Demo EventBridge Rule to SNS and Lambda

• EC2 emits an instance state-change event (for example: stopped)
• EventBridge receives the event on the default event bus and evaluates it against a rule (an event pattern)
• When the pattern matches, EventBridge forwards the event to configured targets (SNS and Lambda)

• An SNS topic to receive notifications
• A Lambda function to process the event programmatically
• An EventBridge rule with an event pattern that matches EC2 stopped events and targets both SNS and Lambda
• A subscription to confirm delivery to an email endpoint

• An AWS account with permissions to create SNS topics, Lambda functions, and EventBridge rules
• At least one EC2 instance in the same account and region to generate events
• Recommended reading: Amazon EventBridge overview, Amazon SNS documentation, AWS Lambda documentation

​

Create an SNS topic

1. Choose Create topic → Standard.
2. Enter a name, for example ec2-alerts.
3. Leave other defaults unless you have specific compliance or encryption needs.
4. Create the topic and note the Topic ARN displayed on the topic details page.

​

Create the Lambda function

1. Choose Create function → Author from scratch.
2. Enter a function name (for example, ec2-event-handler) and select Python as the runtime.
3. Leave permissions and execution role as default for the demo, or attach a role with minimal invoke/CloudWatch permissions in production.
4. Create the function. The function will be invoked by EventBridge when the rule matches.

​

Create an EventBridge rule

https://us-east-2.console.aws.amazon.com/events/home?region=us-east-2#/eventbus/default
arn:aws:events:us-east-2:635573991785:event-bus/default

1. Choose Create rule.
2. Use the Advanced Builder (not the visual Enhanced Builder) to compose the JSON event pattern precisely.
3. Name the rule (for example, ec2-state-change) and set Event bus to default.
4. Keep the rule enabled so it evaluates matching events immediately.

​

Define the event pattern

{
  "source": ["aws.ec2"],
  "detail-type": ["EC2 Instance State-change Notification"],
  "detail": {
    "state": ["stopped"]
  }
}

​

Add targets

​

Subscribe to the SNS topic

• Topic ARN:

arn:aws:sns:us-east-2:635573991785:ec2-alerts

• Protocol: Email
• Endpoint: your.email@example.com (use an address you can access)

​

Generate an EC2 state-change event

1. From the EC2 console, stop a running instance (Actions → Instance State → Stop).
2. When the instance transitions to stopped, EC2 emits an instance state-change event to the account’s default EventBridge bus.
3. EventBridge evaluates the incoming event against the rule’s event pattern. If detail.state is stopped, the rule matches.

​

Verify Lambda invocation and SNS delivery

• Lambda: Open the ec2-event-handler function, select the Monitor tab (CloudWatch metrics), and verify that one or more invocations were recorded at the time you stopped the instance.

• SNS / Email: Check the subscribed email inbox for the notification message from SNS. The notification contains details such as the instance ID, AWS account ID, and the event type “EC2 Instance State-change Notification” indicating the stopped state.

​

Troubleshooting tips

• No SNS email received:
  • Verify the subscription is Confirmed (not Pending).
  • Check the SNS topic’s delivery status and CloudWatch logs for failed deliveries.
• Lambda not invoked:
  • Confirm the EventBridge rule has the Lambda target and that the rule is enabled.
  • Verify EventBridge has invoke permissions for the Lambda (check resource-based policy on the function).
  • Inspect CloudWatch Logs for any Lambda errors.
• Event not matching:
  • Confirm the detail-type, source, and detail.state in the event pattern match the actual event payload. Use EventBridge’s Event Archive or CloudWatch Events history to inspect event samples.

​

Summary

• Captures EC2 instance state-change events on the default EventBridge bus
• Uses an EventBridge rule with an event pattern to filter for stopped instances
• Routes matched events to multiple targets (SNS and Lambda)
• Delivers notifications via SNS subscriptions (email in this demo) and invokes Lambda for programmatic processing