AWS EventBridge Cheat Sheet

Overview

AWS EventBridge is a serverless event bus service that makes it easy to connect applications using events from AWS services, SaaS applications, and custom sources. It enables event-driven architectures by routing events from sources to targets based on rules and patterns without managing infrastructure.

EventBridge supports content-based filtering with event patterns, scheduled rules for cron-like execution, schema registry for event discovery, pipes for point-to-point integrations, and cross-account/cross-region event routing. It provides at-least-once delivery, automatic retries, and dead-letter queues for reliable event processing.

Installation

AWS CLI

# Create a custom event bus
aws events create-event-bus --name my-app-bus

# List event buses
aws events list-event-buses

# Put a custom event
aws events put-events --entries '[
  {
    "Source": "my.app",
    "DetailType": "OrderCreated",
    "Detail": "{\"orderId\": \"123\", \"amount\": 99.99}",
    "EventBusName": "my-app-bus"
  }
]'

CDK (TypeScript)

import * as events from 'aws-cdk-lib/aws-events';
import * as targets from 'aws-cdk-lib/aws-events-targets';

const bus = new events.EventBus(this, 'AppBus', {
  eventBusName: 'my-app-bus',
});

const rule = new events.Rule(this, 'OrderCreatedRule', {
  eventBus: bus,
  eventPattern: {
    source: ['my.app'],
    detailType: ['OrderCreated'],
    detail: {
      amount: [{ numeric: ['>', 100] }],
    },
  },
});

rule.addTarget(new targets.LambdaFunction(processOrderFn));
rule.addTarget(new targets.SqsQueue(orderQueue));

Event Structure

{
  "version": "0",
  "id": "12345678-1234-1234-1234-123456789012",
  "source": "my.app",
  "account": "123456789012",
  "time": "2026-05-18T10:00:00Z",
  "region": "us-east-1",
  "detail-type": "OrderCreated",
  "detail": {
    "orderId": "ord-123",
    "customerId": "cust-456",
    "amount": 149.99,
    "items": ["item-1", "item-2"],
    "status": "pending"
  }
}

Event Patterns

Basic Matching

{
  "source": ["my.app"],
  "detail-type": ["OrderCreated"]
}

Content Filtering

{
  "source": ["my.app"],
  "detail-type": ["OrderCreated"],
  "detail": {
    "status": ["pending", "confirmed"],
    "amount": [{ "numeric": [">", 100] }],
    "customerId": [{ "prefix": "vip-" }],
    "items": [{ "exists": true }]
  }
}

Advanced Pattern Operations

Pattern	Example	Description
Exact match	`["value"]`	Matches exact string
Prefix	`[{"prefix": "prod-"}]`	Starts with string
Suffix	`[{"suffix": ".jpg"}]`	Ends with string
Numeric	`[{"numeric": [">", 0, "<=", 100]}]`	Range comparison
Exists	`[{"exists": true}]`	Field must exist
Not exists	`[{"exists": false}]`	Field must not exist
Anything-but	`[{"anything-but": ["test"]}]`	Excludes values
Wildcard	`[{"wildcard": "prod-*-us"}]`	Glob matching

Rules and Targets

CLI Rule Management

# Create a rule
aws events put-rule \
  --name order-processing \
  --event-bus-name my-app-bus \
  --event-pattern '{
    "source": ["my.app"],
    "detail-type": ["OrderCreated"]
  }' \
  --state ENABLED

# Add Lambda target
aws events put-targets \
  --rule order-processing \
  --event-bus-name my-app-bus \
  --targets '[{
    "Id": "process-lambda",
    "Arn": "arn:aws:lambda:us-east-1:123456789012:function:processOrder",
    "InputTransformer": {
      "InputPathsMap": {
        "orderId": "$.detail.orderId",
        "amount": "$.detail.amount"
      },
      "InputTemplate": "{\"order\": <orderId>, \"total\": <amount>}"
    }
  }]'

# List rules
aws events list-rules --event-bus-name my-app-bus

# Describe a rule
aws events describe-rule --name order-processing --event-bus-name my-app-bus

# Delete a rule
aws events remove-targets --rule order-processing --ids "process-lambda"
aws events delete-rule --name order-processing --event-bus-name my-app-bus

Scheduled Rules

# Run every 5 minutes
aws events put-rule \
  --name every-5-min \
  --schedule-expression "rate(5 minutes)" \
  --state ENABLED

# Cron expression (daily at 8am UTC)
aws events put-rule \
  --name daily-report \
  --schedule-expression "cron(0 8 * * ? *)" \
  --state ENABLED

Supported Targets

Target	Description
Lambda	Invoke function
SQS	Send message to queue
SNS	Publish to topic
Step Functions	Start state machine
Kinesis	Put record to stream
ECS Task	Run Fargate/EC2 task
API Gateway	Invoke REST API
EventBridge Bus	Forward to another bus
CloudWatch Logs	Write to log group
CodePipeline	Start pipeline
Batch	Submit batch job

EventBridge Pipes

# Create a pipe (SQS -> EventBridge)
aws pipes create-pipe \
  --name order-pipe \
  --source arn:aws:sqs:us-east-1:123456789012:orders \
  --target arn:aws:events:us-east-1:123456789012:event-bus/my-app-bus \
  --role-arn arn:aws:iam::123456789012:role/PipeRole \
  --target-parameters '{
    "EventBridgeEventBusParameters": {
      "DetailType": "OrderFromSQS",
      "Source": "pipe.orders"
    }
  }'

Schema Registry

# Discover schemas (enable on event bus)
aws schemas create-discoverer \
  --source-arn arn:aws:events:us-east-1:123456789012:event-bus/my-app-bus

# List discovered schemas
aws schemas list-schemas --registry-name discovered-schemas

# Get schema
aws schemas describe-schema \
  --registry-name discovered-schemas \
  --schema-name my.app@OrderCreated

# Generate code bindings
aws schemas get-code-binding-source \
  --registry-name discovered-schemas \
  --schema-name my.app@OrderCreated \
  --language Python36

Advanced Usage

Cross-Account Event Routing

# On target account — allow source account to put events
aws events put-permission \
  --event-bus-name my-app-bus \
  --action events:PutEvents \
  --principal 111111111111 \
  --statement-id AllowCrossAccount

# On source account — create rule to forward events
aws events put-rule \
  --name forward-events \
  --event-pattern '{"source": ["my.app"]}' \
  --state ENABLED

aws events put-targets \
  --rule forward-events \
  --targets '[{
    "Id": "cross-account",
    "Arn": "arn:aws:events:us-east-1:222222222222:event-bus/my-app-bus"
  }]'

Dead-Letter Queue Configuration

aws events put-targets \
  --rule my-rule \
  --targets '[{
    "Id": "my-target",
    "Arn": "arn:aws:lambda:...:myFunction",
    "RetryPolicy": {
      "MaximumRetryAttempts": 3,
      "MaximumEventAgeInSeconds": 86400
    },
    "DeadLetterConfig": {
      "Arn": "arn:aws:sqs:us-east-1:123456789012:dlq"
    }
  }]'

Archive and Replay

# Create archive
aws events create-archive \
  --archive-name order-archive \
  --source-arn arn:aws:events:us-east-1:123456789012:event-bus/my-app-bus \
  --event-pattern '{"source": ["my.app"]}' \
  --retention-days 90

# Start replay
aws events start-replay \
  --replay-name replay-2026-05 \
  --event-source-arn arn:aws:events:us-east-1:123456789012:event-bus/my-app-bus \
  --event-start-time 2026-05-01T00:00:00Z \
  --event-end-time 2026-05-18T00:00:00Z \
  --destination '{"Arn": "arn:aws:events:us-east-1:123456789012:event-bus/replay-bus"}'

Troubleshooting

Issue	Solution
Events not matching rule	Test pattern with `aws events test-event-pattern`; check field casing
Target not invoked	Verify IAM permissions on target; check rule is ENABLED
Events delayed	EventBridge is near real-time; check target throttling
Missing events	Ensure correct event bus name; check PutEvents quota
Schema not discovered	Enable discoverer on bus; send events to trigger discovery
Cross-account events failing	Verify resource policy on target bus; check STS assume role
DLQ not receiving	Verify SQS permissions; check DLQ ARN in target config
Schedule not firing	Verify cron syntax (6 fields, not 5); check rule state