event pattern rule on the relevant event bus | AWS Lambda |
| Notify multiple systems or teams about an event | Match the event and publish it to a notification topic | Amazon SNS |
| Send matching events into a stream-processing architecture | Match and forward events to a streaming service | Amazon Kinesis |
| Connect a custom application to event-driven workflows | Publish application events to an event bus and route them with rules | Lambda, SNS, or Kinesis |
| React to selected CloudTrail API activity | Route matching CloudTrail events through EventBridge | Lambda for remediation or SNS for alerting |
| Preserve logs for later audit and investigation | Use the appropriate logging and storage services in addition to EventBridge | CloudTrail destination and storage/analysis services |
Common Exam Traps
- Confusing EventBridge with CloudTrail: CloudTrail records API activity; EventBridge routes matching events to targets. They often work together but serve different purposes.
- Treating EventBridge as a log archive: EventBridge is designed for event routing and response, not long-term retention of audit records.
- Assuming every event is sent to every target: Rules determine which events match and which targets are invoked.
- Ignoring the event bus: The bus is the routing point between event producers and rules; it is part of the core EventBridge architecture.
- Selecting SNS for processing logic: SNS is useful for notification and fan-out. Use Lambda when the requirement involves custom code or automated remediation.
- Assuming the producer must directly integrate with every consumer: EventBridge reduces this coupling by allowing producers to publish events while rules handle downstream routing.
- Overlooking the legacy name: A question may refer to CloudWatch Events while describing the capabilities now associated with EventBridge.
Real-World Engineer Notes
- Design event patterns narrowly enough to avoid triggering automation for unrelated events.
- Use separate rules for separate operational outcomes, such as alerting, remediation, and stream ingestion.
- Keep automated remediation conservative. A broad rule that reacts to many state changes can create unintended changes or alert noise.
- Ensure targets have the required permissions to be invoked by EventBridge.
- Use SNS when humans or multiple subscribers need notification; use Lambda when the response requires validation, branching, or calls to other AWS services.
- For compliance use cases, combine EventBridge’s near-real-time response capability with CloudTrail’s audit-recording and retention architecture.
Quick Reference Summary
Sources:
AWS services, custom applications, SaaS applications
Routing:
Event source → Event bus → Rule
Rule function:
Match event content and select targets
Common targets:
Lambda, SNS, Kinesis
Typical use case:
Respond to resource or API state changes
Important relationship:
CloudTrail records activity; EventBridge routes matching activity
Legacy name:
CloudWatch Events
Flashcards
- What is Amazon EventBridge?
A service that receives events, evaluates them against rules, and routes matching events to targets.
- What was EventBridge previously called?
Amazon CloudWatch Events.
- What are the main components of an EventBridge workflow?
Event sources, an event bus, rules, and targets.
- What does an event bus do?
It receives events and provides the routing point where rules evaluate them.
- What does an EventBridge rule determine?
Which events match and which target actions should occur.
- Name three possible EventBridge targets.
AWS Lambda, Amazon SNS, and Amazon Kinesis.
- What types of systems can act as event sources?
AWS services, custom applications, and SaaS applications.
- How can EventBridge and CloudTrail work together?
CloudTrail produces API activity events, and EventBridge routes selected events to notification, processing, or remediation targets.
- Is EventBridge primarily a long-term audit log repository?
No. It routes events and triggers responses; audit retention requires the appropriate logging and storage architecture.
- Why does EventBridge reduce application coupling?
Producers publish events without needing direct integrations with every downstream consumer.
Practice Questions
Question 1
A security team wants to invoke custom remediation code whenever a specific API activity appears in AWS account activity. The solution should react automatically without continuously polling logs. Which architecture is most appropriate?
A. Store all events in Amazon S3 and run a daily batch process
B. Send CloudTrail events to EventBridge and configure a matching rule targeting Lambda
C. Configure an SNS topic as the CloudTrail log archive
D. Send all CloudTrail events directly to Kinesis without filtering
Correct answer: B
Explanation: CloudTrail provides the API activity events, while EventBridge can filter matching events and invoke Lambda for automated remediation. The other options either introduce batch processing, misuse SNS, or omit event filtering and the required processing action.
Question 2
An organization needs to notify several subscribers when a monitored AWS service state change occurs. Which EventBridge design best fits the requirement?
A. Create a rule that targets Amazon SNS
B. Create a rule that targets Amazon Kinesis only
C. Store the event in CloudTrail and wait for a scheduled report
D. Invoke a Lambda function for every event without a rule pattern
Correct answer: A
Explanation: An EventBridge rule can match the relevant state-change event and publish it to SNS, which is designed for notification and fan-out to multiple subscribers.
Question 3
A custom application and several AWS services need to publish events. Multiple independent consumers must respond to different event types. Which design minimizes direct producer-to-consumer coupling?
A. Make each producer call every consumer directly
B. Send all application traffic through a single Lambda function with hard-coded routing
C. Publish events to EventBridge and use separate rules for the required targets
D. Send all events to an SNS topic and require each consumer to inspect every event
Correct answer: C
Explanation: EventBridge provides a central event bus and rule-based routing. Producers publish events once, while separate rules route matching events to the appropriate consumers.
Question 4
Which statement correctly distinguishes CloudTrail from EventBridge?
A. CloudTrail routes events, while EventBridge stores immutable audit logs
B. CloudTrail records activity, while EventBridge evaluates and routes matching events
C. Both services are interchangeable long-term log repositories
D. EventBridge records every API call, while CloudTrail invokes Lambda for state changes
Correct answer: B
Explanation: CloudTrail records AWS API activity and related events. EventBridge can consume selected events, apply rules, and invoke targets such as Lambda, SNS, or Kinesis.