Event Structure

Each event is comprised of the following properties:

detail-type: [REQUIRED] Identifies, in combination with the source field, the fields and values that appear in the detail field. Additionally, this field is often used for filtering to limit the notifications when new events are published.

source: [REQUIRED] Identifies the data domain the event originated from. Additionally, it can be used for filtering to limit the notifications when new events are published.

detail: [REQUIRED] A JSON object that contains information about the event. The service generating the event determines the content of this field. The detail content can be as simple as two fields. AWS API call events have detail objects with approximately 50 fields nested several levels deep.

version: By default, this is set to 0 (zero) in all events.

id: A Version 4 UUID that’s generated for every event. You can use id to trace events as they move through rules to targets.

account: The 12-digit number identifying an AWS account.

time: The event timestamp, which can be specified by the service originating the event. If the event spans a time interval, the service can report the start time, so this value might be before the time the event is received.

region: Identifies the AWS Region where the event originated.

resources: A JSON array that contains ARNs that identify resources that are involved in the event. The service generating the event determines whether to include these ARNs. For example, Amazon EC2 instance state-changes include Amazon EC2 instance ARNs, Auto Scaling events include ARNs for both instances and Auto Scaling groups, but API calls with AWS CloudTrail do not include resource ARNs.

Example EventBridge Event

{
  "version": "0",
  "id": "6a7e8feb-b491-4cf7-a9f1-bf3703467718",
  "detail-type": "EC2 Instance State-change Notification",
  "source": "aws.ec2",
  "account": "111122223333",
  "time": "2017-12-22T18:43:48Z",
  "region": "us-west-1",
  "resources": [
    "arn:aws:ec2:us-west-1:123456789012:instance/i-1234567890abcdef0"
  ],
  "detail": {
    "instance-id": " i-1234567890abcdef0",
    "state": "terminated"
  }
}