Amazon EventBridge

{
  "version": "0",
  "id": "12345678-1234-1234-1234-123456789012",
  "detail-type": "EC2 Instance State-change Notification",
  "source": "aws.ec2",
  "account": "123456789012",
  "time": "2025-01-18T12:00:00Z",
  "region": "us-east-1",
  "resources": [
    "arn:aws:ec2:us-east-1:123456789012:instance/i-1234567890abcdef0"
  ],
  "detail": {
    "instance-id": "i-1234567890abcdef0",
    "state": "stopped"
  }
}

// Match EC2 instance state changes to "stopped" or "terminated"
{
  "source": ["aws.ec2"],
  "detail-type": ["EC2 Instance State-change Notification"],
  "detail": {
    "state": ["stopped", "terminated"]
  }
}

// Match events from specific account with prefix
{
  "source": [{"prefix": "myapp."}],
  "account": ["123456789012"]
}

// Match numeric range (order value > 1000)
{
  "source": ["myapp.orders"],
  "detail": {
    "value": [{"numeric": [">", 1000]}]
  }
}

// Match when field exists
{
  "detail": {
    "error-code": [{"exists": true}]
  }
}

Rate Expressions:
├── rate(1 minute)    - Every minute
├── rate(5 minutes)   - Every 5 minutes
├── rate(1 hour)      - Every hour
└── rate(1 day)       - Every day

Cron Expressions: cron(minutes hours day-of-month month day-of-week year)
├── cron(0 12 * * ? *)        - 12:00 PM UTC daily
├── cron(0 8 ? * MON-FRI *)   - 8:00 AM weekdays
├── cron(0/15 * * * ? *)      - Every 15 minutes
└── cron(0 18 ? * MON *)      - 6:00 PM every Monday

Schema Registry Features:
├── Auto-Discovery
│   ├── Discovers schemas from events on the bus
│   └── Creates versioned schema definitions
│
├── Code Bindings
│   ├── Generate typed classes (Java, Python, TypeScript)
│   ├── Download from console or CLI
│   └── Use with AWS Toolkit for IDEs
│
└── Cross-Account Discovery
    ├── Share schemas across accounts
    └── Centralize event documentation

1. Create Archive
   └── Specify event bus and retention period
       └── Optional: Filter events with pattern

2. Events Flow
   └── Events matching pattern are archived
       └── Stored for retention period (days)

3. Replay Events
   ├── Specify archive and time range
   ├── Select rules to replay to (or all)
   └── Events re-delivered to targets

Important Notes:
├── Events NOT replayed in original order
├── Add timestamps to events for ordering
├── Replay generates new event IDs
└── Targets must be idempotent

Source → Filter → Enrichment → Target

Sources:
├── DynamoDB Streams
├── Kinesis Data Streams
├── Amazon MQ
├── Amazon MSK
├── Self-managed Apache Kafka
└── Amazon SQS

Optional Steps:
├── Filter: Match event patterns
├── Enrich: Call Lambda/Step Functions/API Gateway
└── Transform: Reshape event before delivery

Targets:
├── Lambda, Step Functions
├── SQS, SNS, Kinesis
├── EventBridge bus
├── API Gateway, API destinations
└── Many more AWS services

API Destination Components:
├── Connection
│   ├── Authorization: Basic, OAuth, API Key
│   └── Shared across destinations
│
├── API Destination
│   ├── HTTP endpoint URL
│   ├── HTTP method (POST, PUT, etc.)
│   └── Invocation rate limit (per second)
│
└── Rule/Pipe Target
    ├── Input transformation
    └── Dead-letter queue for failures

Timeouts and Limits:
├── Request timeout: 5 seconds max
├── Retry: Up to 24 hours, 185 attempts
└── Rate limiting: 300 invocations/second max

// Resource policy on receiving account's event bus
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowAccountToPutEvents",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::111122223333:root"
      },
      "Action": "events:PutEvents",
      "Resource": "arn:aws:events:us-east-1:444455556666:event-bus/central-bus"
    }
  ]
}

Account A (Production)                Account B (Monitoring)
┌─────────────────────┐              ┌──────────────────────┐
│  Default Event Bus  │              │   Central Event Bus  │
│         │           │              │          │           │
│    [Rule: Forward]  │──────────────│►    [Rule: Alert]    │
│         │           │  PutEvents   │          │           │
│    (all events)     │              │      [SNS Topic]     │
└─────────────────────┘              └──────────────────────┘

Account C (Development)
┌─────────────────────┐
│  Default Event Bus  │
│         │           │
│    [Rule: Forward]  │──────────────────────────┘
└─────────────────────┘

Do you need to integrate with SaaS partners?
├── Yes → EventBridge (partner event sources)
└── No ↓

Do you need complex event pattern matching?
├── Yes → EventBridge (content-based filtering)
└── No ↓

Do you need scheduled/cron jobs?
├── Yes → EventBridge (Scheduler or rule schedules)
└── No ↓

Do you need SMS/Email/Push notifications?
├── Yes → SNS (notification protocols)
└── No ↓

Do you need fan-out to multiple consumers?
├── Yes → SNS (or EventBridge with multiple targets)
└── No ↓

Do you need message buffering/persistence?
├── Yes → SQS (message retention up to 14 days)
└── No → Consider EventBridge for AWS service events

// Original Event
{
  "detail-type": "EC2 Instance State-change Notification",
  "source": "aws.ec2",
  "detail": {
    "instance-id": "i-1234567890abcdef0",
    "state": "stopped"
  }
}

// Input Path (extract values)
{
  "instance": "$.detail.instance-id",
  "status": "$.detail.state"
}

// Input Template (construct payload)
{
  "message": "Instance <instance> is now <status>",
  "timestamp": "<aws.events.event.ingestion-time>"
}

// Result sent to target
{
  "message": "Instance i-1234567890abcdef0 is now stopped",
  "timestamp": "2025-01-18T12:00:00.000Z"
}

1. Use Custom Event Buses for Application Events
   ├── Separate from AWS service events
   ├── Easier access control
   └── Cleaner event organization

2. Implement Dead-Letter Queues
   ├── Capture failed deliveries
   ├── SQS queue as DLQ
   └── Monitor and alert on DLQ messages

3. Use Schema Registry
   ├── Document event structures
   ├── Generate typed code
   └── Version schemas for compatibility

4. Archive Events for Compliance
   ├── Configure retention period
   ├── Use event patterns to filter
   └── Enable replay for debugging

5. Design Idempotent Targets
   ├── Events may be delivered multiple times
   ├── Replay doesn't guarantee order
   └── Use event IDs for deduplication

Events:
├── Custom events: $1.00 per million
├── AWS service events: Free
├── Cross-account: $1.00 per million
└── Partner events: $0.05 per million

Scheduler:
├── Standard schedules: $1.00 per million invocations
└── One-time schedules: Free

Archive & Replay:
├── Archive storage: $0.023 per GB-month
├── Archive processing: $0.10 per GB
└── Replay: $1.00 per million events

API Destinations:
└── Invocations: $0.20 per million

# Create custom event bus
aws events create-event-bus --name my-app-bus

# Create rule with event pattern
aws events put-rule \
  --name "ec2-stopped-rule" \
  --event-bus-name "default" \
  --event-pattern '{"source":["aws.ec2"],"detail-type":["EC2 Instance State-change Notification"],"detail":{"state":["stopped"]}}'

# Create scheduled rule (every 5 minutes)
aws events put-rule \
  --name "every-5-min" \
  --schedule-expression "rate(5 minutes)"

# Add Lambda target to rule
aws events put-targets \
  --rule "ec2-stopped-rule" \
  --targets "Id"="1","Arn"="arn:aws:lambda:us-east-1:123456789012:function:MyFunction"

# Put custom event
aws events put-events \
  --entries '[{"Source":"myapp","DetailType":"OrderCreated","Detail":"{\"orderId\":\"12345\"}","EventBusName":"my-app-bus"}]'

# Create archive
aws events create-archive \
  --archive-name "my-archive" \
  --event-source-arn "arn:aws:events:us-east-1:123456789012:event-bus/default" \
  --retention-days 30