AWS EventBridge is an event bus system for loosely coupling different services and resources in a publish/subscribe pattern. A service can publish an event (i.e., a message) and multiple other services can subscribe to that event.
The subscription mechanism is done through individual rules that define the pattern of an event to be catched on the event bus and define multiple targets to be called upon that event, e.g. a Lambda function or a StepFunction state machine.
Motivation
This post is intended to serve as a blueprint for how to invoke these two services with rules and how to deal with typical authorization challenges along the way. The required resources are defined as a CloudFormation template in JSON, but can easily be converted to YAML.
I created a test Lambda function and a test StepFunction state machine to be called by their respective EventBridge rule. I refer to these resources in CloudFormation as TestLambdaFunction
and TestStateMachine
, but these are just their logical IDs and will be replaced with ARNs when deployed.
Invoke StepFunction State Machine
This CloudFormation template defines an event rule with ID InvokeStateMachineEventRule
and name start-state-machine
that listens on the default
event bus for events whose detail-type
is set to start-state-machine
.
Targets are resources that are invoked when a rule is triggered. The intrinsic function Fn::GetAtt
returns the ARN of TestStateMachine
specified as the target resource.
Additionally, each target must define an IAM role as RoleArn
which is used to invoke the resource.
{
"InvokeStateMachineEventRule": {
"Type": "AWS::Events::Rule",
"Properties": {
"EventBusName": "default",
"EventPattern": {
"detail-type": ["start-state-machine"],
},
"Name": "start-state-machine",
"State": "ENABLED",
"Targets": [
{
"Arn": {
"Fn: :GetAtt": ["TestStateMachine","Arn"]
},
"Id": "TestStateMachine",
"RoleArn": {
"Fn: :GetAtt": ["InvokeStateMachineIamRole","Arn"]
},
},
],
},
},
}
The IAM role is defined as InvokeStateMachineIamRole
and contains an inline policy that allows the states:StartExecution
action for the TestStateMachine
resource. Since the role is used by an EventBridge rule to invoke another service resource (i.e. StepFunction state machine), an additional AssumeRolePolicyDocument
is provided to allow the role to be taken from EventBridge (i. e. principal events.amazonaws.com
).
{
"InvokeStateMachineIamRole": {
"Type": "AWS::IAM::Role",
"Properties": {
"Policies": [
{
"PolicyName": "InvokeStateMachineRolePolicy",
"PolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": ["states:StartExecution"],
"Resource": [
{
"Fn: :GetAtt": ["TestStateMachine", "Arn"]
}
],
},
],
},
},
],
},
},
"AssumeRolePolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": ["events.amazonaws.com"],
},
"Action": "sts:AssumeRole",
},
],
},
}
Invoke Lambda Function
This event rule InvokeLambdaFunctionEventRule
is similar to the previous one, except that it is named start-lambda-function
and listens for events whose detail-type
is set to start-lambda-function
. Also, the target resource is TestLambdaFunction
and RoleArn
was intentionally omitted.
{
"InvokeLambdaFunctionEventRule": {
"Type": "AWS::Events::Rule",
"Properties": {
"EventBusName": "default",
"EventPattern": {
"detail-type": ["start-lambda-function"],
},
"Name": "start-lambda-function",
"State": "ENABLED",
"Targets": [
{
"Arn": {
"Fn: :GetAtt": ["TestLambdaFunction","Arn"]
},
"Id": "TestLambdaFunction",
},
],
},
},
}
If we provide a RoleArn
for the TestLambdaFunction
target, it will throw an error when deploying it:
UPDATE_FAILED: InvokeLambdaFunctionEventRule (AWS::Events::Rule)
RoleArn is not supported for target arn:aws:lambda:eu-central-1:xxxxxxxxxxxx:function:eventbridge-rule-example-dev-test.
Unlike other services, Lambda uses resource-based permissions to allow other AWS services to invoke this function on your behalf. Therefore, we need to add an InvokeLambdaFunctionPermission
definition that allows the Lambda:InvokeFunction
action for the TestLambdaFunction
resource (i.e. function name). Also this permission is used by an EventBridge rule to invoke this Lambda function. Therefore, we need to specify the principal events.amazonaws.com
and the ARN of InvokeLambdaFunctionEventRule
that actually calls the function.
{
"InvokeLambdaFunctionPermission": {
"Type": "AWS::Lambda::Permission",
"Properties": {
"FunctionName": {
"Fn: :GetAtt": ["TestLambdaFunction", "Arn"],
},
"Action": "lambda:InvokeFunction",
"Principal": "events.amazonaws.com",
"SourceArn": {
"Fn: :GetAtt": ["InvokeLambdaFunctionEventRule", "Arn"]
},
},
},
}
GitHub Repository
I deployed all resources using the Serverless Framework, but only to quickly create the Lambda function and StepFunction state machine. All the important resources are defined as AWS CloudFormation templates and are valid when deployed in other ways, e.g. AWS SAM, AWS CLI, etc.
Feel free to check out the full template and deploy it on your own AWS account: GitHub respository
Top comments (0)