Amazon EventBridge

What it is

Amazon EventBridge is a serverless service that connects application components with events: JSON (JavaScript Object Notation)A text format for structured data made of name-and-value pairs and lists, such as {"bucket": "logs"}. IAM policies, most AWS API responses, and many CloudFormation templates are written in JSON.Glossary entry records that say something happened, such as "an EC2 instance stopped" or "an order was placed". Event sources send events to an event bus, and EventBridge delivers each event to the targets that want it. Sources and targets never call each other directly.

EventBridge has three parts:

Event buses route events from many sources to many targets, using rules.
Pipes connect one source to one target, with optional filtering and enrichment.
Scheduler invokes targets on a schedule or once at a set time.

Event buses and rules

Default event bus: every account has one, and AWS services send their events to it automatically, for example EC2 state changes, S3 events (when enabled on the bucket), and AWS Health events. CloudTrail also delivers API (Application programming interface)A defined way for one program to ask another for data or actions, such as a set of HTTPS requests and responses. Every AWS service is controlled through its API, which the console, the CLI, and the SDKs call for you.Glossary entry calls to it as AWS API Call via CloudTrail events, which needs a trail with logging turned on.
Custom event buses: for your own applications' events, published with the PutEvents API.
Partner event buses: receive events from SaaS partners such as Zendesk, Shopify, Datadog, or PagerDuty, with no integration code.

A rule on a bus has an event pattern, which matches events on any of their fields, for example "source": ["aws.ec2"] and "detail": {"state": ["stopped"]}. Each rule can send matching events to up to five targets, such as Lambda functions, SQS queues, SNS topics, Step Functions state machines, Kinesis streams, ECS tasks, or another event bus. An input transformer can reshape the event before delivery.

In 2026, AWS added a new kind of bus, called simply the Custom Event Bus. It keeps events for 1 to 365 days, delivers to subscribers that each have one target, supports ordered (FIFO (First in, first out)Processing items in the order they arrived. Amazon SQS FIFO queues keep messages in order within a message group and remove duplicates.Glossary entry) delivery within an event group and deduplication at publish time, and is shared with other accounts through AWS RAM. The bus with rules and targets described here is now called Custom Event Bus - Classic and remains available; it has no ordering or deduplication, and the comparisons in this tutorial describe it. Exam scenarios are written for rules and targets.

EventBridge rules. AWS services send events to the default event bus, and your application sends events to a custom event bus with PutEvents. A rule with an event pattern matches events on a bus and sends them to targets: a Lambda function, an SQS queue, and a Step Functions state machine.

Archive and replay

An archive keeps the events from a bus that match a pattern, for a set number of days or indefinitely. You can later replay them to the same bus, for example to recover from a bug in a consumer or to test a new feature with real events.

Schema registry

EventBridge provides schemas for AWS service events, and schema discovery can infer schemas from the events on a bus. From a schema you can download code bindings for your programming language.

Pipes, Scheduler, and API destinations

EventBridge Pipes reads from one source, such as an SQS queue, a Kinesis or DynamoDB stream, or Amazon MSK, filters the events, optionally enriches them (for example by calling a Lambda function or an API), and delivers them to one target. You pay only for events that pass the filter. Use Pipes in place of glue code that polls a source and calls a target.
EventBridge Scheduler runs rate-based, cron-based, and one-time schedules in any time zone, adjusting for daylight saving time. It can call over 270 AWS services directly, retries failed calls, and offers flexible time windows to spread load. AWS recommends Scheduler over the older scheduled rules.
API destinations send events to any HTTPS (HTTP Secure)HTTP sent over a TLS-encrypted connection, so that requests and responses cannot be read or changed on the way, and the server proves its identity with a certificate.Glossary entry endpoint, including SaaS APIs. A connection holds the authorization (Basic, OAuth, or API key), which EventBridge stores in AWS Secrets Manager. You set a maximum invocation rate per second so the endpoint is not overwhelmed. The endpoint must respond within 5 seconds.

Security, resilience, performance, and cost

Security

IAM controls who can create rules and publish events. Targets need permissions too: EventBridge uses either the target's Resource-based policyA permissions policy attached to a resource, such as an S3 bucket policy or an SQS queue policy, that says which principals can use it, including principals in other accounts. Identity-based policies, in contrast, attach to users, groups, and roles.Glossary entry (for example, a Lambda function or an SQS queue) or an IAM role that you give the rule.
Cross-account delivery: a rule in the sender account targets an event bus in the receiver account. The receiver's bus has a resource-based policy that allows the sender account, or a whole AWS Organizations organization. The sender rule needs an IAM role. On the receiver side, add the account field to event patterns so rules match only the accounts you expect.
Encryption at restEncrypting data where it is stored, such as on disks, in databases, or in backups, so that it cannot be read without the key. On AWS it usually uses keys in AWS KMS.Glossary entry: EventBridge encrypts event data with an AWS owned key by default, or with a customer managed AWS KMS key that you choose. Schema discovery does not work on buses encrypted with a Customer managed keyA KMS key that you create, own, and manage: you control its key policy, rotation, and deletion. AWS managed keys, in contrast, are created and managed for you by an AWS service.Glossary entry.
Private access: an interface VPC endpointA private connection from a VPC to an AWS service or another endpoint service without crossing the internet. Gateway endpoints, for Amazon S3 and DynamoDB, are route table targets; interface endpoints are network interfaces that use AWS PrivateLink.Glossary entry (AWS PrivateLink) lets resources in a VPC send events without the internet.

Resilience

Retries: if a target cannot be reached, EventBridge retries with Exponential backoffWaiting longer after each failed attempt before retrying, such as 1, 2, then 4 seconds, usually with some randomness (jitter), so that retries do not overload a struggling service. The AWS SDKs retry this way.Glossary entry, for up to 24 hours and 185 attempts by default. You can lower both.
DLQ (Dead-letter queue)A queue that receives messages that could not be processed after a set number of attempts, so they stop blocking other messages and can be inspected later. Amazon SQS, Amazon SNS, AWS Lambda, and Amazon EventBridge can send failed messages to one.Glossary entry: give each target a DLQ (a standard SQS queue) to keep events that could not be delivered. Without one, the event is dropped once retries run out. Errors such as a missing permission or a deleted target are not retried, and go straight to the DLQ.
Global endpoints: for Regional Fault toleranceThe ability of a system to keep working without interruption when a component fails, because enough redundant capacity is already running. It goes further than high availability, which may allow a short failover.Glossary entry, a global endpoint uses an Amazon Route 53 Health checkA regular test, such as a request to a web page, that a load balancer, an Auto Scaling group, or Route 53 makes to see whether a resource is working. Unhealthy resources stop receiving traffic or are replaced.Glossary entry to fail custom events over to an event bus in a secondary AWS RegionA separate geographic area where AWS runs its services, such as us-east-1 in Northern Virginia, made up of several Availability Zones. Most resources live in one Region; you choose Regions for latency, data residency, and the services you need.Glossary entry. With event replication, events go to both Regions. AWS gives an RTO (Recovery time objective)The longest acceptable time between a disruption and the workload being available again.Glossary entry and RPO (Recovery point objective)The most data, measured in time, that a workload can afford to lose in a disaster. With an RPO of one hour, data must be restorable to no more than an hour before the failure.Glossary entry of about 360 seconds.
Cross-Region delivery: a rule can send events to an event bus in another Region.

Performance

PutEvents accepts up to 10 events per request, under 1 MB in total. The requests-per-second quota varies by Region and can be raised.
Target invocations have their own per-Region quota. When it is reached, invocations are delayed, not dropped.
Each API destination has an invocation rate limit (300 per second by default). Set it below what the endpoint can handle, and add a DLQ in case the backlog outlasts the retry period.

Cost

Events from AWS services to the default bus are free. Custom and partner events are charged per million events published, with each 64 KB chunk counting as one event.
Delivering to another event bus, in another account or Region, is charged per event. Archive storage and replayed events, schema discovery beyond a free monthly allowance, Pipes requests, and API destination invocations are charged too.
Scheduler includes 14 million free invocations a month, then charges per million.

Monitoring

Amazon CloudWatch receives metrics every minute:
- MatchedEvents, TriggeredRules, and Invocations show activity.
- FailedInvocations, InvocationsSentToDlq, and ThrottledRules show trouble.
- IngestionToInvocationStartLatency shows delay.
AWS CloudTrail records EventBridge API calls, such as PutRule, PutTargets, and PutEvents.

EventBridge or another service?

If the requirement is	Choose
React to changes in AWS services or to API calls	EventBridge rule on the default bus
Receive events from a SaaS application	EventBridge partner event bus
Route events by their content to different targets	EventBridge rules with event patterns
Push the same message to many subscribers quickly, or to email, SMS, or mobile	Amazon SNS
Buffer work so consumers pull at their own pace	Amazon SQS
Run a task every night, or once at a set time	EventBridge Scheduler
Coordinate several steps with branching, waits, and retries	AWS Step Functions

Reverse mindmap: when the question points here

Is it Amazon EventBridge?

Yes, when the question says
- React when an EC2 instance changes state leads to EventBridge rule on the default bus
- Act on an API call such as a security group change leads to Rule on AWS API Call via CloudTrail
- Events from Zendesk, Shopify, or another SaaS app leads to Partner event bus
- Route events to different targets by content leads to Rules with event patterns
Use its other parts
- Run a job every night or once at a set time leads to EventBridge Scheduler
- Queue or stream to one target, with filtering and enrichment leads to EventBridge Pipes
- Send events to a third-party HTTPS API leads to API destination
- Reprocess past events after fixing a bug leads to Archive and replay
Make it reliable and secure
- Keep events a target could not receive leads to Dead-letter queue on the target
- Survive a Regional outage leads to Global endpoint
- Collect events from many accounts leads to Central bus with a resource-based policy
No, when the question says
- Consumers pull and process at their own pace leads to Amazon SQS
- Email or SMS to people leads to Amazon SNS
- Multi-step workflow with branching leads to AWS Step Functions

Key takeaways

Event buses route events by rules; each rule matches an event pattern and sends to up to five targets.
The default bus receives AWS service events, plus API calls through CloudTrail; partner buses receive SaaS events.
Pipes connect one source to one target; Scheduler runs schedules and one-time tasks; API destinations call HTTPS endpoints.
Retries last up to 24 hours by default; add a DLQ per target and archives for replay.
Cross-account delivery needs a resource-based policy on the receiving bus; global endpoints add Regional FailoverSwitching automatically to a standby resource when the primary one fails, such as a standby database in Amazon RDS or a backup site chosen by Route 53 failover routing.Glossary entry.