CloudWatch Events (EventBridge) in AWS - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

What happens when a CloudWatch Event rule targets a Lambda function with a dead-letter queue configured?

You have a CloudWatch Event rule that triggers a Lambda function. The Lambda function has a dead-letter queue (DLQ) configured. What is the behavior when the Lambda function invocation fails?

A The event is retried twice and then sent to the DLQ if still failing.

B The event is retried indefinitely until the Lambda function succeeds, ignoring the DLQ.

C The event is discarded immediately without sending to the DLQ or retrying.

D The failed event is sent to the DLQ for later analysis and the event is not retried automatically.

💡 Hint

Think about how Lambda handles failures with DLQ configured in asynchronous invocation.

When a Lambda function is invoked asynchronously by CloudWatch Events and it fails, Lambda retries the invocation twice (total of three attempts). If it still fails, the event is sent to the configured DLQ.

❓ Architecture

intermediate

Which architecture best ensures exactly-once processing of events using EventBridge and SQS?

You want to design an architecture using EventBridge and SQS to ensure that each event is processed exactly once by your application. Which setup achieves this?

A EventBridge rule sends events to an SQS FIFO queue, and the application reads from the queue with message deduplication enabled.

B EventBridge rule sends events to a standard SQS queue, and the application deletes messages after processing.

C EventBridge rule sends events directly to Lambda with retries enabled to ensure no event loss.

D EventBridge rule sends events to SNS topic which fans out to multiple SQS queues for parallel processing.

💡 Hint

Consider which SQS queue type supports deduplication and ordering to avoid duplicate processing.

SQS FIFO queues support exactly-once processing with message deduplication and ordering. Using EventBridge to send events to a FIFO queue ensures no duplicates and ordered processing.

❓ security

advanced

What IAM permission is required for an EventBridge rule to invoke a Lambda function?

To allow an EventBridge rule to invoke a Lambda function, which IAM permission must be granted?

A "events:PutEvents" permission granted to the Lambda function role.

B "lambda:InvokeFunction" permission granted to the EventBridge service principal on the Lambda function resource.

C "lambda:CreateEventSourceMapping" permission granted to the EventBridge rule.

D "events:InvokeFunction" permission granted to the Lambda function resource.

💡 Hint

Think about what permission allows a service to call a Lambda function.

EventBridge needs permission to invoke the Lambda function. This is done by granting the "lambda:InvokeFunction" permission to the EventBridge service principal on the Lambda function's resource policy.

❓ Configuration

advanced

Which EventBridge rule pattern matches events from EC2 instance state changes to 'stopped' or 'terminated'?

Choose the correct EventBridge event pattern JSON that matches EC2 instance state changes when the state is either 'stopped' or 'terminated'.

A

{
  "source": ["aws.ec2"],
  "detail-type": ["EC2 Instance State-change Notification"],
  "detail": {
    "state": {"equals": ["stopped", "terminated"]}
  }
}

B

{
  "source": ["aws.ec2"],
  "detail-type": ["EC2 Instance State-change Notification"],
  "detail": {
    "state": "stopped,terminated"
  }
}

C

{
  "source": ["aws.ec2"],
  "detail-type": ["EC2 Instance State-change Notification"],
  "detail": {
    "state": ["stopped", "terminated"]
  }
}

D

{
  "source": ["aws.ec2"],
  "detail-type": ["EC2 Instance State-change Notification"],
  "detail": {
    "state": ["stopped"],
    "state": ["terminated"]
  }
}

💡 Hint

Remember the syntax for matching multiple values in an array for a key in EventBridge event patterns.

EventBridge event patterns use arrays to match multiple values for a key. Option C correctly uses an array for the "state" key. Option C treats it as a string, A uses invalid syntax, and D repeats the same key twice which is invalid JSON.

✅ Best Practice

expert

What is the best practice to avoid event loss when using EventBridge with multiple targets?

You have an EventBridge rule with multiple targets including Lambda, SQS, and SNS. To avoid losing events if one target fails, what is the best practice?

A Configure EventBridge to batch events and send them only once per minute to reduce failures.

B Send events only to Lambda and rely on Lambda retries to handle failures for other services.

C Use a single SNS topic as the target and subscribe all services to it to centralize event delivery.

D Configure a dead-letter queue (DLQ) for each target and enable retry policies on the EventBridge rule.

💡 Hint

Think about how to handle failures per target and ensure events are not lost.

Configuring a DLQ for each target ensures failed events are captured for later processing. Enabling retry policies helps EventBridge retry failed deliveries. This combination avoids event loss across multiple targets.

Practice

1. What is the primary purpose of AWS CloudWatch Events (EventBridge)?

easy

A. To create virtual servers in the cloud

B. To store large amounts of data for analysis

C. To manage user permissions and access

D. To automatically respond to events by triggering actions

Solution

1. Step 1: Understand EventBridge role

   EventBridge watches for events happening in AWS or custom apps and triggers actions automatically.

2. Step 2: Compare options

   Virtual servers relate to EC2, data storage to S3, user permissions to IAM; only responding to events matches EventBridge.

3. Final Answer:

   To automatically respond to events by triggering actions -> Option D

4. Quick Check:

   EventBridge triggers actions on events = C [OK]

Hint: EventBridge links events to actions automatically [OK]

Common Mistakes:

• Confusing EventBridge with storage or compute services
• Thinking it manages user permissions
• Assuming it creates servers

2. Which of the following is the correct JSON snippet to create a CloudWatch Events rule that triggers every 5 minutes?

easy

A. {"ScheduleExpression": "rate(5 minute)"}

B. {"ScheduleExpression": "cron(0/5 * * * ? *)"}

C. {"ScheduleExpression": "rate(5 min)"}

D. {"ScheduleExpression": "cron(5 * * * ? *)"}

Solution

1. Step 1: Understand schedule syntax

   EventBridge supports rate and cron expressions. For 5-minute intervals, cron syntax is cron(0/5 * * * ? *).

2. Step 2: Check each option

   {"ScheduleExpression": "rate(5 minute)"} uses rate(5 minute) which is invalid syntax (must use 'minutes' plural). {"ScheduleExpression": "cron(0/5 * * * ? *)"} uses correct cron syntax for every 5 minutes. {"ScheduleExpression": "rate(5 min)"} uses 'min' which is invalid. {"ScheduleExpression": "cron(5 * * * ? *)"} triggers at minute 5 every hour, not every 5 minutes.

3. Final Answer:

   {"ScheduleExpression": "cron(0/5 * * * ? *)"} -> Option B

4. Quick Check:

   Cron for every 5 minutes = D [OK]

Hint: Use cron(0/5 * * * ? *) for every 5 minutes [OK]

Common Mistakes:

• Using 'min' instead of 'minutes' in rate expressions
• Confusing cron syntax for intervals
• Using rate with incorrect pluralization

3. Given this EventBridge rule JSON snippet, what will happen when an EC2 instance state changes to 'stopped'?

{
  "Source": ["aws.ec2"],
  "DetailType": ["EC2 Instance State-change Notification"],
  "Detail": {"state": ["stopped"]}
}

medium

A. The rule triggers only when an EC2 instance stops

B. The rule triggers for any EC2 state change

C. The rule triggers only when an EC2 instance starts

D. The rule never triggers

Solution

1. Step 1: Analyze event pattern

   The pattern filters events from source 'aws.ec2' with detail type 'EC2 Instance State-change Notification' and detail state 'stopped'.

2. Step 2: Understand filtering effect

   Only events where the instance state changes to 'stopped' match this pattern, so the rule triggers only then.

3. Final Answer:

   The rule triggers only when an EC2 instance stops -> Option A

4. Quick Check:

   Detail state filter 'stopped' triggers only on stop = A [OK]

Hint: Detail filters limit triggers to specific event states [OK]

Common Mistakes:

• Assuming all EC2 state changes trigger the rule
• Confusing 'stopped' with 'started' state
• Ignoring the detail filter in the event pattern

4. You created an EventBridge rule to trigger a Lambda function on S3 object creation, but the Lambda never runs. What is the most likely cause?

medium

A. The rule's event pattern does not match S3 object creation events

B. The Lambda function has no code

C. S3 does not support EventBridge integration

D. The Lambda function is in a different AWS region

Solution

1. Step 1: Check EventBridge and S3 integration

   S3 supports EventBridge events for object creation, so integration is possible.

2. Step 2: Verify event pattern correctness

   If the event pattern does not correctly specify S3 object creation events, the rule won't trigger the Lambda.

3. Step 3: Consider Lambda region

   EventBridge and Lambda must be in the same region; cross-region triggers do not work.

4. Final Answer:

   The rule's event pattern does not match S3 object creation events -> Option A

5. Quick Check:

   Incorrect event pattern blocks trigger = B [OK]

Hint: Check event pattern matches actual event source and type [OK]

Common Mistakes:

• Assuming Lambda runs without correct event pattern
• Ignoring region mismatch issues
• Believing S3 can't send events to EventBridge

5. You want to create an EventBridge rule that triggers a Lambda function only when an EC2 instance is launched in a specific VPC. Which approach correctly achieves this?

hard

A. Use an event pattern filtering on 'source' as 'aws.ec2' and 'detail-type' as 'EC2 Instance State-change Notification' with 'detail.vpc-id' matching the VPC ID

B. Use a scheduled rule to check EC2 instances every minute and invoke Lambda if any are in the VPC

C. Use an event pattern filtering on 'source' as 'aws.ec2' and 'detail-type' as 'EC2 Instance Launch Successful' with 'detail.vpc-id' matching the VPC ID

D. Use an event pattern filtering on 'source' as 'aws.ec2' and 'detail-type' as 'EC2 Instance State-change Notification' with 'detail.state' as 'running'

Solution

1. Step 1: Identify correct event type for instance launch

   The event 'EC2 Instance Launch Successful' signals a new instance launch, not state changes.

2. Step 2: Filter by VPC ID in event detail

   Filtering on 'detail.vpc-id' ensures only instances in the specific VPC trigger the rule.

3. Step 3: Evaluate other options

   State-change notification with VPC ID does not indicate launch specifically. Scheduled polling is inefficient. State-change to running filters state but not launch event.

4. Final Answer:

   Use an event pattern filtering on 'source' as 'aws.ec2' and 'detail-type' as 'EC2 Instance Launch Successful' with 'detail.vpc-id' matching the VPC ID -> Option C

5. Quick Check:

   Launch event + VPC filter = A [OK]

Hint: Filter on launch event and VPC ID in event detail [OK]

Common Mistakes:

• Using state-change events instead of launch events
• Trying scheduled polling instead of event-driven
• Ignoring VPC ID filter in event pattern