EventBridge errors and troubleshooting
Look up an EventBridge API exception (InvalidEventPatternException, LimitExceededException, ManagedRuleException, PolicyLengthExceededException, PutEvents entry errors) and diagnose rules that don't fire or targets that never receive events — missing Lambda permission (and the SourceAccount trap), SNS/SQS policies and KMS keys, wrong Region for global services, UTC schedules, retries exhausted, DLQ error codes, duplicates and loops with the metric that proves each.
markdownreferencev4FQG4-ZMMTstage: operatetrust: officialservice: eventbridgeinterface: anyInvalidEventPatternExceptionLimitExceededException EventBridgeManagedRuleExceptionPolicyLengthExceededExceptionResourceNotFoundException EventBridgeResourceAlreadyExistsExceptionConcurrentModificationExceptionThrottlingException EventBridgeOperationDisabledExceptionPutEvents FailedEntryCount ErrorCodeEventBridge rule not triggeringLambda not invoked by EventBridgeSourceAccount prevents invocationEventBridge SNS no messagesEventBridge encrypted SQSFailedInvocationsTriggeredRulesNO_PERMISSIONSTHROTTLINGTIMEOUTEXHAUSTED_RETRY_CONDITIONscheduled rule wrong time UTCEventBridge duplicate eventsEventBridge infinite loop
Split the problem with two metrics. If TriggeredRules doesn't move, the pattern or Region is wrong. If it moves but FailedInvocations rises, or Invocations doesn't, the target or its permission is wrong.
Rule didn't fire, or target got nothing
| Symptom | Cause → fix | Check |
|---|---|---|
| Rule ran, Lambda never invoked | The function has no resource policy for events.amazonaws.com. aws lambda get-policy --function-name <fn> returns "A client error (ResourceNotFoundException) occurred when calling the GetPolicy operation: The resource you requested does not exist." or lacks the statement. Add it with --source-arn <rule-arn>, and remove any SourceAccount condition, which prevents invocation. Use --qualifier for aliases | aws lambda get-policy --function-name <fn> (quoted in the cell) |
| Rule ran, no messages in SNS | The topic policy lacks sns:Publish for events.amazonaws.com, or the topic's KMS key policy lacks EventBridge (kms:Decrypt, kms:GenerateDataKey) | aws sns get-topic-attributes --topic-arn <t> → Policy, KmsMasterKeyId |
| Nothing in an encrypted SQS queue | The customer managed key policy lacks events.amazonaws.com. aws/sqs can't be used. Also check the queue policy (reference/sqs/queue-settings-and-encryption.md) | aws sqs get-queue-attributes --attribute-names Policy KmsMasterKeyId, then the key policy |
| Role-based target ignored | The role's trust must allow events.amazonaws.com and its policy the target action. The Region's STS endpoint must be enabled | aws events list-targets-by-rule --rule <r> → RoleArn; aws iam get-role → trust policy |
| IAM / Route 53 API-call rule never fires | Global services emit events only in us-east-1. Create the rule there | The rule's Region (aws events describe-rule --name <r> --region us-east-1) |
| Pattern "should" match | Exact, case-sensitive matching; CloudTrail API events have no resources; numbers vs strings (reference/eventbridge/event-patterns.md). Test with TestEventPattern or the console sandbox | aws events test-event-pattern --event-pattern file://p.json --event file://e.json |
| Just changed the rule | Changes take a short time to propagate | TriggeredRules for the rule over the next minutes |
| Scheduled rule at the wrong time | Schedules are UTC. They run within one minute of the time, at minute (not second) resolution | describe-rule → ScheduleExpression, read as UTC |
| Events arrive hours late | The target was failing and EventBridge kept retrying, for up to 24 hours | The target's FailedInvocations and the target's own errors in that window |
| Events lost | Retries exhausted (24 h / 185 attempts by default, or your RetryPolicy), or the error wasn't retriable. Dropped unless a DLQ is set | list-targets-by-rule → RetryPolicy, DeadLetterConfig; InvocationsSentToDLQ |
PutEvents returned 200 but events are missing | FailedEntryCount > 0. Read each Entries[i].ErrorCode / ErrorMessage and resend only those (guides/eventbridge/route-events.md) | Log FailedEntryCount and every Entries[i].ErrorCode |
| A target ran twice for one event | Rare duplicates are documented. Make targets idempotent | Log the event id: duplicates share it |
| Runaway invocations | An infinite loop: the target changes what the rule watches. Match only the bad state; consider a budget alert | Invocations and TriggeredRules climbing together; CloudTrail shows the target changing the watched resource |
| SNS topic still grants EventBridge after the rule was deleted | Deleting a rule right after creating it can leave the permission. Remove it with set-topic-attributes | get-topic-attributes → Policy for leftover events.amazonaws.com statements |
DLQ message attributes
| Attribute | Meaning |
|---|---|
ERROR_CODE | For example NO_PERMISSIONS, THROTTLING, TIMEOUT |
ERROR_MESSAGE | Details |
EXHAUSTED_RETRY_CONDITION | MaximumRetryAttempts or MaximumEventAgeInSeconds |
RETRY_ATTEMPTS | How many were made |
RULE_ARN, TARGET_ARN | Where it failed |
Not retried at all (straight to the DLQ): missing permissions, a deleted target, an invalid address or failed DNS lookup. The DLQ must be a standard queue in the same Region. If InvocationsFailedToBeSentToDLQ rises, the DLQ's own queue policy or key is wrong.
API exceptions
| Exception | Meaning → fix | Check |
|---|---|---|
InvalidEventPatternException | Invalid pattern: bad JSON, consecutive wildcards, an out-of-range number, more than 1,000 $or combinations, or an overly complex wildcard | Validate with aws events test-event-pattern; count $or combinations |
LimitExceededException | Would create a resource beyond a quota (which quotas apply isn't on the fetched pages). Request an increase or consolidate | Service Quotas for EventBridge; aws events list-rules count |
ManagedRuleException | The rule was created by an AWS service for your account and is managed by it. Change it through that service, not DeleteRule or PutTargets | describe-rule → ManagedBy names the service |
PolicyLengthExceededException | The event bus resource policy is too long. Consolidate statements, for example with an organization condition | aws events describe-event-bus --name <bus> → Policy length |
ResourceNotFoundException | The rule, bus or target doesn't exist. Check the name and Region, and pass EventBusName for rules on a custom bus (the hub's reading) | aws events list-rules --event-bus-name <bus> --region <r> |
ResourceAlreadyExistsException | Already exists. Treat as success in idempotent setup | describe-rule / describe-event-bus for the name |
ConcurrentModificationException | A concurrent change to the same rule, target, archive or replay. Retry | Another deploy or process touching the same rule (CloudTrail) |
ThrottlingException | Request rate too high. Back off; batch PutEvents (10 entries) | Call rate in your code; CloudTrail errorCode |
OperationDisabledException | The operation isn't available in this Region | Try the same call in another Region |
AccessDeniedException | IAM denial (guides/iam/fix-access-denied.md) | aws sts get-caller-identity, then guides/iam/fix-access-denied.md |
InternalException (500) | Unexpected. Retry with backoff | Retry; keep the request ID |
Alarm to catch broken rules
AWS suggests an alarm on FailedInvocations, Sum, threshold ≥ 1, over 10 periods, notifying SNS (guides/cloudwatch/create-alarms.md). Add InvocationsFailedToBeSentToDLQ for rules with a DLQ.
When none of these fits
Put a CloudWatch Logs log group as a second target on the same rule. If events arrive there but not at your target, the problem is the target's permission or the target itself. If nothing arrives, the problem is the pattern or Region. Add a DLQ to the target and read the ERROR_CODE and ERROR_MESSAGE attributes. For PutEvents failures, log every entry's ErrorCode (UNVERIFIED that a log-group target needs no extra setup).