AWS EventBridge Terraform module

Terraform module to create EventBridge resources.

Supported Features

• Creates AWS EventBridge Resources (bus, rules, targets, permissions, connections, destinations, pipes, schedules and schedule groups)
• Attach resources to an existing EventBridge bus
• Support AWS EventBridge Archives and Replays
• Conditional creation for many types of resources
• Support IAM policy attachments and various ways to create and attach additional policies

Usage

EventBridge Complete

Most common use-case which creates custom bus, rules and targets.

module "eventbridge" {
  source = "terraform-aws-modules/eventbridge/aws"

  bus_name = "my-bus"

  rules = {
    orders = {
      description   = "Capture all order data"
      event_pattern = jsonencode({ "source" : ["myapp.orders"] })
      enabled       = true
    }
  }

  targets = {
    orders = [
      {
        name            = "send-orders-to-sqs"
        arn             = aws_sqs_queue.queue.arn
        dead_letter_arn = aws_sqs_queue.dlq.arn
      },
      {
        name              = "send-orders-to-kinesis"
        arn               = aws_kinesis_stream.this.arn
        dead_letter_arn   = aws_sqs_queue.dlq.arn
        input_transformer = local.kinesis_input_transformer
      },
      {
        name = "log-orders-to-cloudwatch"
        arn  = aws_cloudwatch_log_group.this.arn
      }
    ]
  }

  tags = {
    Name = "my-bus"
  }
}

EventBridge Bus

module "eventbridge" {
  source = "terraform-aws-modules/eventbridge/aws"

  bus_name = "my-bus"

  tags = {
    Name = "my-bus"
  }
}

EventBridge Rule

module "eventbridge" {
  source = "terraform-aws-modules/eventbridge/aws"

  bus_name = "my-bus"

  create_targets = false

  rules = {
    logs = {
      description   = "Capture log data"
      event_pattern = jsonencode({ "source" : ["my.app.logs"] })
    }
  }
}

EventBridge Target

module "eventbridge" {
  source = "terraform-aws-modules/eventbridge/aws"

  bus_name = "my-bus"

  rules = {
    logs = {
      description   = "Capture log data"
      event_pattern = jsonencode({ "source" : ["my.app.logs"] })
    }
  }

  targets = {
    logs = [
      {
        name = "send-logs-to-sqs"
        arn  = aws_sqs_queue.queue.arn
      },
      {
        name = "send-logs-to-cloudwatch"
        arn  = aws_cloudwatch_log_stream.logs.arn
      }
    ]
  }
}

EventBridge Archive

module "eventbridge_with_archive" {
  source = "terraform-aws-modules/eventbridge/aws"

  bus_name = "my-bus"

  create_archives = true

  archives = {
    "my-bus-launch-archive" = {
      description    = "EC2 AutoScaling Event archive",
      retention_days = 1
      event_pattern  = <<PATTERN
      {
        "source": ["aws.autoscaling"],
        "detail-type": ["EC2 Instance Launch Successful"]
      }
      PATTERN
    }
  }

  tags = {
    Name = "my-bus"
  }
}

EventBridge Permission

module "eventbridge_with_permissions" {
  source = "terraform-aws-modules/eventbridge/aws"

  bus_name = "my-bus"

  create_permissions = true

  permissions = {
    "099720109477 DevAccess" = {}
    "099720109466 ProdAccess" = {}
  }

  tags = {
    Name = "my-bus"
  }
}

EventBridge with schedule rule and Lambda target

module "eventbridge" {
  source = "terraform-aws-modules/eventbridge/aws"

  create_bus = false

  rules = {
    crons = {
      description         = "Trigger for a Lambda"
      schedule_expression = "rate(5 minutes)"
    }
  }

  targets = {
    crons = [
      {
        name  = "lambda-loves-cron"
        arn   = "arn:aws:lambda:ap-southeast-1:135367859851:function:resolved-penguin-lambda"
        input = jsonencode({"job": "cron-by-rate"})
      }
    ]
  }
}

EventBridge with schedule rule and Step Functions target

module "eventbridge" {
  source = "terraform-aws-modules/eventbridge/aws"

  create_bus = false

  rules = {
    crons = {
      description         = "Run state machine everyday 10:00 UTC"
      schedule_expression = "cron(0 10 * * ? *)"
    }
  }

  targets = {
    crons = [
      {
        name            = "your-awesome-state-machine"
        arn             = "arn:aws:states:us-east-1:123456789012:stateMachine:your-awesome-state-machine"
        attach_role_arn = true
      }
    ]
  }

  sfn_target_arns   = ["arn:aws:states:us-east-1:123456789012:stateMachine:your-awesome-state-machine"]
  attach_sfn_policy = true
}

EventBridge Scheduler which triggers Lambda Function

module "eventbridge" {
  source = "terraform-aws-modules/eventbridge/aws"

  bus_name = "example" # "default" bus already support schedule_expression in rules

  attach_lambda_policy = true
  lambda_target_arns   = ["arn:aws:lambda:us-east-1:135367859851:function:resolved-penguin-lambda"]

  schedules = {
    lambda-cron = {
      description         = "Trigger for a Lambda"
      schedule_expression = "rate(1 day)"
      timezone            = "Europe/London"
      arn                 = "arn:aws:lambda:us-east-1:135367859851:function:resolved-penguin-lambda"
      input               = jsonencode({ "job" : "cron-by-rate" })
    }
  }
}

EventBridge API Destination

module "eventbridge_with_api_destination" {
  source = "terraform-aws-modules/eventbridge/aws"

  bus_name = "my-bus"

  create_connections      = true
  create_api_destinations = true

  attach_api_destination_policy = true

  connections = {
    smee = {
      authorization_type = "OAUTH_CLIENT_CREDENTIALS"
      auth_parameters = {
        oauth = {
          authorization_endpoint = "https://oauth.endpoint.com"
          http_method            = "GET"

          client_parameters = {
            client_id     = "1234567890"
            client_secret = "Pass1234!"
          }

          oauth_http_parameters = {
            body = [{
              key             = "body-parameter-key"
              value           = "body-parameter-value"
              is_value_secret = false
            }]

            header = [{
              key   = "header-parameter-key1"
              value = "header-parameter-value1"
            }, {
              key             = "header-parameter-key2"
              value           = "header-parameter-value2"
              is_value_secret = true
            }]

            query_string = [{
              key             = "query-string-parameter-key"
              value           = "query-string-parameter-value"
              is_value_secret = false
            }]
          }
        }
      }
    }
  }

  api_destinations = {
    smee = {
      description                      = "my smee endpoint"
      invocation_endpoint              = "https://smee.io/hgoubgoibwekt331"
      http_method                      = "POST"
      invocation_rate_limit_per_second = 200
    }
  }
}

Additional IAM policies for Step Function

In addition to all supported AWS service integrations you may want to create and attach additional policies.

There are 5 supported ways to attach additional IAM policies to IAM role used by Step Function:

1. policy_json - JSON string or heredoc, when attach_policy_json = true.
2. policy_jsons - List of JSON strings or heredoc, when attach_policy_jsons = true and number_of_policy_jsons > 0.
3. policy - ARN of existing IAM policy, when attach_policy = true.
4. policies - List of ARNs of existing IAM policies, when attach_policies = true and number_of_policies > 0.
5. policy_statements - Map of maps to define IAM statements which will be generated as IAM policy. Requires attach_policy_statements = true. See examples/complete for more information.

Conditional creation

Sometimes you need to have a way to create resources conditionally but Terraform does not allow usage of count inside module block, so the solution is to specify create arguments.

module "eventbridge" {
  source = "terraform-aws-modules/eventbridge/aws"

  create = false # to disable all resources

  create_bus              = false  # to control creation of the EventBridge Bus and related resources
  create_rules            = false  # to control creation of EventBridge Rules and related resources
  create_targets          = false  # to control creation of EventBridge Targets and related resources
  create_archives         = false  # to control creation of EventBridge Archives
  create_permissions      = false  # to control creation of EventBridge Permissions
  create_role             = false  # to control creation of the IAM role and policies required for EventBridge
  create_connections      = false  # to control creation of EventBridge Connection resources
  create_api_destinations = false  # to control creation of EventBridge Destination resources
  create_schedule_groups  = false  # to control creation of EventBridge Schedule Group resources
  create_schedules        = false  # to control creation of EventBridge Schedule resources
  create_pipes            = false  # to control creation of EventBridge Pipes resources

  attach_cloudwatch_policy       = false
  attach_ecs_policy              = false
  attach_kinesis_policy          = false
  attach_kinesis_firehose_policy = false
  attach_lambda_policy           = false
  attach_sfn_policy              = false
  attach_sqs_policy              = false
  attach_tracing_policy          = false
  attach_api_destination_policy  = false

  # ... omitted
}

Examples

• Complete - Creates EventBridge resources (bus, rules and targets) and connect with SQS queues, Kinesis Stream, Step Function, CloudWatch Logs, Lambda Functions, and more.
• HTTP API Gateway - Creates an integration with HTTP API Gateway as event source.
• Using Default Bus - Creates resources in the default bus.
• Archive - EventBridge Archives resources in various configurations.
• Permissions - Controls permissions to EventBridge.
• Scheduler - EventBridge Scheduler which works with any bus (recommended way).
• ECS Scheduling Events - Use default bus to schedule events on ECS.
• Lambda Scheduling Events - Trigger Lambda functions on schedule (works only with default bus).
• API Destination - Control access to EventBridge using API destinations.
• Pipes - EventBridge Pipes with lots of configurations.

Requirements

Name	Version
terraform	>= 1.0
aws	>= 5.72

Providers

Name	Version
aws	>= 5.72

Modules

No modules.

Resources

Name	Type
aws_cloudwatch_event_api_destination.this	resource
aws_cloudwatch_event_archive.this	resource
aws_cloudwatch_event_bus.this	resource
aws_cloudwatch_event_connection.this	resource
aws_cloudwatch_event_permission.this	resource
aws_cloudwatch_event_rule.this	resource
aws_cloudwatch_event_target.this	resource
aws_iam_policy.additional_inline	resource
aws_iam_policy.additional_json	resource
aws_iam_policy.additional_jsons	resource
aws_iam_policy.api_destination	resource
aws_iam_policy.cloudwatch	resource
aws_iam_policy.ecs	resource
aws_iam_policy.kinesis	resource
aws_iam_policy.kinesis_firehose	resource
aws_iam_policy.lambda	resource
aws_iam_policy.service	resource
aws_iam_policy.sfn	resource
aws_iam_policy.sns	resource
aws_iam_policy.sqs	resource
aws_iam_policy.tracing	resource
aws_iam_policy_attachment.additional_inline	resource
aws_iam_policy_attachment.additional_json	resource
aws_iam_policy_attachment.additional_jsons	resource
aws_iam_policy_attachment.api_destination	resource
aws_iam_policy_attachment.cloudwatch	resource
aws_iam_policy_attachment.ecs	resource
aws_iam_policy_attachment.kinesis	resource
aws_iam_policy_attachment.kinesis_firehose	resource
aws_iam_policy_attachment.lambda	resource
aws_iam_policy_attachment.service	resource
aws_iam_policy_attachment.sfn	resource
aws_iam_policy_attachment.sns	resource
aws_iam_policy_attachment.sqs	resource
aws_iam_policy_attachment.tracing	resource
aws_iam_role.eventbridge	resource
aws_iam_role.eventbridge_pipe	resource
aws_iam_role_policy_attachment.additional_many	resource
aws_iam_role_policy_attachment.additional_one	resource
aws_pipes_pipe.this	resource
aws_scheduler_schedule.this	resource
aws_scheduler_schedule_group.this	resource
aws_schemas_discoverer.this	resource
aws_caller_identity.current	data source
aws_cloudwatch_event_bus.this	data source
aws_iam_policy.tracing	data source
aws_iam_policy_document.additional_inline	data source
aws_iam_policy_document.api_destination	data source
aws_iam_policy_document.assume_role	data source
aws_iam_policy_document.assume_role_pipe	data source
aws_iam_policy_document.cloudwatch	data source
aws_iam_policy_document.ecs	data source
aws_iam_policy_document.kinesis	data source
aws_iam_policy_document.kinesis_firehose	data source
aws_iam_policy_document.lambda	data source
aws_iam_policy_document.service	data source
aws_iam_policy_document.sfn	data source
aws_iam_policy_document.sns	data source
aws_iam_policy_document.sqs	data source
aws_partition.current	data source
aws_region.current	data source

Inputs

Name	Description	Type	Default	Required
api_destinations	A map of objects with EventBridge Destination definitions.	map(any)	{}	no
append_connection_postfix	Controls whether to append '-connection' to the name of the connection	bool	true	no
append_destination_postfix	Controls whether to append '-destination' to the name of the destination	bool	true	no
append_pipe_postfix	Controls whether to append '-pipe' to the name of the pipe	bool	true	no
append_rule_postfix	Controls whether to append '-rule' to the name of the rule	bool	true	no
append_schedule_group_postfix	Controls whether to append '-group' to the name of the schedule group	bool	true	no
append_schedule_postfix	Controls whether to append '-schedule' to the name of the schedule	bool	true	no
archives	A map of objects with the EventBridge Archive definitions.	map(any)	{}	no
attach_api_destination_policy	Controls whether the API Destination policy should be added to IAM role for EventBridge Target	bool	false	no
attach_cloudwatch_policy	Controls whether the Cloudwatch policy should be added to IAM role for EventBridge Target	bool	false	no
attach_ecs_policy	Controls whether the ECS policy should be added to IAM role for EventBridge Target	bool	false	no
attach_kinesis_firehose_policy	Controls whether the Kinesis Firehose policy should be added to IAM role for EventBridge Target	bool	false	no
attach_kinesis_policy	Controls whether the Kinesis policy should be added to IAM role for EventBridge Target	bool	false	no
attach_lambda_policy	Controls whether the Lambda Function policy should be added to IAM role for EventBridge Target	bool	false	no
attach_policies	Controls whether list of policies should be added to IAM role	bool	false	no
attach_policy	Controls whether policy should be added to IAM role	bool	false	no
attach_policy_json	Controls whether policy_json should be added to IAM role	bool	false	no
attach_policy_jsons	Controls whether policy_jsons should be added to IAM role	bool	false	no
attach_policy_statements	Controls whether policy_statements should be added to IAM role	bool	false	no
attach_sfn_policy	Controls whether the StepFunction policy should be added to IAM role for EventBridge Target	bool	false	no
attach_sns_policy	Controls whether the SNS policy should be added to IAM role for EventBridge Target	bool	false	no
attach_sqs_policy	Controls whether the SQS policy should be added to IAM role for EventBridge Target	bool	false	no
attach_tracing_policy	Controls whether X-Ray tracing policy should be added to IAM role for EventBridge	bool	false	no
bus_name	A unique name for your EventBridge Bus	string	"default"	no
cloudwatch_target_arns	The Amazon Resource Name (ARN) of the Cloudwatch Log Streams you want to use as EventBridge targets	list(string)	[]	no
connections	A map of objects with EventBridge Connection definitions.	any	{}	no
create	Controls whether resources should be created	bool	true	no
create_api_destinations	Controls whether EventBridge Destination resources should be created	bool	false	no
create_archives	Controls whether EventBridge Archive resources should be created	bool	false	no
create_bus	Controls whether EventBridge Bus resource should be created	bool	true	no
create_connections	Controls whether EventBridge Connection resources should be created	bool	false	no
create_permissions	Controls whether EventBridge Permission resources should be created	bool	true	no
create_pipes	Controls whether EventBridge Pipes resources should be created	bool	true	no
create_role	Controls whether IAM roles should be created	bool	true	no
create_rules	Controls whether EventBridge Rule resources should be created	bool	true	no
create_schedule_groups	Controls whether EventBridge Schedule Group resources should be created	bool	true	no
create_schedules	Controls whether EventBridge Schedule resources should be created	bool	true	no
create_schemas_discoverer	Controls whether default schemas discoverer should be created	bool	false	no
create_targets	Controls whether EventBridge Target resources should be created	bool	true	no
ecs_pass_role_resources	List of approved roles to be passed	list(string)	[]	no
ecs_target_arns	The Amazon Resource Name (ARN) of the AWS ECS Tasks you want to use as EventBridge targets	list(string)	[]	no
event_source_name	The partner event source that the new event bus will be matched with. Must match name.	string	null	no
kinesis_firehose_target_arns	The Amazon Resource Name (ARN) of the Kinesis Firehose Delivery Streams you want to use as EventBridge targets	list(string)	[]	no
kinesis_target_arns	The Amazon Resource Name (ARN) of the Kinesis Streams you want to use as EventBridge targets	list(string)	[]	no
kms_key_identifier	The identifier of the AWS KMS customer managed key for EventBridge to use, if you choose to use a customer managed key to encrypt events on this event bus. The identifier can be the key Amazon Resource Name (ARN), KeyId, key alias, or key alias ARN.	string	null	no
lambda_target_arns	The Amazon Resource Name (ARN) of the Lambda Functions you want to use as EventBridge targets	list(string)	[]	no
number_of_policies	Number of policies to attach to IAM role	number	0	no
number_of_policy_jsons	Number of policies JSON to attach to IAM role	number	0	no
permissions	A map of objects with EventBridge Permission definitions.	map(any)	{}	no
pipes	A map of objects with EventBridge Pipe definitions.	any	{}	no
policies	List of policy statements ARN to attach to IAM role	list(string)	[]	no
policy	An additional policy document ARN to attach to IAM role	string	null	no
policy_json	An additional policy document as JSON to attach to IAM role	string	null	no
policy_jsons	List of additional policy documents as JSON to attach to IAM role	list(string)	[]	no
policy_path	Path of IAM policy to use for EventBridge	string	null	no
policy_statements	Map of dynamic policy statements to attach to IAM role	any	{}	no
role_description	Description of IAM role to use for EventBridge	string	null	no
role_force_detach_policies	Specifies to force detaching any policies the IAM role has before destroying it.	bool	true	no
role_name	Name of IAM role to use for EventBridge	string	null	no
role_path	Path of IAM role to use for EventBridge	string	null	no
role_permissions_boundary	The ARN of the policy that is used to set the permissions boundary for the IAM role used by EventBridge	string	null	no
role_tags	A map of tags to assign to IAM role	map(string)	{}	no
rules	A map of objects with EventBridge Rule definitions.	map(any)	{}	no
schedule_group_timeouts	A map of objects with EventBridge Schedule Group create and delete timeouts.	map(string)	{}	no
schedule_groups	A map of objects with EventBridge Schedule Group definitions.	any	{}	no
schedules	A map of objects with EventBridge Schedule definitions.	map(any)	{}	no
schemas_discoverer_description	Default schemas discoverer description	string	"Auto schemas discoverer event"	no
sfn_target_arns	The Amazon Resource Name (ARN) of the StepFunctions you want to use as EventBridge targets	list(string)	[]	no
sns_kms_arns	The Amazon Resource Name (ARN) of the AWS KMS's configured for AWS SNS you want Decrypt/GenerateDataKey for	list(string)	[ "*" ]	no
sns_target_arns	The Amazon Resource Name (ARN) of the AWS SNS's you want to use as EventBridge targets	list(string)	[]	no
sqs_target_arns	The Amazon Resource Name (ARN) of the AWS SQS Queues you want to use as EventBridge targets	list(string)	[]	no
tags	A map of tags to assign to resources.	map(string)	{}	no
targets	A map of objects with EventBridge Target definitions.	any	{}	no
trusted_entities	Additional trusted entities for assuming roles (trust relationship)	list(string)	[]	no

Outputs

Name	Description
eventbridge_api_destination_arns	The EventBridge API Destination ARNs
eventbridge_api_destinations	The EventBridge API Destinations created and their attributes
eventbridge_archive_arns	The EventBridge Archive ARNs
eventbridge_archives	The EventBridge Archives created and their attributes
eventbridge_bus	The EventBridge Bus created and their attributes
eventbridge_bus_arn	The EventBridge Bus ARN
eventbridge_bus_name	The EventBridge Bus Name
eventbridge_connection_arns	The EventBridge Connection Arns
eventbridge_connection_ids	The EventBridge Connection IDs
eventbridge_connections	The EventBridge Connections created and their attributes
eventbridge_iam_roles	The EventBridge IAM roles created and their attributes
eventbridge_permission_ids	The EventBridge Permission IDs
eventbridge_permissions	The EventBridge Permissions created and their attributes
eventbridge_pipe_arns	The EventBridge Pipes ARNs
eventbridge_pipe_ids	The EventBridge Pipes IDs
eventbridge_pipe_role_arns	The ARNs of the IAM role created for EventBridge Pipes
eventbridge_pipe_role_names	The names of the IAM role created for EventBridge Pipes
eventbridge_pipes	The EventBridge Pipes created and their attributes
eventbridge_pipes_iam_roles	The EventBridge Pipes IAM roles created and their attributes
eventbridge_role_arn	The ARN of the IAM role created for EventBridge
eventbridge_role_name	The name of the IAM role created for EventBridge
eventbridge_rule_arns	The EventBridge Rule ARNs
eventbridge_rule_ids	The EventBridge Rule IDs
eventbridge_rules	The EventBridge Rules created and their attributes
eventbridge_schedule_arns	The EventBridge Schedule ARNs created
eventbridge_schedule_group_arns	The EventBridge Schedule Group ARNs
eventbridge_schedule_group_ids	The EventBridge Schedule Group IDs
eventbridge_schedule_group_states	The EventBridge Schedule Group states
eventbridge_schedule_groups	The EventBridge Schedule Groups created and their attributes
eventbridge_schedule_ids	The EventBridge Schedule IDs created
eventbridge_schedules	The EventBridge Schedules created and their attributes
eventbridge_targets	The EventBridge Targets created and their attributes

Authors

Module managed by Sven Lito. Check out serverless.tf to learn more about doing serverless with Terraform.

License

Apache 2 Licensed. See LICENSE for full details.