SOA-C03 practice question: EventBridge rules and notifications
Monitoring, Logging, Analysis, Remediation, and Performance Optimization A free question from our original SOA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A logistics broker created an EventBridge rule with the AWS CLI, with no IAM role on its target. It matches EC2 Instance State-change Notification events for the stopped state and targets a Lambda function that tags the instance and opens a ticket.
In CloudWatch, the rule's TriggeredRules metric increases whenever an instance stops, and its FailedInvocations metric increases by the same amount. The function has never run.
What is the MOST likely fix?
Choose one answer.
AA. Turn on a CloudTrail trail in the Region, because EventBridge receives EC2 state-change events only from CloudTrail.
BB. Add a statement to the function's resource-based policy that lets events.amazonaws.com invoke it from this rule.
CC. Add the events:PutEvents and lambda:InvokeFunction permissions to the Lambda function's execution role.
DD. Change the event pattern to match the detail-type field exactly, because the current pattern matches too many events.
Show the answer and explanation
Answer: B
A. Wrong: EC2 state-change notifications are sent to EventBridge directly by the EC2 service, without CloudTrail. TriggeredRules is already increasing, which proves the events are arriving. Learn more: Rules in Amazon EventBridge (opens in a new tab)
B. Right: Correct. A rule that matches but cannot deliver points to a target permission problem. The console adds this permission automatically, but for a CLI-created rule with no target role, lambda add-permission must allow EventBridge to invoke the function. Learn more: Using resource-based policies for Amazon EventBridge (opens in a new tab)
Rule metrics separate the two halves of the problem. TriggeredRules shows events match the pattern, and FailedInvocations shows delivery to the target fails. For Lambda targets created outside the console, the usual cause is a missing resource-based policy statement allowing events.amazonaws.com. A dead-letter queue on the target would also capture the error details for future failures.
Want more on EventBridge rules and notifications? The 5 full-length practice sets have 10 more EventBridge rules and notifications questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →