> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# EventBridge for Automated Responses

> Explains how Amazon EventBridge routes detection events using JSON patterns to trigger scalable, cross-account automated remediation and orchestration with Lambda, Step Functions, and Systems Manager.

Welcome. This lesson explains how Amazon EventBridge turns detection (metrics, logs, traces) into automated operational responses. Detection tools like CloudWatch Metrics, CloudWatch Logs & Logs Insights, CloudWatch Alarms, Application Insights, and X-Ray surface issues — but detection alone doesn't remediate them. EventBridge provides the central, serverless routing and orchestration layer to trigger, coordinate, and audit automated responses.

![A presentation slide titled "From Detection to Action" outlining a four-step automated incident workflow. It lists: Monitor & Detect (CloudWatch/CloudTrail/Config), Route Events (EventBridge), Trigger Actions (automated remediation), and Verify & Log (confirm resolution and audit trail).](https://mintcdn.com/kodekloud-c4ac6d9a/SSy1aL2mVSdeEi1p/images/AWS-Certified-DevOps-Engineer-Professional/Domain-4-Monitoring-and-Logging/EventBridge-for-Automated-Responses/detection-to-action-workflow.jpg?fit=max\&auto=format\&n=SSy1aL2mVSdeEi1p\&q=85\&s=be3cca2f0e22850f0f87e8e096f1814e)

What EventBridge does

* Acts as a serverless event bus that receives events from many sources.
* Evaluates events against JSON-based rules (patterns).
* Forwards matching events to one or more targets that perform actions or orchestrations.
* Automatically scales, and retries failed deliveries (exponential backoff) for up to 24 hours.

Core flow:
Event source → Event bus → Rule (pattern matching) → Targets (actions)

Event bus types

| Bus type | Purpose | Typical use case |
| - | -: | - |
| Default | Account-level bus for AWS service events | Receive AWS-originated events (CloudWatch, CloudTrail) |
| Custom | User-created buses for application or domain events | Isolate application events or create per-team buses |
| Partner | SaaS provider integrations | Ingest events directly from partners (Datadog, PagerDuty, etc.) |

![A slide titled "Amazon EventBridge" showing three feature boxes — "Intelligent Event Routing", a highlighted "Pattern Matching and Filtering", and "Zero Infrastructure Management." To the right it notes JSON-based event patterns and enabling filtering on source, detail-type, and nested detail fields (exact, prefix, numeric matching).](https://mintcdn.com/kodekloud-c4ac6d9a/SSy1aL2mVSdeEi1p/images/AWS-Certified-DevOps-Engineer-Professional/Domain-4-Monitoring-and-Logging/EventBridge-for-Automated-Responses/eventbridge-pattern-matching-filtering-json.jpg?fit=max\&auto=format\&n=SSy1aL2mVSdeEi1p\&q=85\&s=622e5d7f112283db99ce92216550909e)

Pattern matching and filtering
EventBridge rules use JSON-based event patterns to match event fields such as `source`, `detail-type`, and nested `detail` attributes. Supported pattern operators include:

* Exact string matches
* Prefix matches
* Numeric comparisons (>, \<, >=, \<=)
* Field existence checks
* Array membership checks

These operators enable precise routing so downstream automation only runs for relevant events — reducing noise and cost.

When to use EventBridge vs SNS vs SQS

| Purpose | Best choice | Why |
| - | -: | - |
| Content-based routing across AWS, apps, and SaaS | EventBridge | Enables JSON pattern matching and rich filtering for many targets |
| Simple pub/sub fan-out and push notifications | SNS | Lightweight topic-based fan-out with simple filtering |
| Durable queuing, buffering, and pull consumers | SQS | Decouples producers/consumers and supports FIFO ordering |

EventBridge is ideal for content-based routing and integrations across services and SaaS. Use SNS for simple topic-based fan-out and SQS for durable queueing and pull-based consumers.

Event sources and ingestion
EventBridge accepts events from:

* AWS services (CloudWatch Alarms, CloudTrail, Config)
* Custom applications via the PutEvents API
* Partner SaaS integrations (pre-built connectors)
* Scheduled rules (cron expressions)

This flexibility makes EventBridge a natural central hub for routing operational and application events.

![A presentation slide titled "Event Sources — Where Events Come From" showing a diagonal flow of colored bubbles for AWS Service Events, Custom Application Events, SaaS Partner Events, and Schedule-Based Events. Bullet points note examples like CloudWatch alarms, CloudTrail, PutEvents API, and pre-built SaaS integrations (Datadog, MongoDB, Zendesk, Auth0).](https://mintcdn.com/kodekloud-c4ac6d9a/SSy1aL2mVSdeEi1p/images/AWS-Certified-DevOps-Engineer-Professional/Domain-4-Monitoring-and-Logging/EventBridge-for-Automated-Responses/event-sources-aws-saas-custom-schedule.jpg?fit=max\&auto=format\&n=SSy1aL2mVSdeEi1p\&q=85\&s=dc4e3b45b52a9bf877cdf642cbf9c140)

Event patterns and operators — practical examples
You can express rules such as:

* Match every EC2 state change where `detail.state` equals `terminated`.
* Match Security Hub findings with `severity.label` equal to `HIGH` or `CRITICAL`.
* Match resources whose name starts with `prod-` using a prefix match.

![A presentation slide titled "Event Patterns" that lists five pattern-matching capabilities—Exact match, Prefix match, Numeric operators, Exists operator, and Array matching—arranged along a horizontal timeline. Each item includes a short description of how it filters events (e.g., exact strings, prefixes, numeric ranges, field presence, and array value matching).](https://mintcdn.com/kodekloud-c4ac6d9a/SSy1aL2mVSdeEi1p/images/AWS-Certified-DevOps-Engineer-Professional/Domain-4-Monitoring-and-Logging/EventBridge-for-Automated-Responses/event-patterns-matching-timeline.jpg?fit=max\&auto=format\&n=SSy1aL2mVSdeEi1p\&q=85\&s=da9baa272f31703ac74ddd048cb343c0)

Example conceptual use cases

* EC2 lifecycle: Detect an EC2 instance termination where the resource name begins with `production` and trigger lifecycle cleanup or replacement.
* Security: Detect a Security Hub finding with severity `HIGH`/`CRITICAL` and failed compliance status, then initiate containment playbooks.

A single rule can match multiple related patterns and invoke the same remediation target, simplifying maintenance.

Targets and integrations
EventBridge can invoke many target types:

* AWS Lambda
* Step Functions (recommended for orchestration)
* Systems Manager (Run Command / Automation)
* SNS and SQS
* ECS tasks
* CodePipeline / CodeBuild
* Kinesis streams
* Custom targets (via API destinations)

Common automated remediation flow:
CloudWatch Logs (pattern) → Metric Filter → CloudWatch Metric → CloudWatch Alarm → EventBridge rule → Target (Lambda / SSM / Step Functions) → Remediation + Audit Logging

Step Functions shines for multi-step remediations that require retries, error handling, branching logic, or human approvals. It centralizes orchestration and provides clear logging and state history.

![A diagram titled "Step Functions Integration — Complex Workflows with Error Handling" showing a five-step workflow: Event Detection, Multi-Step Processing, Error Handling, Human Approval Gates, and Completion & Logging, connected by arrows. Each colored box briefly describes its role (triggering events, remediation stages, retry/catch logic, manual approvals, and CloudWatch logging).](https://mintcdn.com/kodekloud-c4ac6d9a/SSy1aL2mVSdeEi1p/images/AWS-Certified-DevOps-Engineer-Professional/Domain-4-Monitoring-and-Logging/EventBridge-for-Automated-Responses/step-functions-complex-workflows-error-handling.jpg?fit=max\&auto=format\&n=SSy1aL2mVSdeEi1p\&q=85\&s=9d85ac91962e270cb8e6e914428ae721)

Centralized cross-account routing
You can centralize events from multiple AWS accounts into one central event bus to apply consistent automation, simplify compliance, and reduce operational overhead. Cross-account routing requires configuring resource-based policies and granting source accounts permission to PutEvents to the central bus.

![A presentation slide titled "Cross-Account Event Routing – Centralized Event Management" that lists three steps: 01 Source Accounts, 02 Central Event Bus, and 03 Compliance & Auditing with short descriptions. The left side shows blue/orange/green chevron icons and there's a small "© Copyright KodeKloud" at the bottom.](https://mintcdn.com/kodekloud-c4ac6d9a/SSy1aL2mVSdeEi1p/images/AWS-Certified-DevOps-Engineer-Professional/Domain-4-Monitoring-and-Logging/EventBridge-for-Automated-Responses/cross-account-event-routing-slide.jpg?fit=max\&auto=format\&n=SSy1aL2mVSdeEi1p\&q=85\&s=1369070721e3e0f2c261c6454f58d2a6)

![A presentation slide titled "Cross-Account Event Routing" showing two implementation items on the left ("Resource-Based Policies" and "Source Account Rules") and, on the right, three benefits of centralization: consistent automation policies across accounts, reduced operational overhead, and simplified compliance and auditing.](https://mintcdn.com/kodekloud-c4ac6d9a/SSy1aL2mVSdeEi1p/images/AWS-Certified-DevOps-Engineer-Professional/Domain-4-Monitoring-and-Logging/EventBridge-for-Automated-Responses/cross-account-event-routing-centralized-benefits.jpg?fit=max\&auto=format\&n=SSy1aL2mVSdeEi1p\&q=85\&s=16b03a2e31ddceaa9b0a96d5219a9067)

Common automation patterns

| Pattern | Typical flow | Best for |
| - | -: | - |
| Policy remediation | AWS Config → EventBridge → Systems Manager | Auto-fix drift and enforce policies |
| Security response | CloudTrail → EventBridge → Lambda → SNS | Fast containment, alerting, and audits |
| Lifecycle automation | EC2 state change → EventBridge → Step Functions | Complex lifecycle actions and orchestration |
| Scheduled jobs | Cron rule → EventBridge → Lambda/Step Functions | Periodic maintenance and compliance tasks |

Select a pattern based on runtime requirements, conditional complexity, and whether human approval or multi-step orchestration is required. Use Systems Manager for OS-level runbooks and Step Functions when you need stateful orchestration.

![A slide titled "Common Automation Patterns" listing AWS event-driven patterns (e.g., AWS Config → EventBridge → Systems Manager, CloudTrail → EventBridge → Lambda → SNS, EC2 state changes → EventBridge → Step Functions, cron → EventBridge → Lambda/Step Functions) mapped to outcomes like Auto-Remediation, Security Response, Lifecycle Automation, and Scheduled Automation.](https://mintcdn.com/kodekloud-c4ac6d9a/SSy1aL2mVSdeEi1p/images/AWS-Certified-DevOps-Engineer-Professional/Domain-4-Monitoring-and-Logging/EventBridge-for-Automated-Responses/aws-event-driven-automation-patterns.jpg?fit=max\&auto=format\&n=SSy1aL2mVSdeEi1p\&q=85\&s=40507ddd2426bd61c9a578aa5f086be5)

Limits and operational considerations
Be mindful of these practical limits and design considerations:

| Constraint | Notes / Mitigation |
| - | - |
| Rules per event bus (default soft limit: 300) | Request a quota increase if needed; aggregate patterns when possible |
| Targets per rule (limit: 5) | Use SNS, Step Functions, or fan-out patterns to reach more targets |
| Regionality | EventBridge is regional. For cross-region centralization, forward events (e.g., via Kinesis or cross-region EventBridge) |
| Retry behavior | Failed deliveries are retried with backoff for up to 24 hours |

![A slide titled "Limitations and Considerations" showing four colored cards. Each card lists a constraint: "300 Rules per Event Bus" (soft limit), "5 Targets per Rule" (hard limit), "Same‑Region Limitation" (cross‑account routing only), and "24‑Hour Retry Window" (failed delivery retries).](https://mintcdn.com/kodekloud-c4ac6d9a/SSy1aL2mVSdeEi1p/images/AWS-Certified-DevOps-Engineer-Professional/Domain-4-Monitoring-and-Logging/EventBridge-for-Automated-Responses/limitations-300rules-5targets-same-region-24hr-retry.jpg?fit=max\&auto=format\&n=SSy1aL2mVSdeEi1p\&q=85\&s=f3d6831384cc5b8f9afdcc2206c68620)

Best practices (summary)

* Centralize events where consistent automation and auditing are needed; use resource policies for cross-account PutEvents.
* Prefer EventBridge for content-based routing, especially when integrating multiple AWS services, partner SaaS, or custom apps.
* Use Step Functions to orchestrate retries, approvals, and multi-step remediation with observable state.
* Combine CloudWatch Logs → Metric Filters → Alarms → EventBridge as a reliable detection-to-action pipeline.
* Plan for regionality and limits (rules, targets) during architectural design.

Summary
Amazon EventBridge is a serverless, managed event bus that bridges detection to action. Use it for content-based routing, partner and cross-account integrations, and centralized automated remediation. Combine EventBridge with Lambda, Systems Manager, and Step Functions to build resilient, auditable operational automation while accounting for limits, regions, and permissions.

Further reading and references

* [Amazon EventBridge documentation](https://docs.aws.amazon.com/eventbridge/latest/userguide/what-is-amazon-eventbridge.html)
* [AWS Step Functions](https://docs.aws.amazon.com/step-functions/latest/dg/welcome.html)
* [AWS Systems Manager Automation](https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-automation.html)
* [CloudWatch Alarms and Logs](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/WhatIsCloudWatch.html)

> **[Watch Video](https://learn.kodekloud.com/user/courses/aws-certified-devops-engineer-professional/module/15ed9473-60f4-466a-b7b2-3d9cb829e847/lesson/148f7e99-9ffc-48a7-a2aa-3d2e3986eff8)**


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.