Amazon EventBridgeAuthorCloudBrum editorial teamLast reviewed30 Oct 2026Reading time~12 minLevelBeginner to advanced

• AWS events for freeMany AWS services put events on your default bus on their own: an EC2 instance changing state, a build finishing, a management API call. A rule can react without a line of code to poll for it.
• Your own events on custom busesCall PutEvents from your code with a source, a detail type and a JSON detail. Each domain can have its own bus, with its own permissions and its own archive.
• Rules that read the contentA pattern can look at any field of the event: exact values, prefixes, numeric ranges, exists checks, anything-but and wildcards. The filtering happens in the service, so consumers only see what they asked for.
• Many kinds of targetOne rule sends to up to five targets. Lambda, SQS, SNS, Step Functions, Kinesis, another bus (in this or another account or Region) and HTTPS endpoints through API destinations are all supported.
• Reshape before deliveryAn input transformer picks fields out of the event and builds the message the target expects, so a legacy consumer doesn’t need to learn the full event.
• Pipes for point-to-pointA pipe reads from a queue or stream (SQS, Kinesis, DynamoDB streams, Kafka, Amazon MQ), filters, optionally enriches with a call to Lambda or an API, and delivers to one target. No glue code in between.
• SchedulerOne-time and recurring schedules with time zones and an optional flexible window. It is built for very large numbers of schedules, which is where cron rules on a bus fall short.
• Archive and replayAn archive keeps events from a bus for as long as you choose. When a consumer had a bug, fix it and replay a time window back onto the bus.

Event

A JSON record that something happened. The envelope has fixed fields (source, detail-type, time, account, region, resources) and a free-form detail object that you design.

Event bus

The channel events are sent to. Every account has a default bus for AWS events. You can add custom buses for your own events and partner buses for SaaS providers.

Rule

Belongs to one bus. It either matches events with a pattern or fires on a schedule, and sends what it matches to up to five targets.

Event pattern

A JSON document that looks like the events it wants. Every field you list must match, and a list of values means any of them.

Target

Where a rule delivers: a function, a queue, a topic, a state machine, a stream, another bus or an HTTPS endpoint. Each target has its own role or resource policy.

Input transformer

Pulls values from the event with paths and builds a new message from a template, so the target gets the shape it needs.

Dead-letter queue (DLQ)

An SQS queue that keeps events a target never accepted, after the retries ran out. Without one, an undeliverable event is dropped.

Retry policy

How long and how often EventBridge retries a failed delivery. The default is up to 24 hours and 185 attempts, and you can shorten both per target.

Archive and replay

An archive stores events from one bus, optionally filtered by a pattern. A replay sends a chosen time window back to the same bus, and replayed events carry a replay-name so consumers can tell.

Schema registry

A catalogue of event structures. Discovery can infer schemas from the events on a bus, and code bindings can be generated from them.

API destination

An HTTPS endpoint with stored credentials (basic, API key or OAuth) and a rate limit, so a rule can call a web service and not only AWS services.

Pipe

A managed connection from one source to one target, with a filter and an optional enrichment step between them.

EventBridge Scheduler

The scheduling service for one-time and recurring invocations. A schedule has a target, a role, a time zone and an optional flexible window.

Create a bus, a rule and a safe target with the AWS CLI

1. Name your events firstPick a source (for example com.example.orders) and a detail-type (OrderPlaced), and sketch the fields in detail. These names are a contract, so settle them before anyone consumes them.
2. Create a custom busKeep your own events off the default bus. One bus per domain or per environment is a common starting point.
3. Prepare the target and its dead-letter queueCreate the queue the consumer reads from and a second queue for events that cannot be delivered.
4. Write the pattern and test itDescribe only the events the consumer needs, for example orders with a total of 1000 or more. Run the pattern against a sample event with test-event-pattern before it goes live.
5. Let the rule send to the targetQueues and topics need a resource policy that names the rule. Functions need permission for events.amazonaws.com. Without this the rule matches and nothing arrives.
6. Attach the target with retries and a DLQDecide how long delivery may be retried. An hour is plenty for most consumers, and a day is the default.
7. Turn on an archiveKeep a few weeks of events on the bus. It costs little and lets you replay after a consumer bug.
8. Send a test event and read the answerPutEvents can succeed as a call while a single entry fails. Check FailedEntryCount and the per-entry results, then look in the queue.
9. Watch the rule’s metricsFailedInvocations, InvocationsFailedToBeSentToDlq and ThrottledRules tell you what the console hides. Alarm on them.

• Use PutEvents in batches of up to ten entries, and check every result in the response.
• Keep events small. Put a large payload in S3 and send the key in the detail, so every hop stays quick.
• Put a queue between the bus and a slow consumer, so bursts don’t turn into throttling or failures.
• Filter in the pattern, not in the consumer, so unwanted events are never delivered.
• Use Pipes to read from queues and streams instead of a polling function that only forwards messages.
• Choose targets in the same Region as the bus where you can, since cross-Region hops add latency and cost.
• Set retry settings per target to match how long the consumer can really wait.
• Treat delivery as at least once and design for duplicates, because that is what keeps the system quick and simple.

FinOps is the habit of managing cloud spend together with engineering. These are the FinOps checks that matter most for Amazon EventBridge.

• Remember that AWS service events are free, and custom and partner events are billed per million.
• Tighten patterns so fewer events match, and so fewer targets are invoked and billed downstream.
• Batch and sample chatty producers: a progress event every second per user is rarely needed.
• Archive only what you will replay, using a pattern on the archive, and set a retention period.
• Keep replays short and targeted, since they are billed like events.
• Count Pipes by requests after filtering: filter first, and enrich only what is left.
• Move cron-style rules to Scheduler, where the first 14 million invocations a month are free.
• Don’t send events through several buses when one rule can reach the target directly.
• Use schema discovery on a test bus, not on every production bus all the time.
• Tag buses and rules with the owning team, and put a budget alert on EventBridge spend.

• Give each producer and consumer a role with only the actions it needs, such as events:PutEvents on one bus.
• Write resource policies on buses that name accounts or an organisation, and avoid * principals.
• Use customer managed KMS keys for buses and archives when a rule demands it, and keep the key policy in step.
• Keep secrets out of events. Store API destination credentials in the connection, which keeps them in Secrets Manager for you.
• Restrict who can change rules and targets, since a new target can send your events somewhere else.
• Limit events:PutPermission so a bus can’t be opened to another account by accident.
• Send events to CloudWatch Logs with a rule for the buses where you need an audit of what flowed.
• Record API calls with CloudTrail, and alert on PutPermission, DeleteRule and RemoveTargets.
• Use VPC endpoints where private workloads publish events, so traffic stays off the internet.
• Validate the sender inside the event for sensitive flows, and don’t trust the source field alone on a shared bus.

AWS CloudTrail records who changed buses, rules and targets, AWS Config can record the configuration over time, Security Hub reports on settings, and AWS Artifact holds compliance reports. AWS runs the service and keeps the events safe in transit and at rest. The event design, who may publish and consume, how long you archive, and what a failed delivery triggers are yours.

• Send fewer, smaller events, and sample chatty producers, so less data is routed and stored.
• Filter in the pattern so consumers aren’t woken for events they discard.
• Archive only what you would replay, and set a retention period.
• Retire rules and schedules that no longer have a consumer.
• Where data rules and latency allow, run the bus in a Region on a cleaner grid.
• The AWS carbon tool reports per account and does not list EventBridge on its own, so quote no EventBridge figure.

Purchase options

What you actually pay for

• Custom and partner events published to a bus
• Pipes requests after filtering
• Archive processing and storage, and replayed events
• Scheduler invocations above the free monthly allowance
• API destination invocations, cross-Region and cross-account hops, and schema discovery

An orders domain: a custom bus, a rule for orders of 1000 or more that sends to a queue with retries and a dead-letter queue, a 30-day archive, a nightly schedule in India time and a look at the rule’s failure metric. The CLI tab builds it and sends a test event; Terraform describes the same resources. The Python tab publishes in batches and reads every result, tests a pattern and starts a replay, and the C# tab audits buses for disabled rules, empty rules and targets without a dead-letter queue. Replace the Region, account and names with your own.

# Placeholders: replace the Region and account with your own.
REGION=ap-south-1
ACCOUNT=111122223333
BUS=orders

# 1. A custom bus for the orders domain. Events from your own code go here, not to the default bus.
aws events create-event-bus --region $REGION --name $BUS

# 2. A queue for large orders and a second queue that keeps whatever could not be delivered.
DLQ_URL=$(aws sqs create-queue --region $REGION --queue-name $BUS-large-dlq --query QueueUrl --output text)
DLQ_ARN=$(aws sqs get-queue-attributes --region $REGION --queue-url "$DLQ_URL" --attribute-names QueueArn --query Attributes.QueueArn --output text)
Q_URL=$(aws sqs create-queue --region $REGION --queue-name $BUS-large --query QueueUrl --output text)
Q_ARN=$(aws sqs get-queue-attributes --region $REGION --queue-url "$Q_URL" --attribute-names QueueArn --query Attributes.QueueArn --output text)

# 3. A rule that matches orders of 1000 or more. Test the pattern against a sample event before you rely on it.
cat > pattern.json <<JSON
{"source": ["com.example.orders"], "detail-type": ["OrderPlaced"], "detail": {"total": [{"numeric": [">=", 1000]}]}}
JSON
cat > sample-event.json <<JSON
{"id": "1", "account": "$ACCOUNT", "time": "2026-11-01T10:00:00Z", "region": "$REGION", "resources": [],
 "source": "com.example.orders", "detail-type": "OrderPlaced", "detail": {"orderId": "A-1001", "total": 2500}}
JSON
aws events test-event-pattern --region $REGION --event-pattern file://pattern.json --event file://sample-event.json
aws events put-rule --region $REGION --event-bus-name $BUS --name large-orders --event-pattern file://pattern.json
RULE_ARN=$(aws events describe-rule --region $REGION --event-bus-name $BUS --name large-orders --query Arn --output text)

# 4. Let that one rule send to both queues. Without this policy the rule matches but nothing arrives.
for ARN in "$Q_ARN" "$DLQ_ARN"; do
  URL=$([ "$ARN" = "$Q_ARN" ] && echo "$Q_URL" || echo "$DLQ_URL")
  cat > policy.json <<JSON
{"Version": "2012-10-17", "Statement": [{"Effect": "Allow", "Principal": {"Service": "events.amazonaws.com"},
  "Action": "sqs:SendMessage", "Resource": "$ARN", "Condition": {"ArnEquals": {"aws:SourceArn": "$RULE_ARN"}}}]}
JSON
  python3 -c "import json;print(json.dumps({'Policy': open('policy.json').read()}))" > attrs.json
  aws sqs set-queue-attributes --region $REGION --queue-url "$URL" --attributes file://attrs.json
done

# 5. The target: retry for up to an hour, then park the event in the dead-letter queue.
aws events put-targets --region $REGION --event-bus-name $BUS --rule large-orders \
  --targets "Id=large-queue,Arn=$Q_ARN,RetryPolicy={MaximumRetryAttempts=10,MaximumEventAgeInSeconds=3600},DeadLetterConfig={Arn=$DLQ_ARN}"

# 6. Keep 30 days of events on this bus, so a bug in a consumer can be fixed and the events replayed.
aws events create-archive --region $REGION --archive-name $BUS-30d --retention-days 30 \
  --event-source-arn arn:aws:events:$REGION:$ACCOUNT:event-bus/$BUS

# 7. Send one event, and look at FailedEntryCount: PutEvents can succeed as a call and still reject an entry.
aws events put-events --region $REGION --entries '[{"EventBusName": "orders", "Source": "com.example.orders",
  "DetailType": "OrderPlaced", "Detail": "{\"orderId\": \"A-1001\", \"total\": 2500}"}]'
aws sqs receive-message --region $REGION --queue-url "$Q_URL" --wait-time-seconds 5

# 8. A nightly job at 02:30 India time with a 15-minute window, from EventBridge Scheduler instead of a cron rule.
cat > target.json <<JSON
{"Arn": "$Q_ARN", "RoleArn": "arn:aws:iam::$ACCOUNT:role/scheduler-to-sqs", "Input": "{\\"job\\": \\"orders-report\\"}"}
JSON
aws scheduler create-schedule --region $REGION --name nightly-orders-report --schedule-expression "cron(30 2 * * ? *)" \
  --schedule-expression-timezone Asia/Kolkata --flexible-time-window Mode=FLEXIBLE,MaximumWindowInMinutes=15 --target file://target.json

# 9. Is anything failing to reach a target? Look at the rule's metrics for the last hour.
aws cloudwatch get-metric-statistics --region $REGION --namespace AWS/Events --metric-name FailedInvocations \
  --dimensions Name=RuleName,Value=large-orders --statistics Sum --period 300 \
  --start-time $(date -u -d '-1 hour' +%FT%TZ) --end-time $(date -u +%FT%TZ)

# Placeholders: pass in your own names. The role and account values below are examples.
variable "region" {
  type    = string
  default = "ap-south-1"
}

variable "bus_name" {
  type    = string
  default = "orders"
}

provider "aws" {
  region = var.region
}

data "aws_caller_identity" "me" {}

resource "aws_cloudwatch_event_bus" "orders" {
  name = var.bus_name
}

resource "aws_cloudwatch_event_archive" "orders" {
  name             = "${var.bus_name}-30d"
  event_source_arn = aws_cloudwatch_event_bus.orders.arn
  retention_days   = 30
}

resource "aws_sqs_queue" "large_dlq" {
  name = "${var.bus_name}-large-dlq"
}

resource "aws_sqs_queue" "large" {
  name = "${var.bus_name}-large"
}

resource "aws_cloudwatch_event_rule" "large_orders" {
  name           = "large-orders"
  event_bus_name = aws_cloudwatch_event_bus.orders.name
  event_pattern = jsonencode({
    source        = ["com.example.orders"]
    "detail-type" = ["OrderPlaced"]
    detail        = { total = [{ numeric = [">=", 1000] }] }
  })
}

# Both queues must allow this one rule to send. Without it the rule matches and nothing arrives.
data "aws_iam_policy_document" "from_rule" {
  for_each = {
    large     = aws_sqs_queue.large.arn
    large_dlq = aws_sqs_queue.large_dlq.arn
  }

  statement {
    actions   = ["sqs:SendMessage"]
    resources = [each.value]

    principals {
      type        = "Service"
      identifiers = ["events.amazonaws.com"]
    }

    condition {
      test     = "ArnEquals"
      variable = "aws:SourceArn"
      values   = [aws_cloudwatch_event_rule.large_orders.arn]
    }
  }
}

resource "aws_sqs_queue_policy" "large" {
  queue_url = aws_sqs_queue.large.id
  policy    = data.aws_iam_policy_document.from_rule["large"].json
}

resource "aws_sqs_queue_policy" "large_dlq" {
  queue_url = aws_sqs_queue.large_dlq.id
  policy    = data.aws_iam_policy_document.from_rule["large_dlq"].json
}

resource "aws_cloudwatch_event_target" "large_queue" {
  rule           = aws_cloudwatch_event_rule.large_orders.name
  event_bus_name = aws_cloudwatch_event_bus.orders.name
  target_id      = "large-queue"
  arn            = aws_sqs_queue.large.arn

  retry_policy {
    maximum_retry_attempts       = 10
    maximum_event_age_in_seconds = 3600
  }

  dead_letter_config {
    arn = aws_sqs_queue.large_dlq.arn
  }
}

resource "aws_iam_role" "scheduler" {
  name = "scheduler-to-sqs"
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect    = "Allow"
      Principal = { Service = "scheduler.amazonaws.com" }
      Action    = "sts:AssumeRole"
      Condition = { StringEquals = { "aws:SourceAccount" = data.aws_caller_identity.me.account_id } }
    }]
  })
}

resource "aws_iam_role_policy" "scheduler_send" {
  role = aws_iam_role.scheduler.id
  policy = jsonencode({
    Version   = "2012-10-17"
    Statement = [{ Effect = "Allow", Action = "sqs:SendMessage", Resource = aws_sqs_queue.large.arn }]
  })
}

resource "aws_scheduler_schedule" "nightly_report" {
  name                         = "nightly-orders-report"
  schedule_expression          = "cron(30 2 * * ? *)"
  schedule_expression_timezone = "Asia/Kolkata"

  flexible_time_window {
    mode                      = "FLEXIBLE"
    maximum_window_in_minutes = 15
  }

  target {
    arn      = aws_sqs_queue.large.arn
    role_arn = aws_iam_role.scheduler.arn
    input    = jsonencode({ job = "orders-report" })
  }
}

output "bus_arn" {
  value = aws_cloudwatch_event_bus.orders.arn
}

# pip install boto3
# Sends orders to a bus in batches of ten (the PutEvents limit per call), checks the answer entry by entry,
# tests an event pattern without deploying it, and replays a time window from the archive.
import datetime as dt
import json

import boto3

events = boto3.client("events", region_name="ap-south-1")
BUS = "orders"


def publish(orders):
    """Returns the orders EventBridge refused. A call can succeed while single entries fail, so read every result."""
    refused = []
    for start in range(0, len(orders), 10):
        batch = orders[start:start + 10]
        entries = [{"EventBusName": BUS, "Source": "com.example.orders", "DetailType": "OrderPlaced",
                    "Detail": json.dumps(order)} for order in batch]
        reply = events.put_events(Entries=entries)
        if reply["FailedEntryCount"]:
            for order, result in zip(batch, reply["Entries"]):
                if "ErrorCode" in result:
                    refused.append((order, result["ErrorCode"], result.get("ErrorMessage", "")))
    return refused


def matches(pattern, event):
    """True when the pattern would select the event. Handy in unit tests for your rules."""
    return events.test_event_pattern(EventPattern=json.dumps(pattern), Event=json.dumps(event))["Result"]


def replay(archive_arn, bus_arn, hours=2):
    """Sends the events of the last few hours from the archive back to the bus they came from."""
    end = dt.datetime.now(dt.timezone.utc)
    name = "fix-" + end.strftime("%Y%m%d-%H%M%S")
    events.start_replay(ReplayName=name, EventSourceArn=archive_arn, Destination={"Arn": bus_arn},
                        EventStartTime=end - dt.timedelta(hours=hours), EventEndTime=end)
    return name


if __name__ == "__main__":
    pattern = {"source": ["com.example.orders"], "detail-type": ["OrderPlaced"], "detail": {"total": [{"numeric": [">=", 1000]}]}}
    sample = {"id": "1", "account": "111122223333", "time": "2026-11-01T10:00:00Z", "region": "ap-south-1", "resources": [],
              "source": "com.example.orders", "detail-type": "OrderPlaced", "detail": {"orderId": "A-1001", "total": 2500}}
    print("pattern matches the sample:", matches(pattern, sample))
    problems = publish([{"orderId": "A-%d" % n, "total": 400 + n * 300} for n in range(1, 26)])
    print("refused:", problems or "none")

// dotnet add package AWSSDK.EventBridge
// Audits every event bus in the Region: disabled rules, rules without targets, and targets that have no dead-letter queue.
using Amazon.EventBridge;
using Amazon.EventBridge.Model;

using var events = new AmazonEventBridgeClient();
int problems = 0;

var buses = await events.ListEventBusesAsync(new ListEventBusesRequest());
foreach (EventBus bus in buses.EventBuses)
{
    string? token = null;
    do
    {
        var page = await events.ListRulesAsync(new ListRulesRequest { EventBusName = bus.Name, NextToken = token });
        foreach (Rule rule in page.Rules)
        {
            // rules an AWS service created for you carry a ManagedBy value, and they are not yours to fix
            if (!string.IsNullOrEmpty(rule.ManagedBy)) continue;

            if (rule.State == RuleState.DISABLED)
            {
                Console.WriteLine($"{bus.Name}/{rule.Name}: rule is disabled");
                problems++;
            }

            var targets = await events.ListTargetsByRuleAsync(new ListTargetsByRuleRequest { EventBusName = bus.Name, Rule = rule.Name });
            if (targets.Targets.Count == 0)
            {
                Console.WriteLine($"{bus.Name}/{rule.Name}: rule has no target");
                problems++;
            }
            foreach (Target target in targets.Targets.Where(t => t.DeadLetterConfig?.Arn is null))
            {
                Console.WriteLine($"{bus.Name}/{rule.Name}: target {target.Id} has no dead-letter queue");
                problems++;
            }
        }
        token = page.NextToken;
    } while (token != null);
}

Console.WriteLine(problems == 0 ? "No problems found." : $"{problems} problem(s) found.");
return problems == 0 ? 0 : 1;

Videos picked for this service. Each one is labelled with its source, opens on YouTube if you prefer, and loads only when you press play.

Typical targets and sources include AWS Lambda, Amazon API Gateway and Amazon S3 notifications. Metrics and alarms for rules live in Amazon CloudWatch, and customer managed keys come from AWS KMS.