3.3.1.3. Integrating AWS Event Sources (AWS Health, EventBridge, CloudTrail)

3.3.1.3. Integrating AWS Event Sources (AWS Health, EventBridge, CloudWatch)

Integrating event sources means building a unified incident detection pipeline where any anomaly — infrastructure, security, or application — routes to the right responder.

Unified event pipeline architecture:

AWS Health Events      ─┐
CloudWatch Alarms      ─┤
GuardDuty Findings     ─┤→ EventBridge ─→ Step Functions (Incident Router)
Config Compliance      ─┤                  ├→ PagerDuty (P1 incidents)
CloudTrail Events      ─┤                  ├→ Slack (P2 notifications)
Custom App Events      ─┘                  ├→ Lambda (auto-remediation)
                                           └→ S3 (incident archive)

EventBridge rule patterns for incident classification:

{
  "source": ["aws.guardduty"],
  "detail-type": ["GuardDuty Finding"],
  "detail": {
    "severity": [{"numeric": [">=", 7]}]
  }
}

Cross-account event aggregation: EventBridge supports forwarding events between accounts. Application accounts forward events to a central operations account where all alerting and automation runs.

AWS Health + EventBridge integration: Health events arrive automatically in EventBridge. Create rules to:

• Alert on service issues affecting your region
• Trigger DR failover when your primary region has issues
• Notify teams of upcoming maintenance windows

Exam Trap: EventBridge rules match events based on the event pattern — and the matching is exact unless you use prefix, suffix, or numeric matching. A rule matching "source": ["aws.ec2"] will NOT match "source": ["aws.ec2.spot"]. These are different sources. If the exam describes a rule that isn't firing, check whether the source and detail-type values match exactly.