EventBridge rules and notifications: SOA-C03 study notes and practice questions
What to know about EventBridge rules and notifications for the SOA-C03 exam, from the Monitoring, Logging, Analysis, Remediation, and Performance Optimization domain (22% of the exam guide), then 1 free question to test it. Part of the SOA-C03 study guide.
EventBridge is the glue for operational automation: “when this happens, do that”.
Key facts
Event sources: AWS service events (such as EC2 state changes, GuardDuty findings, CloudWatch alarm state changes, Health events), API calls recorded by CloudTrail, your own applications, and SaaS partners.
Rules use an event pattern (match on fields such as source, detail-type, detail.state) or a schedule.
Targets: SNS, SQS, Lambda, Step Functions, Systems Manager Automation and Run Command, ECS tasks, Kinesis, other event buses, API destinations and more. A rule can have up to five targets.
EventBridge Scheduler runs one-off or recurring schedules (cron or rate) with time zones and flexible windows; it is the newer way to schedule tasks.
Input transformers reshape the event before it reaches the target, for example into a readable message.
Cross-account and cross-Region: send events to an event bus in another account or Region, with a resource policy on the receiving bus.
Archive and replay keeps events so you can reprocess them.
Debugging a rule that doesn’t work
Metric
Means
TriggeredRules is zero
The pattern doesn’t match the events; check field names, case and the event’s real structure
Invocations rise but FailedInvocations too
The rule matches but can’t deliver: usually the target’s resource policy or the rule’s IAM role lacks permission
Add a dead-letter queue to the target to keep events that fail delivery, and set retry policies.
Common traps
Events from API calls need CloudTrail. Rules on “AWS API Call via CloudTrail” only see calls that CloudTrail records.
SNS topic encrypted with an AWS managed key. EventBridge can’t publish to it; use a customer managed key that allows EventBridge.
Writing a cron job on an EC2 instance for a schedule. Use EventBridge Scheduler.
A logistics broker created an EventBridge rule with the AWS CLI, with no IAM role on its target. It matches EC2 Instance State-change Notification events for the stopped state and targets a Lambda function that tags the instance and opens a ticket.
In CloudWatch, the rule's TriggeredRules metric increases whenever an instance stops, and its FailedInvocations metric increases by the same amount. The function has never run.
What is the MOST likely fix?
Choose one answer.
AA. Turn on a CloudTrail trail in the Region, because EventBridge receives EC2 state-change events only from CloudTrail.
BB. Add a statement to the function's resource-based policy that lets events.amazonaws.com invoke it from this rule.
CC. Add the events:PutEvents and lambda:InvokeFunction permissions to the Lambda function's execution role.
DD. Change the event pattern to match the detail-type field exactly, because the current pattern matches too many events.
Show the answer and explanation
Answer: B
A. Wrong: EC2 state-change notifications are sent to EventBridge directly by the EC2 service, without CloudTrail. TriggeredRules is already increasing, which proves the events are arriving. Learn more: Rules in Amazon EventBridge (opens in a new tab)
B. Right: Correct. A rule that matches but cannot deliver points to a target permission problem. The console adds this permission automatically, but for a CLI-created rule with no target role, lambda add-permission must allow EventBridge to invoke the function. Learn more: Using resource-based policies for Amazon EventBridge (opens in a new tab)
Rule metrics separate the two halves of the problem. TriggeredRules shows events match the pattern, and FailedInvocations shows delivery to the target fails. For Lambda targets created outside the console, the usual cause is a missing resource-based policy statement allowing events.amazonaws.com. A dead-letter queue on the target would also capture the error details for future failures.
Want more on EventBridge rules and notifications? The 5 full-length practice sets have 10 more EventBridge rules and notifications questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →