Event-Driven Remediation

The previous topic ended where an alarm runs out of room: a repair that needs several ordered steps, a decision, or a resource the alarm's dimensions do not name. This topic picks up there. It covers how something that happened becomes an event, how that event reaches the right consumer, and how the repair itself is written so it can run unattended at 03:00 without making the incident worse.

What This Topic Covers

• The difference between a metric and an event, and which detection problems need each
• The EventBridge event envelope, default and custom event buses, and rules
• Event pattern matching in detail: subset semantics, arrays as OR, exact character matching, and the comparison operators
• Target permissions, the input transformer, scheduled rules, and EventBridge Scheduler
• EventBridge Pipes: the source, filter, enrichment, and target stages, and when a pipe beats a bus
• Batching, concurrency, partial batch failure, and pipe logging
• Troubleshooting event delivery: retry policies, dead-letter queues, the AWS/Events metrics, infinite loops, and archive and replay
• Systems Manager Automation runbooks: the action vocabulary, step properties, the two-role permission chain, approvals, and rate control
• The four detection sources and the remediation patterns built on them, including AWS Config remediation actions
• The guardrails every automated repair needs, and where AWS DevOps Agent and Kiro fit in an incident loop

Why It Matters

Task 1.2 of the SOA-C03 exam guide asks you to route, enrich, and deliver events with EventBridge, troubleshoot event bus rules, and run predefined and custom Automation runbooks. Those are three separate skills, and questions rarely test them in isolation: a scenario gives you symptoms and asks what to check, or gives you a repair and asks which mechanism performs it.

The same machinery reappears throughout the rest of the course. Automated compliance response in the Security domain is an EventBridge rule with a different event source. Fleet patching in the Deployment domain is a runbook with rate controls. Learn the routing and the runbook model properly here and the later domains become applications of it rather than new material.