DOP-C02 EventBridge Bus, Rule, Target — the schedule that is not a crontab

The bus still fires. The instance can be off.

<!-- hal:authoritative:yaml -->

The bus still fires. The instance can be off.

§I — Frame

08-05 opened DOP-C02 at Domain 1, 22 percent: CodePipeline, buildspec, CodeDeploy blue/green. 08-17 opened Domain 2, 17 percent: custom resources, change sets, the signal that must still fire. Domain 5 is Incident and Event Response, 14 percent. Domain 4 sits next to it: Monitoring and Logging, 15 percent, where the longer note files CloudWatch Events. Weights around them, verified 08-05: D3 15, D6 17. Sixty-five scored. Seven-fifty to pass.

The center of gravity is a clock that is not a host file. CloudWatch Events defines actions on things that happened, or schedules cron-based events (devops-engineer-professional.md, CloudWatch Events). EventBridge is that service with extra buses and third-party sources (same note, EventBridge; eventbridge.md). Gift's clause, adjacent, is the exam trap in plain English: "Scheduling tasks in a cron-like manner based on CloudWatch Events triggering Lambda functions" (Python for DevOps, Ch.13, p.513). Cron-like. Coin it with today's Ops and Dev: the schedule that is not a crontab.

Around that clock: the default bus versus extra buses; a rule that matches JSON versus a rule that carries ScheduleExpression; one rule, many targets, in parallel; CloudTrail API events with ReadOnly calls excluded; cross-account delivery in the same region; GuardDuty and Auto Scaling as producers that already speak this bus. The 08-05 pipeline is a target, not the topic. The 08-17 custom resource is a wait, not a schedule. The 08-26 failover record is a name, not a bus.

§II — Domain foundations: four facts the stem will name

Fact one. Bus, rule, target. Three objects. One JSON body.

eventbridge.md is the short spine. Both CloudWatch Events and EventBridge operate using an event bus. Both have a default event bus. CloudWatch Events has only that default bus, not exposed in the UI. EventBridge can have additional event buses. Rules match incoming events, or they are scheduled. Events are JSON objects: which EC2 instance changed state, into what state, at what time.

MonitoringLogging.md names the same trio with exam verbs. An event indicates a change in your AWS environment. A target processes events and receives them in JSON. A rule matches incoming events and routes them to targets. A single rule can route to multiple targets, all processed in parallel. Rules are not processed in a particular order. A rule can customize the JSON sent to the target, passing only certain parts or overwriting it with a constant.

The cheatsheet row compresses it: "Event bus, rule-based routing" (aws-core-services.md). If the stem says "crontab on the instance," the candidate has imported a host file into a bus question. Send them back to the trio. The schedule is not a crontab.

Fact two. The target list is the listener list. Learn it once.

The longer DOP note lists who can hear a rule: Lambda, EC2 instances, Kinesis Data Streams, Kinesis Data Firehose, CloudWatch Logs, ECS tasks, Systems Manager Run Command, Systems Manager Automation, Batch jobs, Step Functions state machines, CodePipeline pipelines, CodeBuild projects, Inspector assessment templates, SNS topics, SQS queues, built-in EC2 CreateSnapshot / RebootInstances / StopInstances / TerminateInstances, and the default event bus of another AWS account (devops-engineer-professional.md, Targets). SAP notes add the same compute / orchestration / integration / maintenance grouping when CloudWatch alarms are forwarded to EventBridge (solutions-architect-professional.md, 11.1).

CodePipeline as a target is how a commit is not the only start. The 08-05 lesson remains the stage contract. Today the pipeline is one ARN on list_targets_by_rule. A stem that asks "how does a GuardDuty finding start a pipeline" wants a rule, not a new stage. GuardDuty itself uses CloudWatch Events (Incident.md, GuardDuty). Auto Scaling can notify via EventBridge or CloudWatch Events and trigger Lambdas by filtering those events (devops-engineer-professional-02.md, ASG).

Fact three. Scheduled rules are cron-like. They still live on the bus.

The DOP notes say it: or schedule cron-based events. eventbridge.md says it: scheduled based rules. Gift says it: cron-like manner. The expression uses cron() or rate(). The function that is the target does not need to be running. The instance that used to hold the crontab can be stopped. If the stem says "the Lambda timed out because the EC2 host was rebooted," the candidate has put the schedule back on the host. The rule is still ENABLED. The target still receives JSON at the next tick.

A scheduled rule with zero targets is a legal object and a failed design. The exam may not use the word "finding." The ops lesson prints schedule-without-listener. The cert answer is: the rule exists, nothing is invoked.

Fact four. Cross-account stays in-region. CloudTrail skips ReadOnly.

The DOP notes: can deliver cross-account; must be in the same region. A target that is the default bus of another account is on the list. A target in another region is not how this service hops. Use a rule in that region, or a bus you own there.

CloudTrail integration allows rules to fire on API calls. ReadOnly calls (List*, Get*, Describe*) are not supported (devops-engineer-professional.md). A stem that triggers a Lambda on every DescribeInstances is selling a rule that will not fire. Write the pattern for RunInstances or TerminateInstances. Leave List/Get/Describe out.

S3 notifications are the cousin. Object-level only, not bucket-level. SNS, SQS, or Lambda. CloudTrail on that bucket if you need more (same note, S3 Events). Do not pick EventBridge as the answer to a bucket-notification stem unless the stem names the bus.

§III — DOP flavor: the event that starts work

Domain 5 is incident and event response. The bus is how a finding becomes an action without a human crontab.

GuardDuty analyzes continuously, then can trigger Lambda (Incident.md). The path is CloudWatch Events. Inspector assessment templates are already on the target list. A failed instance launch can be an Auto Scaling event on the same bus (devops-engineer-professional-02.md). The candidate who answers "install cron on the AMI" has not read Domain 5.

CodePipeline and CodeBuild as targets are how Domain 1 work starts from an event rather than from a poll. 08-05 stays closed. Today you name the rule that starts the pipeline. You do not redraw the stages.

Built-in EC2 actions are the maintenance targets: snapshot, reboot, stop, terminate. A scheduled rule that stops dev instances at 20:00 is a bus schedule. A user-data script that sleeps until 20:00 is a crontab with extra steps. The exam prefers the bus.

§IV — Adjacent SAP flavor: extra buses, same trio

eventbridge.md is the SAP clone. The extra fact it adds for the architect seat is the additional event bus. DOP will still ask it, because a custom application or a partner source lands on a bus you created, not on default. A rule created without EventBusName sits on default. Events put on app-bus will not match it. The ops census lists every bus for that reason.

JSON is the payload in both seats. The clone: events themselves are JSON objects. MonitoringLogging.md: a target receives events in JSON format; a rule can rewrite that JSON. Input transformers are how you keep a Lambda handler small. The exam will offer "the target receives the whole event" versus "the target receives a constant." Both are legal. The rule decides.

Third-party sources are the EventBridge increment over CloudWatch Events (both notes). If the stem names a SaaS partner, the bus is EventBridge, not the old console-hidden default-only service.

§V — Worked example: the rule the crontab replaced

A team used to run backups from 0 2 * * * on a bastion. The bastion sleeps. The backup does not run. The DOP answer is a scheduled rule on the default bus, target a Lambda (or an ECS task, or an SSM Automation), expression cron(0 2 * * ? *). Gift's console walk is that timer (Ch.15, p.640). The bastion can stay stopped.

A second rule matches EC2 Instance State-change Notification where state is terminated, targets an SNS topic and a CodeBuild project in parallel. MonitoringLogging.md is the authority for the fan-out. The crontab that grepped logs for "terminated" is retired.

A third rule matches CloudTrail CreateUser and targets a Lambda that opens a ticket. ListUsers is not a pattern that will fire. The notes already said ReadOnly is excluded.

None of these rules put from the ops census. The cert stem asks which object you create. The answer is the rule on the bus, not a line on the instance.

§V.B — Four stems that recycle older visits

The exam will try to spend 08-05, 08-17, and 08-26 under today's title. Send those stems back.

A stem that names CodeDeploy blue/green, a target group pair, and a hook is 08-05. EventBridge may start the pipeline that contains that deploy. It does not replace the deploy. If the question is "how does the traffic shift," the answer is still CodeDeploy. If the question is "how does a GuardDuty finding start that pipeline," the answer is a rule whose target is the pipeline ARN.

A stem that names ServiceToken, ResponseURL, and a stack stuck in CREATE_IN_PROGRESS is 08-17. A scheduled rule that invokes the same Lambda every ten minutes is a different wait. The custom resource waits on one POST. The rule waits on the bus clock. Do not put a WaitCondition on a scheduled rule. Do not put a cron expression on a custom resource.

A stem that names PRIMARY, SECONDARY, and a health check is 08-26. Route 53 failover changes the answer. EventBridge does not resolve names. A rule can target a Lambda that calls change_resource_record_sets. That write is a different tool. Today's census refused it on Wednesday and still refuses it today.

A stem that names a crontab, a bastion, and "high availability for the job" wants the bus. Two bastions with two crontabs is not HA for a schedule. It is two hosts that can both fire or both sleep. The managed rule fires once per expression, in the region, whether any bastion exists. That is the answer the 14 percent domain is buying.

Input transformers deserve one more line because MonitoringLogging.md already gave you the hook. A rule can send only $.detail.instance-id to a Lambda, or send a constant {"action":"drain"}. The target code stays small. A crontab that called backup.sh --full hard-coded the constant in the host file. The rule stores the constant next to the expression. When you list targets you see Input or InputPath. When you list a crontab you see a line. Same data. Different owner.

One more inventory check before you sit. Domain 5 is 14 percent. Domain 4 is 15 percent. Together they are larger than Domain 2. You already spent Domain 2 on 08-17. You have not spent the bus. If a practice set still feels like pipelines and stacks, you are restudying 08-05 and 08-17. Switch the set to events, buses, and scheduled rules until a stem that says "cron" makes you name the rule first.

§VI — Connection to today's Ops and Dev lessons

Ops lists buses, rules, and targets, and refuses put_rule. Dev names asyncio.sleep as the wait the loop still owns, and time.sleep as the wait that owns the thread (Ramalho Ch.19, pp.709-710). The cert object is the bus-owned schedule. The language object is the loop-owned sleep. The host object is the crontab / time.sleep. One coin.

§VII — Practice questions

§VIII — Closing

Bus, rule, target. Schedule or match. Many targets, parallel, same region. ReadOnly API calls do not fire. Extra buses are EventBridge. A crontab on a bastion is the wrong owner.

The Bootcamp pages are the CloudWatch Events section of devops-engineer-professional.md, MonitoringLogging.md, and eventbridge.md. 08-05 still holds the pipeline. 08-17 still holds the custom-resource wait. 08-26 still holds the DNS name. Do not restudy them under today's title.

Examine the next practice stem that says "cron." If the sentence only makes sense when a host is awake, the coin is already spent. Change the product, or change the owner.

Related

• Prior arc: AWS DOP — custom resources / change sets (2026-08-17)
• Domain hub: Cross-References/domains/Cert-Prep
• Grounding: DOP notes — CloudWatch Events / EventBridge · EventBridge (Sovereign-Bootcamp SAP clone)