AWS EventBridge Integration

Overview

Amazon EventBridge is a serverless event bus that delivers a stream of real-time events from AWS services, SaaS applications, and your own applications. With this integration you can forward any AWS event to autobotAI via an EventBridge rule and API destination, triggering automated workflows the moment a specific event occurs.

Unlike the pre-configured integrations for Security Hub, Inspector, or GuardDuty, this generic EventBridge integration puts you in control of which events to listen to. You define the event pattern, and autobotAI receives matching events in real time through a listener.

By using this integration, you can:

• Listen to any AWS service event available on the default EventBridge bus
• Define custom event patterns to capture exactly the events you care about
• Trigger automated workflows in autobotAI when specific AWS events occur
• React to infrastructure changes, API calls, scheduled events, and more in real time
• Combine events from multiple AWS services into a single listener or separate them across dedicated listeners

Use Cases

Because you choose the event pattern, the possibilities are broad. Common examples include:

Infrastructure Change Automation

• EC2 state changes: Auto-tag, notify, or remediate when instances start, stop, or terminate
• Security group modifications: Detect and revert unauthorized rule changes
• S3 bucket events: Respond to bucket policy changes, object uploads, or access control modifications
• RDS events: Act on database instance state changes, snapshot creation, or failover events

Compliance and Governance

• AWS Config rule evaluations: Trigger remediation when a Config rule becomes non-compliant
• IAM policy changes: Alert on or revert unauthorized IAM modifications
• CloudTrail API activity: Respond to specific API calls (e.g., DeleteBucket, StopLogging)
• Tag enforcement: Detect and correct resources missing required tags

Operational Automation

• Auto Scaling events: React to scale-out or scale-in lifecycle events
• ECS / EKS task and pod events: Monitor container workload state changes
• CodePipeline / CodeBuild events: Trigger downstream workflows on build success or failure
• Systems Manager events: Respond to patch compliance changes or command execution results

Cost Management

• Savings Plans and Reserved Instance events: Alert on upcoming expirations
• Budgets alerts: Trigger workflows when spending thresholds are breached
• Trusted Advisor check results: Automate responses to cost optimization recommendations

Scheduled Automation

• Cron-based schedules: Use EventBridge Scheduler rules to invoke your listener on a recurring schedule for periodic health checks, report generation, or housekeeping tasks

Prerequisites

Before setting up the integration, ensure you have:

1. Active AWS Account

   • An active AWS account in the region where you want to capture events
   • The AWS service(s) whose events you want to capture must be active and generating events

2. autobotAI Account

   • A registered autobotAI account
   • Admin or Editor permissions to create listeners

3. Event Pattern Identified

   • You must know the event source and detail type for the AWS events you want to capture
   • Use the Amazon EventBridge event pattern documentation to identify the correct pattern
   • You can browse available events in the EventBridge console under Rules → Create rule → Event pattern

Architecture

The integration uses AWS EventBridge to securely forward events to autobotAI:

AWS Service Event → EventBridge Rule (your event pattern) → API Destination → autobotAI Listener

Components:

• EventBridge Rule: Matches events based on your custom event pattern
• API Destination: Secure HTTPS endpoint pointing to your autobotAI listener
• Connection: API key authentication between AWS and autobotAI
• autobotAI Listener: Receives and processes incoming events

Event Buses

By default, all AWS service events are published to the default event bus. If you are using custom event buses or partner event sources, create the rule on the appropriate bus.

Multi-Region and Multi-Account

EventBridge rules are regional. If you need to capture events from multiple regions or accounts:

• Multi-region: Deploy the EventBridge rule in each region where you want to capture events, or use EventBridge cross-region event routing to forward events to a central region.
• Multi-account: Use EventBridge cross-account event delivery or AWS Organizations to aggregate events into a central account before forwarding to autobotAI.

Setup Instructions

Step 1: Create a Listener in autobotAI

1. Navigate to Listeners

   • Go to the autobotAI dashboard
   • Click on "Bot Building Blocks" → "Listeners"

2. Create New Listener

   • Click on "+ New" to create a new listener

3. Configure Listener Details

   • Name: Give your listener a descriptive name (e.g., "AWS EventBridge - EC2 State Changes")
   • Description: Describe the events this listener will receive
   • Authentication Method: Select Secret Key in Headers
   • Click on "Next"

4. Generate Authentication

   • autobotAI will automatically generate a unique Listener URL and Secret Key
   • Click "Generate" if needed

5. Important: Save Your Credentials

   • Copy both the Listener URL and Secret Key
   • Store these securely - they will be needed for AWS configuration

Step 2: Create the EventBridge Rule

You can create the rule using the AWS Console, AWS CLI, or CloudFormation. The console approach is described below.

Option A: AWS Console

1. Go to the Amazon EventBridge console and choose Rules → Create rule.

2. Define rule detail

   • Name: A descriptive name, for example autobotAI-EC2-StateChange
   • Description: Describe what this rule captures
   • Event bus: Select default (or your custom bus)
   • Rule type: Select Rule with an event pattern
   • Click "Next"

3. Build event pattern

   Select Event pattern form for a guided experience, or use the Custom pattern (JSON editor) to paste a pattern directly.

   Using the form:

   • Event source: AWS services
   • AWS service: Select the service (e.g., EC2, S3, IAM, Config)
   • Event type: Select the specific event type

   Using JSON editor (examples below):

   EC2 Instance State Change:

   json
   {
     "source": ["aws.ec2"],
     "detail-type": ["EC2 Instance State-change Notification"]
   }

   S3 Bucket Policy Change via CloudTrail:

   json
   {
     "source": ["aws.s3"],
     "detail-type": ["AWS API Call via CloudTrail"],
     "detail": {
       "eventSource": ["s3.amazonaws.com"],
       "eventName": ["PutBucketPolicy", "DeleteBucketPolicy"]
     }
   }

   AWS Config Compliance Change:

   json
   {
     "source": ["aws.config"],
     "detail-type": ["Config Rules Compliance Change"],
     "detail": {
       "newEvaluationResult": {
         "complianceType": ["NON_COMPLIANT"]
       }
     }
   }

   IAM Policy Change via CloudTrail:

   json
   {
     "source": ["aws.iam"],
     "detail-type": ["AWS API Call via CloudTrail"],
     "detail": {
       "eventSource": ["iam.amazonaws.com"],
       "eventName": ["CreatePolicy", "DeletePolicy", "AttachUserPolicy", "DetachUserPolicy", "AttachRolePolicy", "DetachRolePolicy"]
     }
   }

   Security Group Change:

   json
   {
     "source": ["aws.ec2"],
     "detail-type": ["AWS API Call via CloudTrail"],
     "detail": {
       "eventSource": ["ec2.amazonaws.com"],
       "eventName": ["AuthorizeSecurityGroupIngress", "AuthorizeSecurityGroupEgress", "RevokeSecurityGroupIngress", "RevokeSecurityGroupEgress"]
     }
   }

   ECS Task State Change:

   json
   {
     "source": ["aws.ecs"],
     "detail-type": ["ECS Task State Change"]
   }

   CodePipeline Execution State Change:

   json
   {
     "source": ["aws.codepipeline"],
     "detail-type": ["CodePipeline Pipeline Execution State Change"],
     "detail": {
       "state": ["FAILED", "SUCCEEDED"]
     }
   }

   Tip: You can combine multiple sources or detail types in a single pattern using arrays. For example, to capture both EC2 and RDS state changes:

   json
   {
     "source": ["aws.ec2", "aws.rds"],
     "detail-type": ["EC2 Instance State-change Notification", "RDS DB Instance Event"]
   }

   Click "Next" after defining your pattern.

4. Select target

   • Target types: Select EventBridge API destination
   • API destination: Select Create a new API destination

5. Configure API destination

   • Name: autobotAI-EventBridge-Listener (or a more specific name)
   • API destination endpoint: Paste your autobotAI listener URL (from Step 1)
   • HTTP method: POST
   • Connection type: Create a new connection
   • Connection name: autobotAI-EventBridge-Connection
   • Authorization type: API key
   • API key name: x-secret-key
   • API key value: Paste your autobotAI secret key (from Step 1)
   • Invocation rate limit: 300 per second (adjust based on expected event volume)

6. Configure execution role

   • Select Create a new role for this specific resource
   • AWS will create an IAM role with the minimum permissions needed to invoke the API destination

7. Review and create

   • Review the rule configuration
   • Click "Create rule"
   • Verify the rule state is ENABLED

Option B: AWS CLI

Use the following commands to create the integration via the CLI. Replace the placeholder values with your actual values.

Create the connection:

bash
aws events create-connection \
  --name autobotAI-EventBridge-Connection \
  --authorization-type API_KEY \
  --auth-parameters "{\"ApiKeyAuthParameters\":{\"ApiKeyName\":\"x-secret-key\",\"ApiKeyValue\":\"YOUR_SECRET_KEY\"}}"

Create the API destination:

bash
aws events create-api-destination \
  --name autobotAI-EventBridge-Listener \
  --connection-arn "CONNECTION_ARN_FROM_ABOVE" \
  --invocation-endpoint "YOUR_LISTENER_URL" \
  --http-method POST \
  --invocation-rate-limit-per-second 300

Create the rule (example: EC2 state changes):

bash
aws events put-rule \
  --name autobotAI-EC2-StateChange \
  --event-pattern '{"source":["aws.ec2"],"detail-type":["EC2 Instance State-change Notification"]}' \
  --state ENABLED

Add the API destination as a target:

bash
aws events put-targets \
  --rule autobotAI-EC2-StateChange \
  --targets '[{"Id":"autobotAI-target","Arn":"API_DESTINATION_ARN","RoleArn":"EXECUTION_ROLE_ARN","HttpParameters":{"HeaderParameters":{}}}]'

Option C: CloudFormation

You can also deploy the integration using a CloudFormation template. Below is a parameterized template that you can customize with your event pattern:

yaml
AWSTemplateFormatVersion: '2010-09-09'
Description: autobotAI Generic EventBridge Integration

Parameters:
  APIEndPoint:
    Type: String
    Description: Your autobotAI listener URL
  APIKeyName:
    Type: String
    Default: x-secret-key
    Description: API key header name
  APIKeyValue:
    Type: String
    NoEcho: true
    Description: Your autobotAI listener secret key
  EventSource:
    Type: String
    Description: 'AWS event source (e.g., aws.ec2, aws.s3, aws.config)'
  EventDetailType:
    Type: String
    Description: 'Event detail type (e.g., EC2 Instance State-change Notification)'

Resources:
  Connection:
    Type: AWS::Events::Connection
    Properties:
      Name: autobotAI-eventbridge-listener-connection
      AuthorizationType: API_KEY
      AuthParameters:
        ApiKeyAuthParameters:
          ApiKeyName: !Ref APIKeyName
          ApiKeyValue: !Ref APIKeyValue

  ApiDestination:
    Type: AWS::Events::ApiDestination
    Properties:
      Name: autobotAI-eventbridge-listener-webhook
      ConnectionArn: !GetAtt Connection.Arn
      InvocationEndpoint: !Ref APIEndPoint
      HttpMethod: POST
      InvocationRateLimitPerSecond: 300

  InvokeApiRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: autobotAI_EventBridge_Invoke_Api_Destination
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: events.amazonaws.com
            Action: sts:AssumeRole

  InvokeApiPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      ManagedPolicyName: autobotAI_EventBridge_Invoke_Api_Destination_Policy
      Roles:
        - !Ref InvokeApiRole
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action: events:InvokeApiDestination
            Resource: !GetAtt ApiDestination.Arn

  EventRule:
    Type: AWS::Events::Rule
    Properties:
      Name: autobotAI-EventBridge-Rule
      State: ENABLED
      EventPattern:
        source:
          - !Ref EventSource
        detail-type:
          - !Ref EventDetailType
        account:
          - !Ref AWS::AccountId
      Targets:
        - Id: autobotAI-target
          Arn: !GetAtt ApiDestination.Arn
          RoleArn: !GetAtt InvokeApiRole.Arn

Deploy the template:

1. Save the template as autobotAI-EventBridge.yml
2. Open the AWS CloudFormation console → Create stack → Upload a template file
3. Fill in the parameters:
   • APIEndPoint: Your autobotAI listener URL
   • APIKeyValue: Your autobotAI secret key
   • EventSource: The AWS event source (e.g., aws.ec2)
   • EventDetailType: The event detail type (e.g., EC2 Instance State-change Notification)
4. Acknowledge IAM capabilities and create the stack

Step 3: Verify Integration

1. Check EventBridge Rule

   • Go to AWS EventBridge console
   • Find your rule and verify it's enabled and targeting your API destination

2. Trigger a Test Event

   • Perform an action in AWS that matches your event pattern
   • For example, if listening to EC2 state changes, start or stop an EC2 instance
   • Wait a few moments for the event to be delivered

3. Verify in autobotAI

   • Go to your listener in autobotAI
   • Click "Test" to view recent events
   • You should see the AWS event data being received

4. Check Metrics (optional)

   • In the EventBridge console, check the rule's Monitoring tab
   • Verify the Invocations and FailedInvocations metrics
   • A successful delivery shows invocations with zero failures

Designing Event Patterns

Choosing the right event pattern is the most important part of this integration. A well-designed pattern ensures you receive only the events you need, reducing noise and cost.

Event Pattern Basics

Every EventBridge event has the following top-level fields you can match on:

Pattern Matching Operators

EventBridge supports several matching operators within the detail field:

json
{
  "detail": {
    "state": ["running", "stopped"],
    "instance-id": [{ "prefix": "i-0" }],
    "severity": [{ "numeric": [">=", 7] }],
    "errorCode": [{ "exists": true }],
    "bucketName": [{ "anything-but": "my-internal-bucket" }]
  }
}

Finding the Right Event Pattern

1. Browse in the console: Go to EventBridge → Rules → Create rule. The event pattern builder shows all available AWS services and their event types.
2. AWS documentation: Each AWS service documents its EventBridge events. Search for "[service name] EventBridge events" in the AWS docs.
3. EventBridge sandbox: Use the EventBridge Sandbox feature to test patterns against sample events before deploying a rule.
4. CloudTrail events: Almost any AWS API call can be captured via CloudTrail events on EventBridge using source aws.{service} and detail type AWS API Call via CloudTrail.

Event Pattern Examples

Below are ready-to-use event patterns for common scenarios.

Security Events

Console login without MFA:

json
{
  "source": ["aws.signin"],
  "detail-type": ["AWS Console Sign In via CloudTrail"],
  "detail": {
    "additionalEventData": {
      "MFAUsed": ["No"]
    }
  }
}

Root account usage:

json
{
  "source": ["aws.signin"],
  "detail-type": ["AWS Console Sign In via CloudTrail"],
  "detail": {
    "userIdentity": {
      "type": ["Root"]
    }
  }
}

Infrastructure Events

Auto Scaling lifecycle action:

json
{
  "source": ["aws.autoscaling"],
  "detail-type": ["EC2 Instance Launch Successful", "EC2 Instance Terminate Successful"]
}

RDS instance event:

json
{
  "source": ["aws.rds"],
  "detail-type": ["RDS DB Instance Event"]
}

Lambda function invocation failure:

json
{
  "source": ["aws.lambda"],
  "detail-type": ["AWS API Call via CloudTrail"],
  "detail": {
    "eventSource": ["lambda.amazonaws.com"],
    "eventName": ["Invoke"],
    "errorCode": [{ "exists": true }]
  }
}

Operational Events

AWS Health events (service disruptions):

json
{
  "source": ["aws.health"],
  "detail-type": ["AWS Health Event"]
}

Systems Manager parameter change:

json
{
  "source": ["aws.ssm"],
  "detail-type": ["Parameter Store Change"]
}

Secrets Manager rotation events:

json
{
  "source": ["aws.secretsmanager"],
  "detail-type": ["AWS API Call via CloudTrail"],
  "detail": {
    "eventSource": ["secretsmanager.amazonaws.com"],
    "eventName": ["RotateSecret"]
  }
}

Security Considerations

Authentication

• API Key Authentication: Uses header-based authentication via x-secret-key
• Secret Key Protection: Treat your secret key as sensitive data; store it in AWS Secrets Manager if possible
• HTTPS Only: All communication uses HTTPS for encryption in transit

Data Privacy

• Events remain in your AWS account until forwarded
• No data is stored on autobotAI servers beyond processing
• You maintain full control over which events are forwarded

Least Privilege

• The EventBridge execution role only has permission to invoke the specific API destination
• Review and audit IAM roles created by the CloudFormation template or console
• Use resource-based policies to restrict which accounts or services can put events on your bus

Event Filtering

• Define precise event patterns to forward only the events you need
• Avoid overly broad patterns (e.g., matching all events from a service) unless intentional
• Broad patterns increase event volume, cost, and noise

Troubleshooting

Rule Not Matching Events

Problem: Your EventBridge rule is not capturing the expected events

Solutions:

1. Verify Event Pattern Syntax

   • Go to EventBridge → Rules → Select your rule → View event pattern
   • Use the EventBridge Sandbox to test your pattern against sample events
   • Ensure JSON syntax is valid (no trailing commas, correct quoting)

2. Check Event Source and Detail Type

   • Event sources and detail types are case-sensitive
   • Use the EventBridge console's event pattern builder to confirm exact values
   • For CloudTrail-based events, ensure CloudTrail is enabled and logging the relevant API calls

3. Verify Event Bus

   • Ensure the rule is on the correct event bus (default vs. custom)
   • AWS service events go to the default bus unless explicitly routed elsewhere

4. Check Region

   • EventBridge rules only match events in the region where the rule is deployed
   • Deploy rules in every region where the target events are generated

API Destination Failures

Problem: Events are matched but not delivered to autobotAI

Troubleshooting Steps:

1. Check API Destination Health

   • Go to EventBridge → API destinations
   • Verify the destination status is healthy
   • Check the invocation endpoint URL is correct

2. Verify Connection

   • Go to EventBridge → Connections
   • Ensure the connection status is AUTHORIZED
   • Verify the API key name and value are correct

3. Review Dead-Letter Queue (if configured)

   • If you configured a DLQ on the rule target, check for failed events
   • Failed events in the DLQ include error details

4. Check CloudWatch Metrics

   • Review the rule's FailedInvocations metric
   • Check InvocationsSentToDlq if a DLQ is configured
   • Look at API destination InvocationCount and 4xxErrors / 5xxErrors

5. Test Listener Endpoint

   • Test the listener URL manually using curl:

     bash
     curl -X POST YOUR_LISTENER_URL \
       -H "Content-Type: application/json" \
       -H "x-secret-key: YOUR_SECRET_KEY" \
       -d '{"test": true}'

   • Verify the response is 200 OK

Rate Limiting

Problem: Events are being throttled or dropped

Solutions:

1. Increase Rate Limit

   • Edit the API destination and increase the invocation rate limit
   • Default is 300 per second; adjust based on your event volume

2. Configure Retry Policy

   • EventBridge retries failed deliveries for up to 24 hours by default
   • Configure a custom retry policy on the rule target if needed

3. Add Dead-Letter Queue

   • Configure an SQS dead-letter queue on the rule target to capture events that fail after all retries

Best Practices

Event Pattern Design

1. Be Specific

   • Use the most specific event pattern possible to reduce noise
   • Filter on detail fields (e.g., specific API calls, resource types, states) rather than matching all events from a service

2. Test Before Deploying

   • Use the EventBridge Sandbox to validate patterns against sample events
   • Start with a narrow pattern and broaden it as needed

3. Document Your Patterns

   • Maintain a record of which event patterns are deployed and why
   • Use descriptive rule names and descriptions

Listener Organization

1. Dedicated Listeners per Use Case

   • Create separate listeners for different event categories (security, infrastructure, operations)
   • This makes it easier to build targeted bots and workflows in autobotAI

2. Naming Convention

   • Use consistent naming: e.g., AWS EventBridge - <Service> - <Event Type>
   • Match rule names in AWS to listener names in autobotAI for traceability

Reliability

1. Configure Dead-Letter Queues

   • Always configure a DLQ on production EventBridge rule targets
   • Monitor the DLQ for failed events and set up alarms

2. Monitor Invocation Metrics

   • Set up CloudWatch alarms on FailedInvocations and ThrottledRules
   • Review metrics regularly to catch delivery issues early

3. Use Multiple Regions When Needed

   • Deploy rules in every region where events are generated
   • Consider cross-region event routing for centralized processing

Cost Management

1. EventBridge Pricing

   • EventBridge charges per event published to the bus (AWS service events are free) and per API destination invocation
   • Use precise event patterns to minimize unnecessary invocations

2. autobotAI Usage

   • Monitor listener event volume
   • Review workflow execution frequency and optimize as needed

Support and Resources

AWS Documentation

• Amazon EventBridge Documentation
• EventBridge Event Patterns
• EventBridge API Destinations
• AWS Service Events Reference
• CloudFormation EventBridge Resources

autobotAI Resources

• Listener Documentation
• Bot Building Guide
• AWS Security Hub (OCSF) Integration
• AWS Inspector Integration
• AWS GuardDuty Integration

Additional Help

• Contact autobotAI support for integration issues
• Use the EventBridge Sandbox to test and debug event patterns
• Check AWS service quotas for EventBridge rules and API destinations

Need Help? If you encounter any issues during setup, contact autobotAI support with:

• Your EventBridge rule configuration and event pattern
• API destination status and connection details
• CloudWatch metrics for the rule (invocations, failures)
• Sample event payload from the AWS service you are capturing