The pattern behind nearly every question in this domain (14%) is detect → route → act: a signal (an alarm, an event, a finding) goes through EventBridge to something that fixes the problem or tells a person, with as little custom code as possible.
Amazon EventBridge
EventBridge is the backbone of every “react automatically” answer.
Buses
| Bus | Receives |
|---|---|
| Default bus | AWS service events automatically: EC2 state changes, Auto Scaling lifecycle actions, CodePipeline/CodeBuild/CodeDeploy state changes, Health, GuardDuty and Security Hub findings, Config compliance changes — and every API call recorded by CloudTrail (detail-type AWS API Call via CloudTrail, such as AuthorizeSecurityGroupIngress or PutBucketPublicAccessBlock) |
| Custom bus | Your applications’ events (PutEvents). Does not receive AWS service events |
| Partner bus | SaaS events (Datadog, Zendesk, Auth0…) |
Events from global services (IAM, console sign-in, some Health events) arrive in us-east-1.
Rules and targets
- A rule is an event pattern (JSON match on
source,detail-typeanddetailfields, with content filters such as prefix, numeric, exists and anything-but) or a schedule, sending to targets: Lambda, Systems Manager Automation, Run Command, Step Functions, SNS, SQS, CodePipeline, CodeBuild, ECS tasks, another account’s event bus, or an API destination. - Input transformers reshape the payload (input paths plus a template).
- API destinations call any HTTP API (Jira, Slack, PagerDuty) directly, using a connection that stores the auth in Secrets Manager — no Lambda.
- Target failures: each target has a retry policy (maximum event age and attempts) and an optional SQS dead-letter queue.
- Permissions: SQS and SNS targets need a resource policy allowing
events.amazonaws.com(plus the KMS key policy if they use a customer managed key). Lambda needs a resource-based permission (the console adds it). Step Functions, Kinesis, SSM Automation and ECS targets use an IAM role instead. - Cross-account: send events to a central account’s bus, allowed by that bus’s policy.
- Archive and replay reprocesses events after a fix. EventBridge Scheduler runs cron or one-time jobs. EventBridge Pipes connect a source (SQS, Kinesis, DynamoDB Streams, Kafka, MQ) through filter, enrich and transform steps to a target.
Classic automation patterns
| Trigger | Response |
|---|---|
Security group opened to 0.0.0.0/0 (CloudTrail API event) |
Lambda revokes the rule; SNS notifies |
Root user console sign-in (userIdentity.type = Root) |
SNS alert |
| AWS Health scheduled maintenance | SSM Automation restarts the instance (or a Lambda registers a task in a maintenance window if restarts must happen then) |
Health AWS_RISK_CREDENTIALS_EXPOSED |
Lambda deactivates the access key |
| Auto Scaling terminating lifecycle hook | Lambda → Run Command collects logs → CompleteLifecycleAction |
| Pipeline or build failed | SNS or chat notification |
| High-severity GuardDuty finding | Step Functions or Lambda isolates the instance: quarantine security group, EBS snapshots |
New instance launched (RunInstances) |
Lambda tags it with the creator |
AWS Config
- A configuration recorder (per Region) and a delivery channel (S3 + SNS).
- Rules: hundreds of managed rules —
required-tags,s3-bucket-public-read-prohibited,s3-bucket-level-public-access-prohibited,ec2-instance-profile-attached,encrypted-volumes,restricted-ssh,acm-certificate-expiration-check,access-keys-rotated,cloudformation-stack-drift-detection-check— or custom rules in Lambda or Guard policy-as-code for anything without a managed rule. - Triggers: on configuration change, or periodic. Rules evaluate existing resources too — which is why they beat “EventBridge on create” answers whenever a question says existing and future resources.
- Remediation: manual or automatic, using an SSM Automation runbook (AWS-provided or custom — add a tag, attach an instance profile, block public access), with retries.
- Conformance packs bundle rules and remediations and deploy across an organization; member accounts can’t delete them. An aggregator gives a multi-account, multi-Region compliance view. Compliance changes are emitted to EventBridge.
Incident tooling
- Systems Manager OpsCenter collects OpsItems — operational issues created from CloudWatch alarms, Config and EventBridge — with related resources and runbooks attached. Good for “track and remediate operational issues centrally”.
- Systems Manager Incident Manager provides response plans triggered by alarms or EventBridge, contacts and escalation plans with engagement acknowledgment, chat channels, runbooks, and a timeline with post-incident analysis. It still appears in exam questions; check its current availability before relying on it for new accounts.
- Notify people through SNS or Amazon Q Developer in chat applications (formerly AWS Chatbot) for Slack and Microsoft Teams.
Troubleshooting
Where to look
| What | Location |
|---|---|
| cfn-init | /var/log/cfn-init.log, /var/log/cfn-init-cmd.log |
| User data (cloud-init) | /var/log/cloud-init-output.log |
| CodeDeploy agent | /var/log/aws/codedeploy-agent/ |
| Elastic Beanstalk | Request logs (tail or bundle), or stream to CloudWatch |
| Lambda | Log group /aws/lambda/<function-name> |
Common failures
| Symptom | Usual cause and fix |
|---|---|
| CodeDeploy deployment stuck on EC2 | Agent not running, or the instance profile can’t read the revision in S3 |
| CodeDeploy fails at a hook | The script returned non-zero or hit its timeout |
Every deployment fails at ApplicationStop |
The previous revision’s stop script is broken — redeploy with --ignore-application-stop-failures |
| Blue/green traffic never shifts | Health checks failing on the new target group |
Stack stuck in UPDATE_ROLLBACK_FAILED |
Fix the resource, then continue update rollback |
| Instances “succeed” without working software | Add cfn-signal with a CreationPolicy |
| Auto Scaling launch failures | Invalid AMI or instance type, no capacity, missing KMS grant for encrypted EBS, wrong subnet — see the activity history |
| Instances replaced in a loop | Health check grace period shorter than start-up time |
Instances stuck in Pending:Wait |
Lifecycle hook never completed |
| Async Lambda events disappear | Add an on-failure destination or DLQ (async calls retry twice) |
| One bad record blocks a stream | Partial batch response, bisect on error, maximum retry attempts |
| Lambda HTTP 429 | Concurrency limit — reserved concurrency for critical functions, raise limits, or buffer with SQS |
Alarm in INSUFFICIENT_DATA |
Metric not arriving — agent, name, dimensions or permissions |
Finding the root cause
- CloudWatch Logs Insights across log groups, X-Ray traces and service maps, CloudTrail for “who changed what” just before the incident, and DevOps Guru for machine-learning-detected anomalies and likely causes.
Exam checklist
- “React to an API call immediately”: EventBridge rule on the CloudTrail event (default bus) → Lambda or SSM Automation.
- “Detect and fix existing and new non-compliant resources”: Config rule + automatic remediation.
- “Call Jira or PagerDuty from an event without code”: API destination.
- “SNS target never receives events”: topic policy must allow
events.amazonaws.com(and the KMS key policy, if encrypted). - “AWS maintenance or exposed key notifications”: AWS Health → EventBridge.
- “React to events from every account centrally”: forward to a central event bus.
- “Isolate, don’t terminate”: keep forensic evidence — quarantine security group, snapshots, tags, detach from the Auto Scaling group.
- “Reprocess events after a bug fix”: EventBridge archive and replay.