CloudWatch Events (EventBridge) in AWS - Mini Project: Build & Apply

Create a CloudWatch EventBridge Rule to Trigger a Lambda Function

📖 Scenario: You are working as a cloud engineer for a company. They want to automatically run a Lambda function every day at 6 AM UTC to perform daily cleanup tasks.You will create an EventBridge rule that triggers the Lambda function on schedule.

🎯 Goal: Build an EventBridge rule with a cron schedule expression that triggers a Lambda function named DailyCleanupFunction every day at 6 AM UTC.

📋 What You'll Learn

Create an EventBridge rule named DailyCleanupRule with a cron schedule expression for 6 AM UTC daily

Set the rule's state to ENABLED

Add the Lambda function DailyCleanupFunction as the target of the rule

💡 Why This Matters

🌍 Real World

Automating tasks on a schedule is common in cloud environments. EventBridge rules help trigger Lambda functions or other services without manual intervention.

💼 Career

Cloud engineers and DevOps professionals often create scheduled events and connect them to serverless functions for automation and maintenance.

1

Create the EventBridge rule resource

Create an AWS CloudFormation resource of type AWS::Events::Rule named DailyCleanupRule with a ScheduleExpression set to cron(0 6 * * ? *) and State set to ENABLED.

AWS

# Your CloudFormation template starts here
# Define the EventBridge rule resource named DailyCleanupRule

Hint

The cron expression cron(0 6 * * ? *) means 6 AM UTC every day.

2

Add the Lambda function target to the rule

Add a Targets property to the DailyCleanupRule resource. Set it to a list with one target object that has Arn set to !GetAtt DailyCleanupFunction.Arn and Id set to DailyCleanupTarget.

AWS

Resources:
  DailyCleanupRule:
    Type: AWS::Events::Rule
    Properties:
      ScheduleExpression: 'cron(0 6 * * ? *)'
      State: ENABLED
      # Add Targets property here

Hint

The Targets property is a list of objects. Each target needs an Arn and an Id.

3

Define the Lambda function resource

Create an AWS CloudFormation resource named DailyCleanupFunction of type AWS::Lambda::Function. Set Handler to index.handler, Runtime to python3.12, and Role to arn:aws:iam::123456789012:role/lambda-execution-role. Set Code to an inline zip with a single file index.py containing a simple handler function.

AWS

Resources:
  DailyCleanupRule:
    Type: AWS::Events::Rule
    Properties:
      ScheduleExpression: 'cron(0 6 * * ? *)'
      State: ENABLED
      Targets:
        - Arn: !GetAtt DailyCleanupFunction.Arn
          Id: DailyCleanupTarget

# Define the DailyCleanupFunction Lambda resource below

Hint

The Lambda function needs a role ARN for execution permissions.

4

Add permission for EventBridge to invoke the Lambda function

Add an AWS CloudFormation resource named AllowEventBridgeInvoke of type AWS::Lambda::Permission. Set FunctionName to !Ref DailyCleanupFunction, Action to lambda:InvokeFunction, Principal to events.amazonaws.com, and SourceArn to !GetAtt DailyCleanupRule.Arn.

AWS

Resources:
  DailyCleanupRule:
    Type: AWS::Events::Rule
    Properties:
      ScheduleExpression: 'cron(0 6 * * ? *)'
      State: ENABLED
      Targets:
        - Arn: !GetAtt DailyCleanupFunction.Arn
          Id: DailyCleanupTarget
  DailyCleanupFunction:
    Type: AWS::Lambda::Function
    Properties:
      Handler: index.handler
      Runtime: python3.12
      Role: arn:aws:iam::123456789012:role/lambda-execution-role
      Code:
        ZipFile: |
          def handler(event, context):
              return 'Cleanup done'

# Add Lambda permission resource here

Hint

This permission allows EventBridge to call your Lambda function.

Practice

1. What is the primary purpose of AWS CloudWatch Events (EventBridge)?

easy

A. To create virtual servers in the cloud

B. To store large amounts of data for analysis

C. To manage user permissions and access

D. To automatically respond to events by triggering actions

Solution

1. Step 1: Understand EventBridge role

   EventBridge watches for events happening in AWS or custom apps and triggers actions automatically.

2. Step 2: Compare options

   Virtual servers relate to EC2, data storage to S3, user permissions to IAM; only responding to events matches EventBridge.

3. Final Answer:

   To automatically respond to events by triggering actions -> Option D

4. Quick Check:

   EventBridge triggers actions on events = C [OK]

Hint: EventBridge links events to actions automatically [OK]

Common Mistakes:

• Confusing EventBridge with storage or compute services
• Thinking it manages user permissions
• Assuming it creates servers

2. Which of the following is the correct JSON snippet to create a CloudWatch Events rule that triggers every 5 minutes?

easy

A. {"ScheduleExpression": "rate(5 minute)"}

B. {"ScheduleExpression": "cron(0/5 * * * ? *)"}

C. {"ScheduleExpression": "rate(5 min)"}

D. {"ScheduleExpression": "cron(5 * * * ? *)"}

Solution

1. Step 1: Understand schedule syntax

   EventBridge supports rate and cron expressions. For 5-minute intervals, cron syntax is cron(0/5 * * * ? *).

2. Step 2: Check each option

   {"ScheduleExpression": "rate(5 minute)"} uses rate(5 minute) which is invalid syntax (must use 'minutes' plural). {"ScheduleExpression": "cron(0/5 * * * ? *)"} uses correct cron syntax for every 5 minutes. {"ScheduleExpression": "rate(5 min)"} uses 'min' which is invalid. {"ScheduleExpression": "cron(5 * * * ? *)"} triggers at minute 5 every hour, not every 5 minutes.

3. Final Answer:

   {"ScheduleExpression": "cron(0/5 * * * ? *)"} -> Option B

4. Quick Check:

   Cron for every 5 minutes = D [OK]

Hint: Use cron(0/5 * * * ? *) for every 5 minutes [OK]

Common Mistakes:

• Using 'min' instead of 'minutes' in rate expressions
• Confusing cron syntax for intervals
• Using rate with incorrect pluralization

3. Given this EventBridge rule JSON snippet, what will happen when an EC2 instance state changes to 'stopped'?

{
  "Source": ["aws.ec2"],
  "DetailType": ["EC2 Instance State-change Notification"],
  "Detail": {"state": ["stopped"]}
}

medium

A. The rule triggers only when an EC2 instance stops

B. The rule triggers for any EC2 state change

C. The rule triggers only when an EC2 instance starts

D. The rule never triggers

Solution

1. Step 1: Analyze event pattern

   The pattern filters events from source 'aws.ec2' with detail type 'EC2 Instance State-change Notification' and detail state 'stopped'.

2. Step 2: Understand filtering effect

   Only events where the instance state changes to 'stopped' match this pattern, so the rule triggers only then.

3. Final Answer:

   The rule triggers only when an EC2 instance stops -> Option A

4. Quick Check:

   Detail state filter 'stopped' triggers only on stop = A [OK]

Hint: Detail filters limit triggers to specific event states [OK]

Common Mistakes:

• Assuming all EC2 state changes trigger the rule
• Confusing 'stopped' with 'started' state
• Ignoring the detail filter in the event pattern

4. You created an EventBridge rule to trigger a Lambda function on S3 object creation, but the Lambda never runs. What is the most likely cause?

medium

A. The rule's event pattern does not match S3 object creation events

B. The Lambda function has no code

C. S3 does not support EventBridge integration

D. The Lambda function is in a different AWS region

Solution

1. Step 1: Check EventBridge and S3 integration

   S3 supports EventBridge events for object creation, so integration is possible.

2. Step 2: Verify event pattern correctness

   If the event pattern does not correctly specify S3 object creation events, the rule won't trigger the Lambda.

3. Step 3: Consider Lambda region

   EventBridge and Lambda must be in the same region; cross-region triggers do not work.

4. Final Answer:

   The rule's event pattern does not match S3 object creation events -> Option A

5. Quick Check:

   Incorrect event pattern blocks trigger = B [OK]

Hint: Check event pattern matches actual event source and type [OK]

Common Mistakes:

• Assuming Lambda runs without correct event pattern
• Ignoring region mismatch issues
• Believing S3 can't send events to EventBridge

5. You want to create an EventBridge rule that triggers a Lambda function only when an EC2 instance is launched in a specific VPC. Which approach correctly achieves this?

hard

A. Use an event pattern filtering on 'source' as 'aws.ec2' and 'detail-type' as 'EC2 Instance State-change Notification' with 'detail.vpc-id' matching the VPC ID

B. Use a scheduled rule to check EC2 instances every minute and invoke Lambda if any are in the VPC

C. Use an event pattern filtering on 'source' as 'aws.ec2' and 'detail-type' as 'EC2 Instance Launch Successful' with 'detail.vpc-id' matching the VPC ID

D. Use an event pattern filtering on 'source' as 'aws.ec2' and 'detail-type' as 'EC2 Instance State-change Notification' with 'detail.state' as 'running'

Solution

1. Step 1: Identify correct event type for instance launch

   The event 'EC2 Instance Launch Successful' signals a new instance launch, not state changes.

2. Step 2: Filter by VPC ID in event detail

   Filtering on 'detail.vpc-id' ensures only instances in the specific VPC trigger the rule.

3. Step 3: Evaluate other options

   State-change notification with VPC ID does not indicate launch specifically. Scheduled polling is inefficient. State-change to running filters state but not launch event.

4. Final Answer:

   Use an event pattern filtering on 'source' as 'aws.ec2' and 'detail-type' as 'EC2 Instance Launch Successful' with 'detail.vpc-id' matching the VPC ID -> Option C

5. Quick Check:

   Launch event + VPC filter = A [OK]

Hint: Filter on launch event and VPC ID in event detail [OK]

Common Mistakes:

• Using state-change events instead of launch events
• Trying scheduled polling instead of event-driven
• Ignoring VPC ID filter in event pattern