[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"cheat-sheet---en":3,"domain-info---en":3,"topic-info----en":3,"prev-aws-certified-cloudops-engineer-associate-monitoring-logging-performance-event-driven-remediation-eventbridge-fundamentals-en":4,"lesson-aws-certified-cloudops-engineer-associate-monitoring-logging-performance-event-driven-remediation-eventbridge-fundamentals-en":19,"next-aws-certified-cloudops-engineer-associate-monitoring-logging-performance-event-driven-remediation-eventbridge-fundamentals-en":1254},null,{"locked":5,"reason":6,"meta":7,"item":3},true,"paywall",{"title":8,"description":9,"isFree":10,"estimatedMinutes":11,"difficulty":12,"learningObjectives":13},"CloudWatch Dashboards","Build the view an engineer opens at 03:00: custom and automatic dashboards, the widget types worth knowing, cross-account and cross-Region graphs, dashboards as JSON in source control, and what sharing a dashboard really grants.",false,16,"beginner",[14,15,16,17,18],"Compare automatic dashboards with custom dashboards and choose between them","Select the right widget type for a given operational question","Build a dashboard that graphs metrics from several accounts and Regions in one view","Manage dashboards as JSON through PutDashboard instead of by clicking","Explain the permissions granted to people you share a dashboard with",{"locked":10,"reason":3,"meta":20,"item":32},{"title":21,"description":22,"isFree":5,"estimatedMinutes":23,"difficulty":24,"learningObjectives":25},"EventBridge Fundamentals","Learn how EventBridge routes events: the event envelope, default and custom buses, the exact-match rules of event pattern evaluation, target permissions, and input transformation.",24,"intermediate",[26,27,28,29,30,31],"Distinguish an event from a metric and explain which detection problems need each","Identify the fields of the EventBridge event envelope and write an event pattern that matches them","Explain how pattern matching evaluates arrays, leaf nodes, and absent fields","Compare the default event bus, custom event buses, and partner event buses","Choose between an IAM execution role and a resource-based policy for a target","Reshape an event with the input transformer before it reaches a target",{"id":33,"title":21,"body":34,"description":22,"difficulty":24,"estimatedMinutes":23,"extension":1162,"infographics":1163,"isFree":5,"learningObjectives":1180,"meta":1181,"navigation":5,"path":1182,"quiz":1183,"seo":1251,"stem":1252,"__hash__":1253},"courses/courses/aws-certified-cloudops-engineer-associate/en/domains/01-monitoring-logging-performance/03-event-driven-remediation/01-eventbridge-fundamentals.md",{"type":35,"value":36,"toc":1151},"minimark",[37,50,53,58,61,73,84,87,98,102,109,382,398,411,415,418,425,435,441,446,449,452,456,467,470,562,565,569,572,587,597,618,630,633,792,812,815,826,830,845,848,862,871,896,900,907,913,983,989,1063,1079,1082,1086,1101,1107,1110,1114,1144,1147],[38,39,40,41,45,46,49],"p",{},"A CloudWatch alarm can reboot the one instance its dimensions point at. It cannot do this: when any instance tagged ",[42,43,44],"code",{},"Environment=prod"," enters the ",[42,47,48],{},"stopped"," state, open a Systems Manager OpsItem, start a runbook that captures the console output, and notify the owning team. There is no number to threshold here. Nothing rises or falls. Something simply happened, once, to one resource, and several things need to occur because of it.",[38,51,52],{},"That is the gap EventBridge fills. It is the router that sits between things that happen in your account and the things that should run in response.",[54,55,57],"h2",{"id":56},"events-are-facts-metrics-are-numbers","Events are facts; metrics are numbers",[38,59,60],{},"This boundary is worth getting right before anything else, because half of the diagnostic questions in this domain turn on it.",[38,62,63,64,68,69,72],{},"A ",[65,66,67],"strong",{},"metric"," is a time series of numbers. ",[42,70,71],{},"CPUUtilization"," on an instance is 4% at 09:00 and 71% at 09:01. Alarms exist to watch that series and decide when the numbers have gone bad for long enough to matter.",[38,74,75,76,79,80,83],{},"An ",[65,77,78],{},"event"," is a JSON document describing something that occurred, delivered once, near the moment it occurred. An instance changed state. An EBS snapshot finished. Someone called ",[42,81,82],{},"AuthorizeSecurityGroupIngress",". An AWS Health notification opened for a Region. None of these are numbers, so no alarm can watch them.",[38,85,86],{},"Test yourself with a fast rule: if a human would describe the situation with a verb in the past tense, it is an event. If they would describe it with a number and a comparison, it is a metric.",[38,88,89,90,93,94,97],{},"The two connect, and the exam likes the connection. A CloudWatch alarm changing state is itself an event on the default bus (",[42,91,92],{},"aws.cloudwatch",", detail-type ",[42,95,96],{},"CloudWatch Alarm State Change","). So the answer to \"my alarm needs to trigger a five-step repair\" is almost always: keep the alarm, and let EventBridge match its state-change event and start the workflow.",[54,99,101],{"id":100},"the-event-envelope","The event envelope",[38,103,104,105,108],{},"Every event has the same outer structure, with the service-specific payload nested inside ",[42,106,107],{},"detail",". Here is a real EC2 state-change event:",[110,111,116],"pre",{"className":112,"code":113,"language":114,"meta":115,"style":115},"language-json shiki shiki-themes material-theme-lighter github-light github-dark","{\n  \"version\": \"0\",\n  \"id\": \"6a7e8feb-b491-4cf7-a9f1-bf3703467718\",\n  \"detail-type\": \"EC2 Instance State-change Notification\",\n  \"source\": \"aws.ec2\",\n  \"account\": \"111122223333\",\n  \"time\": \"2017-12-22T18:43:48Z\",\n  \"region\": \"us-west-1\",\n  \"resources\": [\n    \"arn:aws:ec2:us-west-1:123456789012:instance/i-1234567890abcdef0\"\n  ],\n  \"detail\": {\n    \"instance-id\": \"i-1234567890abcdef0\",\n    \"state\": \"terminated\"\n  }\n}\n","json","",[42,117,118,127,157,178,199,220,241,262,283,298,310,316,330,352,371,377],{"__ignoreMap":115},[119,120,123],"span",{"class":121,"line":122},"line",1,[119,124,126],{"class":125},"sP7_E","{\n",[119,128,130,134,138,141,144,148,152,154],{"class":121,"line":129},2,[119,131,133],{"class":132},"s39Yj","  \"",[119,135,137],{"class":136},"sseR_","version",[119,139,140],{"class":132},"\"",[119,142,143],{"class":125},":",[119,145,147],{"class":146},"sjJ54"," \"",[119,149,151],{"class":150},"s_sjI","0",[119,153,140],{"class":146},[119,155,156],{"class":125},",\n",[119,158,160,162,165,167,169,171,174,176],{"class":121,"line":159},3,[119,161,133],{"class":132},[119,163,164],{"class":136},"id",[119,166,140],{"class":132},[119,168,143],{"class":125},[119,170,147],{"class":146},[119,172,173],{"class":150},"6a7e8feb-b491-4cf7-a9f1-bf3703467718",[119,175,140],{"class":146},[119,177,156],{"class":125},[119,179,181,183,186,188,190,192,195,197],{"class":121,"line":180},4,[119,182,133],{"class":132},[119,184,185],{"class":136},"detail-type",[119,187,140],{"class":132},[119,189,143],{"class":125},[119,191,147],{"class":146},[119,193,194],{"class":150},"EC2 Instance State-change Notification",[119,196,140],{"class":146},[119,198,156],{"class":125},[119,200,202,204,207,209,211,213,216,218],{"class":121,"line":201},5,[119,203,133],{"class":132},[119,205,206],{"class":136},"source",[119,208,140],{"class":132},[119,210,143],{"class":125},[119,212,147],{"class":146},[119,214,215],{"class":150},"aws.ec2",[119,217,140],{"class":146},[119,219,156],{"class":125},[119,221,223,225,228,230,232,234,237,239],{"class":121,"line":222},6,[119,224,133],{"class":132},[119,226,227],{"class":136},"account",[119,229,140],{"class":132},[119,231,143],{"class":125},[119,233,147],{"class":146},[119,235,236],{"class":150},"111122223333",[119,238,140],{"class":146},[119,240,156],{"class":125},[119,242,244,246,249,251,253,255,258,260],{"class":121,"line":243},7,[119,245,133],{"class":132},[119,247,248],{"class":136},"time",[119,250,140],{"class":132},[119,252,143],{"class":125},[119,254,147],{"class":146},[119,256,257],{"class":150},"2017-12-22T18:43:48Z",[119,259,140],{"class":146},[119,261,156],{"class":125},[119,263,265,267,270,272,274,276,279,281],{"class":121,"line":264},8,[119,266,133],{"class":132},[119,268,269],{"class":136},"region",[119,271,140],{"class":132},[119,273,143],{"class":125},[119,275,147],{"class":146},[119,277,278],{"class":150},"us-west-1",[119,280,140],{"class":146},[119,282,156],{"class":125},[119,284,286,288,291,293,295],{"class":121,"line":285},9,[119,287,133],{"class":132},[119,289,290],{"class":136},"resources",[119,292,140],{"class":132},[119,294,143],{"class":125},[119,296,297],{"class":125}," [\n",[119,299,301,304,307],{"class":121,"line":300},10,[119,302,303],{"class":146},"    \"",[119,305,306],{"class":150},"arn:aws:ec2:us-west-1:123456789012:instance/i-1234567890abcdef0",[119,308,309],{"class":146},"\"\n",[119,311,313],{"class":121,"line":312},11,[119,314,315],{"class":125},"  ],\n",[119,317,319,321,323,325,327],{"class":121,"line":318},12,[119,320,133],{"class":132},[119,322,107],{"class":136},[119,324,140],{"class":132},[119,326,143],{"class":125},[119,328,329],{"class":125}," {\n",[119,331,333,335,339,341,343,345,348,350],{"class":121,"line":332},13,[119,334,303],{"class":132},[119,336,338],{"class":337},"sZMiF","instance-id",[119,340,140],{"class":132},[119,342,143],{"class":125},[119,344,147],{"class":146},[119,346,347],{"class":150},"i-1234567890abcdef0",[119,349,140],{"class":146},[119,351,156],{"class":125},[119,353,355,357,360,362,364,366,369],{"class":121,"line":354},14,[119,356,303],{"class":132},[119,358,359],{"class":337},"state",[119,361,140],{"class":132},[119,363,143],{"class":125},[119,365,147],{"class":146},[119,367,368],{"class":150},"terminated",[119,370,309],{"class":146},[119,372,374],{"class":121,"line":373},15,[119,375,376],{"class":125},"  }\n",[119,378,379],{"class":121,"line":11},[119,380,381],{"class":125},"}\n",[38,383,384,385,387,388,391,392,394,395,397],{},"The two fields you will write patterns against constantly are ",[42,386,206],{}," (which service or application emitted this, ",[42,389,390],{},"aws.*"," for AWS services) and ",[42,393,185],{}," (which kind of event this is within that source). Everything specific to the event lives under ",[42,396,107],{},", and its shape is defined by the emitting service.",[38,399,400,401,403,404,406,407,410],{},"Two details about ",[42,402,290],{}," catch people out. AWS API call events sourced from CloudTrail often have nothing in ",[42,405,290],{}," at all, so a pattern that filters on it will never match. And global services such as IAM and Route 53 exist only in US East (N. Virginia), so their API call events are available only in that Region. A rule in ",[42,408,409],{},"eu-west-1"," waiting for an IAM policy change will wait forever.",[54,412,414],{"id":413},"event-buses-default-custom-partner","Event buses: default, custom, partner",[38,416,417],{},"An event bus is a router that receives events and offers them to the rules attached to it. There are three kinds, and the distinction is not cosmetic.",[38,419,420,421,424],{},"The ",[65,422,423],{},"default event bus"," exists in every account and Region, and it is where AWS services deliver their events. This is not configurable. When an EC2 instance changes state, that event goes to the default bus of that account, full stop.",[38,426,63,427,430,431,434],{},[65,428,429],{},"custom event bus"," is one you create. Your own applications publish to it with ",[42,432,433],{},"PutEvents",", and you can forward events from one bus to another (including across accounts and Regions) by making a bus the target of a rule. Custom buses exist so that application events do not have to share a rule namespace with the AWS service traffic, and so you can attach a resource-based policy that lets specific other accounts publish to it.",[38,436,63,437,440],{},[65,438,439],{},"partner event bus"," receives events from a SaaS provider through a partner event source you associate with it.",[442,443],"infographic",{"alt":444,"slug":445},"A routing diagram showing one event entering an event bus, being evaluated against three rules with different event patterns, and delivered to the targets of the two rules that match.","eventbridge-bus-routing-model",[38,447,448],{},"The misconception to kill now: creating a custom bus does not move AWS service events onto it. If a scenario says \"isolate our application events from AWS service noise,\" a custom bus is right. If a scenario says \"receive S3 events on our custom bus,\" the honest answer is that they arrive on the default bus and you forward them.",[38,450,451],{},"Quotas worth remembering: 100 event buses per account per Region, 300 rules per event bus in most Regions, and 5 targets per rule (that last one is not adjustable).",[54,453,455],{"id":454},"rules-the-pattern-is-the-filter","Rules: the pattern is the filter",[38,457,458,459,462,463,466],{},"A rule has a filter and a list of targets. The filter is either an ",[65,460,461],{},"event pattern"," (match events by content) or a ",[65,464,465],{},"schedule expression"," (fire on a cron or rate expression). It is one or the other.",[38,468,469],{},"The pattern has the same shape as the event it matches, which is the design decision that makes patterns readable. This pattern selects EC2 instance terminations:",[110,471,473],{"className":112,"code":472,"language":114,"meta":115,"style":115},"{\n  \"source\": [\"aws.ec2\"],\n  \"detail-type\": [\"EC2 Instance State-change Notification\"],\n  \"detail\": {\n    \"state\": [\"terminated\"]\n  }\n}\n",[42,474,475,479,501,521,533,554,558],{"__ignoreMap":115},[119,476,477],{"class":121,"line":122},[119,478,126],{"class":125},[119,480,481,483,485,487,489,492,494,496,498],{"class":121,"line":129},[119,482,133],{"class":132},[119,484,206],{"class":136},[119,486,140],{"class":132},[119,488,143],{"class":125},[119,490,491],{"class":125}," [",[119,493,140],{"class":146},[119,495,215],{"class":150},[119,497,140],{"class":146},[119,499,500],{"class":125},"],\n",[119,502,503,505,507,509,511,513,515,517,519],{"class":121,"line":159},[119,504,133],{"class":132},[119,506,185],{"class":136},[119,508,140],{"class":132},[119,510,143],{"class":125},[119,512,491],{"class":125},[119,514,140],{"class":146},[119,516,194],{"class":150},[119,518,140],{"class":146},[119,520,500],{"class":125},[119,522,523,525,527,529,531],{"class":121,"line":180},[119,524,133],{"class":132},[119,526,107],{"class":136},[119,528,140],{"class":132},[119,530,143],{"class":125},[119,532,329],{"class":125},[119,534,535,537,539,541,543,545,547,549,551],{"class":121,"line":201},[119,536,303],{"class":132},[119,538,359],{"class":337},[119,540,140],{"class":132},[119,542,143],{"class":125},[119,544,491],{"class":125},[119,546,140],{"class":146},[119,548,368],{"class":150},[119,550,140],{"class":146},[119,552,553],{"class":125},"]\n",[119,555,556],{"class":121,"line":222},[119,557,376],{"class":125},[119,559,560],{"class":121,"line":243},[119,561,381],{"class":125},[38,563,564],{},"Three separate requirements, all of which must hold.",[54,566,568],{"id":567},"how-pattern-matching-actually-works","How pattern matching actually works",[38,570,571],{},"Four rules govern every pattern you will ever write or debug. Learn them here and most \"my rule does not fire\" problems become a 30-second diagnosis.",[38,573,574,577,578,581,582,586],{},[65,575,576],{},"Matching is a subset test."," Every field you name must match. Every field you omit is ignored. So ",[42,579,580],{},"{\"source\": [\"aws.ecs\"]}"," matches ",[583,584,585],"em",{},"every"," ECS event on the bus. This is the mechanism behind rules that turn out to fire hundreds of times a day: the pattern was under-specified, not wrong.",[38,588,589,592,593,596],{},[65,590,591],{},"An array means OR."," ",[42,594,595],{},"\"state\": [\"stopped\", \"terminated\"]"," matches either value. To require two conditions, name two fields, which is an implicit AND. There is a related trap: if you write the same key twice in one pattern, EventBridge uses only the last reference and silently ignores the first.",[38,598,599,602,603,605,606,609,610,613,614,617],{},[65,600,601],{},"Matching is exact, character for character."," Most AWS services treat ",[42,604,143],{}," and ",[42,607,608],{},"/"," in an ARN as interchangeable. EventBridge does not. If the event carries ",[42,611,612],{},"instance/i-0abc"," and your pattern says ",[42,615,616],{},"instance:i-0abc",", nothing matches, and nothing tells you why.",[38,619,620,592,623,605,626,629],{},[65,621,622],{},"Comparison operators work on leaf nodes only.",[42,624,625],{},"$or",[42,627,628],{},"anything-but"," are the two exceptions.",[38,631,632],{},"Those operators are the second half of pattern fluency:",[634,635,636,652],"table",{},[637,638,639],"thead",{},[640,641,642,646,649],"tr",{},[643,644,645],"th",{},"Operator",[643,647,648],{},"Example",[643,650,651],{},"Meaning",[653,654,655,671,686,700,715,730,745,760,778],"tbody",{},[640,656,657,663,668],{},[658,659,660],"td",{},[42,661,662],{},"prefix",[658,664,665],{},[42,666,667],{},"\"Region\": [{\"prefix\": \"us-\"}]",[658,669,670],{},"value starts with",[640,672,673,678,683],{},[658,674,675],{},[42,676,677],{},"suffix",[658,679,680],{},[42,681,682],{},"\"FileName\": [{\"suffix\": \".png\"}]",[658,684,685],{},"value ends with",[640,687,688,692,697],{},[658,689,690],{},[42,691,628],{},[658,693,694],{},[42,695,696],{},"\"state\": [{\"anything-but\": \"initializing\"}]",[658,698,699],{},"value is anything else",[640,701,702,707,712],{},[658,703,704],{},[42,705,706],{},"numeric",[658,708,709],{},[42,710,711],{},"\"Price\": [{\"numeric\": [\">\", 10, \"\u003C=\", 20]}]",[658,713,714],{},"numeric range",[640,716,717,722,727],{},[658,718,719],{},[42,720,721],{},"exists",[658,723,724],{},[42,725,726],{},"\"state\": [{\"exists\": true}]",[658,728,729],{},"field present or absent",[640,731,732,737,742],{},[658,733,734],{},[42,735,736],{},"cidr",[658,738,739],{},[42,740,741],{},"\"sourceIPAddress\": [{\"cidr\": \"10.0.0.0/24\"}]",[658,743,744],{},"IP in range",[640,746,747,752,757],{},[658,748,749],{},[42,750,751],{},"equals-ignore-case",[658,753,754],{},[42,755,756],{},"\"Name\": [{\"equals-ignore-case\": \"alice\"}]",[658,758,759],{},"case-insensitive equality",[640,761,762,767,772],{},[658,763,764],{},[42,765,766],{},"wildcard",[658,768,769],{},[42,770,771],{},"\"FileName\": [{\"wildcard\": \"dir/*.png\"}]",[658,773,774,777],{},[42,775,776],{},"*"," matches any characters",[640,779,780,784,789],{},[658,781,782],{},[42,783,625],{},[658,785,786],{},[42,787,788],{},"\"$or\": [{\"Location\": [\"NY\"]}, {\"Day\": [\"Monday\"]}]",[658,790,791],{},"OR across different fields",[38,793,794,795,797,798,801,802,804,805,808,809,811],{},"Two constraints on the last two. ",[42,796,766],{}," is supported in event bus rules but ",[65,799,800],{},"not"," in pipe filters, and each event bus allows only 30 rules containing wildcards, a quota you cannot raise. And an ",[42,803,625],{}," that expands to more than 1,000 rule combinations is rejected with ",[42,806,807],{},"InvalidEventPatternException","; the combination count is the product of the argument counts of every ",[42,810,625],{}," array in the pattern.",[38,813,814],{},"An event pattern is capped at 2,048 characters by default.",[38,816,817,818,821,822,825],{},"The single most useful debugging habit here is the ",[65,819,820],{},"EventBridge Sandbox"," in the console (or the ",[42,823,824],{},"TestEventPattern"," API). Paste a real event, paste your pattern, get a yes or no. It costs nothing and it settles arguments that otherwise take an afternoon.",[54,827,829],{"id":828},"targets-and-the-two-permission-models","Targets and the two permission models",[38,831,832,833,836,837,840,841,844],{},"Up to 5 targets per rule. The list is long, and the ones that matter for remediation are Lambda, SNS, SQS, Step Functions, Systems Manager Automation, Systems Manager Run Command, Systems Manager OpsItem, Incident Manager response plans, ECS tasks, API destinations, and other event buses. Some targets do not receive the event at all: EC2 ",[42,834,835],{},"RebootInstances",", ",[42,838,839],{},"StopInstances",", and ",[42,842,843],{},"TerminateInstances"," treat the event purely as a trigger for that API call.",[38,846,847],{},"Permissions work one of two ways, and knowing which applies to which target is exam material.",[38,849,850,853,854,857,858,861],{},[65,851,852],{},"An IAM execution role."," You set ",[42,855,856],{},"RoleArn"," on the target, the role's trust policy allows ",[42,859,860],{},"events.amazonaws.com"," to assume it, and its permission policy grants the action the target needs. This is how most targets work, and it is the only option for targets such as Systems Manager Automation and ECS.",[38,863,864,867,868,870],{},[65,865,866],{},"A resource-based policy on the target."," For Lambda, SNS, and SQS, if no execution role is configured, EventBridge falls back to a policy on the target resource itself granting ",[42,869,860],{}," permission to invoke or publish.",[38,872,873,874,877,878,881,882,885,886,605,889,892,893,895],{},"Here is the practical consequence, and it is a favorite scenario. Create the rule in the console and it works, because the console attaches the resource-based policy for you. Create the same rule with ",[42,875,876],{},"PutTargets"," and the target is never invoked, because nothing attached that policy. The ",[42,879,880],{},"TriggeredRules"," metric shows the rule fired; ",[42,883,884],{},"Invocations"," shows nothing arriving. Two more variants of the same shape: an encrypted SQS queue or SNS topic needs ",[42,887,888],{},"kms:Decrypt",[42,890,891],{},"kms:GenerateDataKey"," granted to ",[42,894,860],{}," in the key policy, and EventBridge cannot use an SQS queue encrypted with an AWS owned key at all.",[54,897,899],{"id":898},"input-transformation-reshaping-the-event","Input transformation: reshaping the event",[38,901,902,903,906],{},"Some targets need the event as-is. Others need a specific structure, or a human-readable line. The ",[65,904,905],{},"input transformer"," solves this in two parts.",[38,908,420,909,912],{},[583,910,911],{},"input path"," defines variables from the event with JSON path:",[110,914,916],{"className":112,"code":915,"language":114,"meta":115,"style":115},"{\n  \"timestamp\": \"$.time\",\n  \"instance\": \"$.detail.instance-id\",\n  \"state\": \"$.detail.state\"\n}\n",[42,917,918,922,942,962,979],{"__ignoreMap":115},[119,919,920],{"class":121,"line":122},[119,921,126],{"class":125},[119,923,924,926,929,931,933,935,938,940],{"class":121,"line":129},[119,925,133],{"class":132},[119,927,928],{"class":136},"timestamp",[119,930,140],{"class":132},[119,932,143],{"class":125},[119,934,147],{"class":146},[119,936,937],{"class":150},"$.time",[119,939,140],{"class":146},[119,941,156],{"class":125},[119,943,944,946,949,951,953,955,958,960],{"class":121,"line":159},[119,945,133],{"class":132},[119,947,948],{"class":136},"instance",[119,950,140],{"class":132},[119,952,143],{"class":125},[119,954,147],{"class":146},[119,956,957],{"class":150},"$.detail.instance-id",[119,959,140],{"class":146},[119,961,156],{"class":125},[119,963,964,966,968,970,972,974,977],{"class":121,"line":180},[119,965,133],{"class":132},[119,967,359],{"class":136},[119,969,140],{"class":132},[119,971,143],{"class":125},[119,973,147],{"class":146},[119,975,976],{"class":150},"$.detail.state",[119,978,309],{"class":146},[119,980,981],{"class":121,"line":201},[119,982,381],{"class":125},[38,984,420,985,988],{},[583,986,987],{},"input template"," is what the target actually receives:",[110,990,992],{"className":112,"code":991,"language":114,"meta":115,"style":115},"{\n  \"instance\": \u003Cinstance>,\n  \"state\": \u003Cstate>,\n  \"note\": \"instance \\\"\u003Cinstance>\\\" is in \u003Cstate>\"\n}\n",[42,993,994,998,1014,1029,1059],{"__ignoreMap":115},[119,995,996],{"class":121,"line":122},[119,997,126],{"class":125},[119,999,1000,1002,1004,1006,1008,1012],{"class":121,"line":129},[119,1001,133],{"class":132},[119,1003,948],{"class":136},[119,1005,140],{"class":132},[119,1007,143],{"class":125},[119,1009,1011],{"class":1010},"srjyR"," \u003Cinstance>",[119,1013,156],{"class":125},[119,1015,1016,1018,1020,1022,1024,1027],{"class":121,"line":159},[119,1017,133],{"class":132},[119,1019,359],{"class":136},[119,1021,140],{"class":132},[119,1023,143],{"class":125},[119,1025,1026],{"class":1010}," \u003Cstate>",[119,1028,156],{"class":125},[119,1030,1031,1033,1036,1038,1040,1042,1045,1049,1052,1054,1057],{"class":121,"line":180},[119,1032,133],{"class":132},[119,1034,1035],{"class":136},"note",[119,1037,140],{"class":132},[119,1039,143],{"class":125},[119,1041,147],{"class":146},[119,1043,1044],{"class":150},"instance ",[119,1046,1048],{"class":1047},"s_hVV","\\\"",[119,1050,1051],{"class":150},"\u003Cinstance>",[119,1053,1048],{"class":1047},[119,1055,1056],{"class":150}," is in \u003Cstate>",[119,1058,309],{"class":146},[119,1060,1061],{"class":121,"line":201},[119,1062,381],{"class":125},[38,1064,1065,1066,836,1069,836,1072,840,1075,1078],{},"You get up to 100 variables, plus reserved ones you do not have to define: ",[42,1067,1068],{},"aws.events.rule-arn",[42,1070,1071],{},"aws.events.rule-name",[42,1073,1074],{},"aws.events.event.ingestion-time",[42,1076,1077],{},"aws.events.event.json"," for the whole original payload.",[38,1080,1081],{},"The failure mode to expect: EventBridge does not validate input paths when you save the rule. A path that matches nothing produces no variable, and that field simply vanishes from the output. No error, no warning, just a target receiving less than you intended.",[54,1083,1085],{"id":1084},"scheduled-rules-and-eventbridge-scheduler","Scheduled rules and EventBridge Scheduler",[38,1087,1088,1089,1092,1093,1096,1097,1100],{},"A rule can fire on a schedule instead of a pattern, using ",[42,1090,1091],{},"rate(...)"," or ",[42,1094,1095],{},"cron(...)",". Two facts about scheduled rules that questions turn on: the expression is evaluated in ",[65,1098,1099],{},"UTC",", and the finest resolution is one minute, with the invocation landing somewhere inside that minute rather than on the exact second.",[38,1102,1103,1106],{},[65,1104,1105],{},"EventBridge Scheduler"," is the separate, purpose-built service for scheduling, and it is the right answer whenever a scenario stresses scale or per-schedule flexibility. It handles millions of schedules, supports one-time invocations as well as recurring ones, understands time zones, offers flexible time windows to spread load, and reaches more than 270 services through its universal target parameter. Scheduled rules are constrained by the rules-per-bus quota and the 5-targets-per-rule limit; Scheduler is not.",[38,1108,1109],{},"Keyword cue: \"thousands of per-customer schedules,\" \"one-time,\" or \"in the customer's local time zone\" points at Scheduler. \"React when this AWS service does something\" points at a rule.",[54,1111,1113],{"id":1112},"exam-tips","Exam tips",[1115,1116,1117,1121,1127,1135,1138,1141],"ul",{},[1118,1119,1120],"li",{},"Read the stem for a past-tense verb. \"When an instance is terminated,\" \"when a snapshot completes,\" \"when someone changes a policy\" are all EventBridge. \"When CPU exceeds 80% for 10 minutes\" is an alarm.",[1118,1122,1123,1124,1126],{},"A rule that fires far more often than expected is an under-specified pattern. A rule that never fires is usually one of three things: a pattern with the wrong ARN punctuation, a global-service event expected outside us-east-1, or a filter on a ",[42,1125,290],{}," field that CloudTrail-sourced events leave empty.",[1118,1128,1129,1131,1132,1134],{},[42,1130,880],{}," greater than zero with ",[42,1133,884],{}," at zero means the routing worked and the permissions did not. That is the resource-based-policy question in metric form.",[1118,1136,1137],{},"Composite alarms cannot perform EC2 or Auto Scaling actions. When a scenario needs a composite condition to drive a multi-step repair, the composite alarm notifies and an EventBridge rule matches the alarm state-change event.",[1118,1139,1140],{},"Custom event buses never receive AWS service events directly. If an option claims otherwise, eliminate it.",[1118,1142,1143],{},"Remember the three hard numbers: 5 targets per rule (not adjustable), 300 rules per event bus, 100 event buses per account per Region.",[38,1145,1146],{},"The mental model to keep: the bus does not choose a destination. Every rule attached to a bus sees every event that arrives, decides independently whether it matches, and delivers to its own targets. Add a rule and you add a consumer without touching anything already running, which is what \"loosely coupled\" means in practice here. Next you will look at Pipes, which handles the case a bus is wrong for: one specific stream that needs its records filtered, enriched with a lookup, and handed to exactly one destination.",[1148,1149,1150],"style",{},"html pre.shiki code .sP7_E, html code.shiki .sP7_E{--shiki-light:#39ADB5;--shiki-default:#24292E;--shiki-dark:#E1E4E8}html pre.shiki code .s39Yj, html code.shiki .s39Yj{--shiki-light:#39ADB5;--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .sseR_, html code.shiki .sseR_{--shiki-light:#9C3EDA;--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .sjJ54, html code.shiki .sjJ54{--shiki-light:#39ADB5;--shiki-default:#032F62;--shiki-dark:#9ECBFF}html pre.shiki code .s_sjI, html code.shiki .s_sjI{--shiki-light:#91B859;--shiki-default:#032F62;--shiki-dark:#9ECBFF}html pre.shiki code .sZMiF, html code.shiki .sZMiF{--shiki-light:#E2931D;--shiki-default:#005CC5;--shiki-dark:#79B8FF}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .srjyR, html code.shiki .srjyR{--shiki-light:#90A4AE;--shiki-light-font-style:inherit;--shiki-default:#B31D28;--shiki-default-font-style:italic;--shiki-dark:#FDAEB7;--shiki-dark-font-style:italic}html pre.shiki code .s_hVV, html code.shiki .s_hVV{--shiki-light:#90A4AE;--shiki-default:#005CC5;--shiki-dark:#79B8FF}",{"title":115,"searchDepth":159,"depth":159,"links":1152},[1153,1154,1155,1156,1157,1158,1159,1160,1161],{"id":56,"depth":129,"text":57},{"id":100,"depth":129,"text":101},{"id":413,"depth":129,"text":414},{"id":454,"depth":129,"text":455},{"id":567,"depth":129,"text":568},{"id":828,"depth":129,"text":829},{"id":898,"depth":129,"text":899},{"id":1084,"depth":129,"text":1085},{"id":1112,"depth":129,"text":1113},"md",[1164],{"slug":445,"concept":1165,"style":1166,"aspectRatio":1167,"labels":1168},"A left-to-right routing diagram showing how one event travels through an event bus. Event sources on the left send a single event into a central event bus; three rules sit to the right of the bus, each labeled with its own event pattern, and arrows show two of them matching and delivering to their own targets while the third does not match. The emphasis is that the bus fans the event out to every rule independently rather than routing it to one destination, and the footer states that consequence in one sentence.","diagram","16:9",[1169,1170,1171,1172,1173,1174,1175,1176,1177,1178,1179],"Sources: AWS services, your applications, SaaS partners","Default event bus","Rule A pattern: source aws.ec2, state stopped","Rule B pattern: source aws.ec2, any state change","Rule C pattern: source aws.rds","Rule A matches: delivers to its own targets","Rule B matches: delivers to its own targets","Rule C does not match: EventBridge takes no action","Up to 5 targets per rule","Targets: Lambda, SNS, SQS, Systems Manager Automation, Step Functions, and more","The bus does not pick a destination. Every rule sees every event, and each match delivers on its own.",[26,27,28,29,30,31],{},"/courses/aws-certified-cloudops-engineer-associate/en/domains/01-monitoring-logging-performance/03-event-driven-remediation/01-eventbridge-fundamentals",{"passingScore":1184,"questions":1185},70,[1186,1195,1203,1209,1217,1225,1235,1243],{"question":1187,"type":1188,"options":1189,"correctAnswer":1191,"explanation":1194},"An operations team needs to react whenever anyone modifies a security group in the production account. Which detection mechanism fits?","single",[1190,1191,1192,1193],"A CloudWatch metric alarm on the security group's rule count","An EventBridge rule matching the AWS API Call via CloudTrail event for AuthorizeSecurityGroupIngress","A CloudWatch Logs metric filter on the VPC flow logs","A composite alarm combining the security group alarms","A security group change is a discrete fact, not a number that rises and falls, so there is no metric for an alarm to evaluate. Flow logs record traffic that was allowed or denied, not the configuration change itself, so a metric filter would see the effect at best and only after traffic arrives.",{"question":1196,"type":1188,"options":1197,"correctAnswer":1201,"explanation":1202},"Which event pattern matches an EC2 instance state-change event where the state is stopped or terminated?",[1198,1199,1200,1201],"{\"source\": [\"aws.ec2\"], \"detail\": {\"state\": {\"stopped\": true, \"terminated\": true}}}","{\"source\": [\"aws.ec2\"], \"detail\": {\"state\": [\"stopped\"], \"state\": [\"terminated\"]}}","{\"source\": [\"aws.ec2\"], \"detail\": {\"state\": [{\"anything-but\": [\"running\"]}]}}","{\"source\": [\"aws.ec2\"], \"detail\": {\"state\": [\"stopped\", \"terminated\"]}}","Multiple values inside one array are an OR, so listing both states in the same array matches either one. Repeating the same key twice is the trap: EventBridge keeps only the last reference, so that pattern quietly matches terminated alone.",{"question":1204,"type":1188,"options":1205,"correctAnswer":1207,"explanation":1208},"True or False: if you create a custom event bus, AWS service events from that account start arriving on it instead of the default bus.",[1206,1207],"True","False","AWS service events always go to the account's default event bus and cannot be redirected there. Custom buses receive events your own applications publish with PutEvents, or events you forward from another bus with a bus-to-bus rule.",{"question":1210,"type":1188,"options":1211,"correctAnswer":1214,"explanation":1216},"A rule's event pattern specifies only \"source\": [\"aws.ecs\"]. What does it match?",[1212,1213,1214,1215],"Nothing, because a pattern must also specify detail-type","Only events whose entire body is exactly that JSON object","Every event from Amazon ECS on that bus, regardless of detail-type or detail contents","Every event on the bus, because a single-field pattern is treated as a wildcard","Pattern matching is a subset test: every field you name must match, and every field you leave out is ignored. That is why over-broad patterns are the usual cause of a rule firing far more often than expected.",{"question":1218,"type":1188,"options":1219,"correctAnswer":1220,"explanation":1224},"You add a Lambda function as the target of a rule using the PutTargets API, without specifying a RoleArn. The rule triggers but the function never runs. What is the most likely cause?",[1220,1221,1222,1223],"The Lambda function's resource-based policy does not allow events.amazonaws.com to invoke it","Lambda cannot be an EventBridge target without Step Functions in between","The rule needs a dead-letter queue before any target can be invoked","The event pattern is too large and was silently truncated","For Lambda, SNS, and SQS targets with no execution role configured, EventBridge falls back to resource-based permissions on the target. The console attaches that policy for you; PutTargets does not, which is why the same rule works from the console and fails from the API.",{"question":1226,"type":1227,"options":1228,"correctAnswers":1233,"explanation":1234},"Which statements about EventBridge event pattern matching are correct? (Choose 2.)","multiple",[1229,1230,1231,1232],"Comparison operators such as prefix and numeric only work on leaf nodes, with $or and anything-but as the exceptions","EventBridge treats a colon and a slash in an ARN as equivalent characters","The wildcard operator is supported in event bus rules but not in pipe filters","A pattern with exists false matches events where the named intermediate object is absent",[1229,1231],"EventBridge does exact character matching in patterns, so a colon and a slash are different, which is a frequent cause of ARN patterns that never fire. Exists matching also works only on leaf nodes, not on intermediate objects, so you cannot test for the presence of a nested container that way.",{"question":1236,"type":1188,"options":1237,"correctAnswer":1240,"explanation":1242},"A team needs 40,000 one-time invocations at customer-specific times in customer-specific time zones. Which EventBridge feature fits?",[1238,1239,1240,1241],"One scheduled rule per customer on the default event bus","A single scheduled rule with 40,000 targets","EventBridge Scheduler schedules","An archive with 40,000 scheduled replays","Scheduler is built for schedules at this scale, supports one-time invocations and time zones, and can hit more than 270 services through the universal target parameter. Scheduled rules are capped by the rules-per-bus quota, evaluate in UTC, and allow only 5 targets each.",{"question":1244,"type":1188,"options":1245,"correctAnswer":1249,"explanation":1250},"An input transformer defines the variable \u003Cinstance> from $.detail.instance-id, but the deployed target receives no instance value at all. What explains this?",[1246,1247,1248,1249],"Input transformers cannot read fields inside detail","Variable names must be uppercase to be substituted","The template referenced the variable without quotes, so it was dropped","The event being matched has no detail.instance-id field, so the variable was never created","EventBridge does not validate input paths when you save a rule, and a path that resolves to nothing produces no variable rather than an error. The field simply disappears from the transformed output, so a typo in an input path surfaces only in the target's own logs.",{"title":21,"description":22},"courses/aws-certified-cloudops-engineer-associate/en/domains/01-monitoring-logging-performance/03-event-driven-remediation/01-eventbridge-fundamentals","q_F1YKNA1WNgkVt1zfsEdHJHbgE7JrkeO0h9Marp-1I",{"locked":5,"reason":6,"meta":1255,"item":3},{"title":1256,"description":1257,"isFree":10,"estimatedMinutes":1258,"difficulty":1259,"learningObjectives":1260},"EventBridge Pipes and Troubleshooting","Build point-to-point integrations with EventBridge Pipes using filtering and enrichment, then diagnose event delivery failures with retry policies, dead-letter queues, pipe logs, and the AWS/Events metrics.",26,"advanced",[1261,1262,1263,1264,1265,1266],"Describe the four stages of an EventBridge pipe and the services allowed at each","Choose between an event bus and a pipe for a given integration","Explain how batching, concurrency, and partial batch failure behave in a pipe","Configure pipe logging with the right log level and decide when to include execution data","Diagnose a failed target delivery using the retry policy, a dead-letter queue, and the AWS/Events metrics","Recover lost or misprocessed events with an archive and a replay"]