--- cuppy_hub: aws cuppy_path: reference/eventbridge/errors.md cuppy_section: docs cuppy_doc: FQG4-ZMMT cuppy_doc_uuid: 97dfe12a-7193-4570-a9ea-a869d12bba47 cuppy_permalink: https://cuppy.io/aws/d/FQG4-ZMMT cuppy_version: 4 cuppy_updated: 2026-10-23T16:16:52.575Z cuppy_canonical: https://cuppy.io/aws/docs/reference/eventbridge/errors cuppy_mcp: https://cuppy.io/mcp cuppy_body_sha256: 0eed032d65ddfbfceeeec586956031d34757f37c52887de3969e71a564767fff # cuppy_body_sha256 is over the document body ALONE, excluding both generated blocks. --- # EventBridge errors and troubleshooting **Split the problem with two metrics.** If `TriggeredRules` doesn't move, the **pattern or Region** is wrong. If it moves but `FailedInvocations` rises, or `Invocations` doesn't, the **target or its permission** is wrong. ## Rule didn't fire, or target got nothing | Symptom | Cause → fix | Check | |---|---|---| | Rule ran, Lambda never invoked | The function has no resource policy for `events.amazonaws.com`. `aws lambda get-policy --function-name ` returns "A client error (ResourceNotFoundException) occurred when calling the GetPolicy operation: The resource you requested does not exist." or lacks the statement. Add it with `--source-arn `, and **remove any `SourceAccount`** condition, which prevents invocation. Use `--qualifier` for aliases | `aws lambda get-policy --function-name ` (quoted in the cell) | | Rule ran, no messages in SNS | The topic policy lacks `sns:Publish` for `events.amazonaws.com`, or the topic's KMS key policy lacks EventBridge (`kms:Decrypt`, `kms:GenerateDataKey`) | `aws sns get-topic-attributes --topic-arn ` → `Policy`, `KmsMasterKeyId` | | Nothing in an encrypted SQS queue | The customer managed key policy lacks `events.amazonaws.com`. `aws/sqs` can't be used. Also check the queue policy (`reference/sqs/queue-settings-and-encryption.md`) | `aws sqs get-queue-attributes --attribute-names Policy KmsMasterKeyId`, then the key policy | | Role-based target ignored | The role's trust must allow `events.amazonaws.com` and its policy the target action. The Region's STS endpoint must be enabled | `aws events list-targets-by-rule --rule ` → `RoleArn`; `aws iam get-role` → trust policy | | IAM / Route 53 API-call rule never fires | Global services emit events **only in `us-east-1`**. Create the rule there | The rule's Region (`aws events describe-rule --name --region us-east-1`) | | Pattern "should" match | Exact, case-sensitive matching; CloudTrail API events have no `resources`; numbers vs strings (`reference/eventbridge/event-patterns.md`). Test with `TestEventPattern` or the console sandbox | `aws events test-event-pattern --event-pattern file://p.json --event file://e.json` | | Just changed the rule | Changes take a short time to propagate | `TriggeredRules` for the rule over the next minutes | | Scheduled rule at the wrong time | Schedules are **UTC**. They run within one minute of the time, at minute (not second) resolution | `describe-rule` → `ScheduleExpression`, read as UTC | | Events arrive hours late | The target was failing and EventBridge kept retrying, for up to 24 hours | The target's `FailedInvocations` and the target's own errors in that window | | Events lost | Retries exhausted (24 h / 185 attempts by default, or your `RetryPolicy`), or the error wasn't retriable. Dropped unless a DLQ is set | `list-targets-by-rule` → `RetryPolicy`, `DeadLetterConfig`; `InvocationsSentToDLQ` | | `PutEvents` returned 200 but events are missing | `FailedEntryCount` > 0. Read each `Entries[i].ErrorCode` / `ErrorMessage` and resend only those (`guides/eventbridge/route-events.md`) | Log `FailedEntryCount` and every `Entries[i].ErrorCode` | | A target ran twice for one event | Rare duplicates are documented. Make targets idempotent | Log the event `id`: duplicates share it | | Runaway invocations | An infinite loop: the target changes what the rule watches. Match only the bad state; consider a budget alert | `Invocations` and `TriggeredRules` climbing together; CloudTrail shows the target changing the watched resource | | SNS topic still grants EventBridge after the rule was deleted | Deleting a rule right after creating it can leave the permission. Remove it with `set-topic-attributes` | `get-topic-attributes` → `Policy` for leftover `events.amazonaws.com` statements | ## DLQ message attributes | Attribute | Meaning | |---|---| | `ERROR_CODE` | For example `NO_PERMISSIONS`, `THROTTLING`, `TIMEOUT` | | `ERROR_MESSAGE` | Details | | `EXHAUSTED_RETRY_CONDITION` | `MaximumRetryAttempts` or `MaximumEventAgeInSeconds` | | `RETRY_ATTEMPTS` | How many were made | | `RULE_ARN`, `TARGET_ARN` | Where it failed | Not retried at all (straight to the DLQ): missing permissions, a deleted target, an invalid address or failed DNS lookup. The DLQ must be a standard queue in the same Region. If `InvocationsFailedToBeSentToDLQ` rises, the **DLQ's own** queue policy or key is wrong. ## API exceptions | Exception | Meaning → fix | Check | |---|---|---| | `InvalidEventPatternException` | Invalid pattern: bad JSON, consecutive wildcards, an out-of-range number, more than 1,000 `$or` combinations, or an overly complex wildcard | Validate with `aws events test-event-pattern`; count `$or` combinations | | `LimitExceededException` | Would create a resource beyond a quota (which quotas apply isn't on the fetched pages). Request an increase or consolidate | Service Quotas for EventBridge; `aws events list-rules` count | | `ManagedRuleException` | The rule was created by an AWS service for your account and is managed by it. Change it through that service, not `DeleteRule` or `PutTargets` | `describe-rule` → `ManagedBy` names the service | | `PolicyLengthExceededException` | The event bus resource policy is too long. Consolidate statements, for example with an organization condition | `aws events describe-event-bus --name ` → `Policy` length | | `ResourceNotFoundException` | The rule, bus or target doesn't exist. Check the name and Region, and pass `EventBusName` for rules on a custom bus (the hub's reading) | `aws events list-rules --event-bus-name --region ` | | `ResourceAlreadyExistsException` | Already exists. Treat as success in idempotent setup | `describe-rule` / `describe-event-bus` for the name | | `ConcurrentModificationException` | A concurrent change to the same rule, target, archive or replay. Retry | Another deploy or process touching the same rule (CloudTrail) | | `ThrottlingException` | Request rate too high. Back off; batch `PutEvents` (10 entries) | Call rate in your code; CloudTrail `errorCode` | | `OperationDisabledException` | The operation isn't available in this Region | Try the same call in another Region | | `AccessDeniedException` | IAM denial (`guides/iam/fix-access-denied.md`) | `aws sts get-caller-identity`, then `guides/iam/fix-access-denied.md` | | `InternalException` (500) | Unexpected. Retry with backoff | Retry; keep the request ID | ## Alarm to catch broken rules AWS suggests an alarm on `FailedInvocations`, Sum, threshold ≥ 1, over 10 periods, notifying SNS (`guides/cloudwatch/create-alarms.md`). Add `InvocationsFailedToBeSentToDLQ` for rules with a DLQ. ## When none of these fits Put a CloudWatch Logs log group as a second target on the same rule. If events arrive there but not at your target, the problem is the target's permission or the target itself. If nothing arrives, the problem is the pattern or Region. Add a DLQ to the target and read the `ERROR_CODE` and `ERROR_MESSAGE` attributes. For `PutEvents` failures, log every entry's `ErrorCode` (UNVERIFIED that a log-group target needs no extra setup). --- You are reading one file. The same content is free over MCP at https://cuppy.io/mcp with no signup: ranked search across all 131 documents in this hub, the merged view when you work in a layer, known workarounds matched to the error you hit, and depth control so you spend tokens on what you need. Start with the `_hello` tool. How to connect: https://cuppy.io/aws/ Something wrong in this document? Report it with the `session feedback` tool on the same endpoint.