EventBridge Rule Example

A minimal EventBridge rule, expressed as CloudFormation, routing EC2 instance state changes to an SNS topic:

AWSTemplateFormatVersion: '2010-09-09'
Description: 'AWS EventBridge Rule Template'

Resources:
  MyEventRule:
    Type: 'AWS::Events::Rule'
    Properties:
      Name: 'my-event-rule'
      Description: 'A sample EventBridge rule'
      State: 'ENABLED'
      # The event pattern - this example looks for EC2 instance state changes
      EventPattern:
        source:
          - 'aws.ec2'
        detail-type:
          - 'EC2 Instance State-change Notification'
        detail:
          state:
            - 'running'
            - 'stopped'

      # The target(s) - this example sends to an SNS topic
      Targets:
        - Id: 'MySNSTarget'
          Arn: !Ref MySNSTopic
          InputTransformer:
            InputPathsMap:
              instance: "$.detail.instance-id"
              state: "$.detail.state"
            InputTemplate: |
              "EC2 instance <instance> has changed state to <state>"

  # The topic that will receive the events
  MySNSTopic:
    Type: 'AWS::SNS::Topic'
    Properties:
      TopicName: 'my-event-notifications'

  # Without this policy the rule matches and the message is silently dropped
  EventTopicPolicy:
    Type: 'AWS::SNS::TopicPolicy'
    Properties:
      PolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service: events.amazonaws.com
            Action: 'sns:Publish'
            Resource: !Ref MySNSTopic
      Topics:
        - !Ref MySNSTopic

The template:

1. Creates a rule that matches EC2 instance state changes to running or stopped.
2. Sends the matched events to an SNS topic.
3. Rewrites each event into a readable sentence with an InputTransformer, so the subscriber receives "EC2 instance i-0abc… has changed state to running" rather than the raw event JSON.
4. Grants events.amazonaws.com permission to publish to the topic. For SNS and Lambda targets, EventBridge relies on a resource-based policy on the target rather than an IAM role — without it the stack still deploys and the rule still matches, but every delivery fails silently. Other target types, including Step Functions state machines, Kinesis streams and API Gateway APIs, use an IAM role given in the target’s RoleArn instead.

A rule must contain at least an EventPattern or a ScheduleExpression; a rule with neither is rejected by CloudFormation.