DVA-C02Chapter 6 of 101Objective 1.6

EventBridge and Step Functions

This chapter covers Amazon EventBridge and AWS Step Functions, two core services for building event-driven and workflow-based applications on AWS. For the DVA-C02 exam, these topics appear in approximately 15-20% of questions, often integrated with Lambda, SQS, and other services. You will learn how EventBridge ingests and routes events, how Step Functions orchestrates state machines, and how to combine them for robust, decoupled architectures. Mastery of these services is critical for the 'Development' domain, specifically objective 1.6, which focuses on designing event-driven and workflow solutions.

25 min read
Intermediate
Updated May 31, 2026

The Assembly Line and the Orchestrator

Imagine a factory assembly line for building custom cars. The line has multiple stations: chassis assembly, engine installation, painting, and final inspection. Each station can work independently, but the order matters—you can't paint before the engine is installed. This is like a Step Functions state machine: each step is a state, and the transitions define the workflow. Now, imagine that each station has a buzzer that signals when it's ready for the next car. But the buzzers are not connected—they just sound, and workers must listen. This is like raw events: each service emits events, but there's no centralized logic. EventBridge is the factory supervisor who listens to all buzzers, logs them, and decides which station should start next based on a predefined schedule. The supervisor can also wait for multiple buzzers before triggering a complex operation (like starting a new car only when all parts are ready). In this analogy, the supervisor (EventBridge) receives events (buzzers), applies rules (e.g., 'if chassis is ready and engine is available, start engine station'), and routes them to targets (stations). The assembly line (Step Functions) then orchestrates the sequence of tasks, handling failures (e.g., if painting fails, send car to rework) and managing timeouts. Without the supervisor, events would be chaotic; without the line, there's no structured process. Together, they enable a resilient, automated car production—just like EventBridge and Step Functions enable event-driven, serverless workflows on AWS.

How It Actually Works

What is Amazon EventBridge?

Amazon EventBridge is a serverless event bus service that ingests, filters, transforms, and routes events from AWS services, SaaS applications, and custom applications. It replaces Amazon CloudWatch Events, offering a richer set of features such as schema registry, event archiving, and replay. The core concept is the "event"—a JSON object that describes a change in state. Events are published to an event bus, and rules determine which events are forwarded to which targets.

EventBridge Components

- Event Bus: A pipeline that receives events. There are three types: default bus (receives events from AWS services), custom buses (for your own applications), and partner buses (from SaaS partners). Each account has one default bus per region. - Event: A JSON structure with fields like source, detail-type, detail, resources, time, region, account, and version. Example:

{
    "version": "0",
    "id": "12345678-1234-1234-1234-123456789012",
    "detail-type": "EC2 Instance State-change Notification",
    "source": "aws.ec2",
    "account": "123456789012",
    "time": "2023-01-01T00:00:00Z",
    "region": "us-east-1",
    "resources": ["arn:aws:ec2:us-east-1:123456789012:instance/i-1234567890abcdef0"],
    "detail": {
      "instance-id": "i-1234567890abcdef0",
      "state": "running"
    }
  }

- Rule: Evaluates events as they arrive. A rule consists of an event pattern (filter) and one or more targets. Event patterns use JSON matching, supporting exact match, prefix, suffix, numeric comparison, exists, and anything-but. Example pattern to match EC2 instance running:

{
    "source": ["aws.ec2"],
    "detail-type": ["EC2 Instance State-change Notification"],
    "detail": {
      "state": ["running"]
    }
  }

Target: The destination for matching events. Targets include Lambda, Step Functions, SQS, SNS, Kinesis, API Gateway, ECS tasks, and more. Each rule can have up to 5 targets.

Schema Registry: Stores event schemas and generates code bindings for Java, Python, and TypeScript. You can discover schemas from events or upload them manually.

Archive and Replay: EventBridge can archive events for up to 14 days (default) or custom retention (1-14 days). You can replay archived events to a new or existing bus, useful for testing or recovery.

How EventBridge Works Internally

When an event is published, it is received by the event bus. The bus evaluates all rules in parallel. Each rule's event pattern is matched against the incoming event. If matched, the event is sent to all targets of that rule. Targets are invoked synchronously or asynchronously depending on the target type. For example, Lambda is invoked asynchronously by default, while Step Functions is invoked synchronously. The event is delivered at least once; duplicate events are possible, so targets should be idempotent. EventBridge uses a payload-based model: the entire event is delivered to the target, but you can use input transformers to modify the payload before delivery.

What is AWS Step Functions?

AWS Step Functions is a serverless orchestration service that lets you coordinate multiple AWS services into a workflow. You define state machines using Amazon States Language (ASL), a JSON-based language. State machines consist of states (tasks, choices, waits, parallels, etc.) and transitions. Step Functions executes the workflow, handling retries, error handling, and timeouts.

Step Functions State Types

Task State: Represents a unit of work, typically invoking a Lambda function, running an ECS task, or calling an API. Task states have parameters like Resource (ARN of the service), Parameters (input to the task), TimeoutSeconds (default 60 seconds, max 99999999), HeartbeatSeconds (for activity tasks), and Retry and Catch for error handling.

Choice State: Adds branching logic based on the input. Uses Choices array with Variable, StringEquals, NumericGreaterThan, etc.

Wait State: Delays the execution for a specified duration (Seconds, Timestamp) or until a time (TimestampPath).

Pass State: Passes its input to its output, optionally adding fixed data. Useful for testing or injecting static values.

Parallel State: Executes multiple branches concurrently. Each branch is a state machine itself. The output is an array of each branch's output.

Map State: Iterates over an array of items, executing a sub-state machine for each item. You can set MaxConcurrency to control parallelism (default 40, max 1000).

Succeed State: Terminates the state machine successfully.

Fail State: Terminates the state machine with a failure, setting Cause and Error strings.

How Step Functions Works Internally

When a state machine execution starts, Step Functions creates an execution record. It then traverses states sequentially, performing the action of each state. For Task states, it invokes the specified service and waits for a response. The service's response becomes the input to the next state. If a task fails, the state machine can retry based on Retry configuration (e.g., exponential backoff with jitter). If retries are exhausted, the Catch block can route to a fallback state. Step Functions also supports activity tasks where a worker polls for tasks, useful for long-running activities.

Workflow Types: Standard vs. Express

Standard Workflows: Long-running, durable, exactly-once execution. Execution history is stored for up to 90 days. Ideal for auditing and long processes. Pricing is based on state transitions.

Express Workflows: Short-running, high-volume, at-least-once execution. Execution history is stored in CloudWatch Logs. Ideal for streaming and high-throughput scenarios. Pricing is based on executions and duration.

Integration Between EventBridge and Step Functions

EventBridge can trigger Step Functions state machines directly as a target. The event from EventBridge becomes the input to the state machine. Step Functions can also emit events to EventBridge using the PutEvents API call from a Task state, enabling complex event-driven workflows. For example, a state machine processes an order and emits an "OrderProcessed" event, which EventBridge routes to a notification service.

Key Defaults and Limits

EventBridge: Event size limit 256 KB (payload). Maximum rules per bus: 300. Maximum targets per rule: 5. Event retention for archive: 14 days default, configurable 1-14 days.

Step Functions: Maximum execution history size 25,000 events. Maximum execution time: 1 year (Standard) or 5 minutes (Express). Maximum state machine definition size: 64 KB (Standard) or 10 KB (Express with publish version). Input/output size limit: 256 KB.

Configuration and Verification Commands

To create an EventBridge rule via CLI:

aws events put-rule --name "MyRule" --event-pattern '{"source": ["aws.ec2"]}'

To add a target:

aws events put-targets --rule "MyRule" --targets "Id"="1","Arn"="arn:aws:lambda:us-east-1:123456789012:function:MyFunction"

To create a Step Functions state machine via CLI:

aws stepfunctions create-state-machine --name "MyStateMachine" --definition file://definition.json --role-arn arn:aws:iam::123456789012:role/MyRole

To start an execution:

aws stepfunctions start-execution --state-machine-arn arn:aws:states:us-east-1:123456789012:stateMachine:MyStateMachine --input '{"key": "value"}'

To list executions:

aws stepfunctions list-executions --state-machine-arn arn:aws:states:us-east-1:123456789012:stateMachine:MyStateMachine

Interaction with Related Technologies

Lambda: Both EventBridge and Step Functions integrate deeply with Lambda. EventBridge triggers Lambda functions; Step Functions invokes Lambda as a task. Lambda can also emit custom events to EventBridge.

SQS: EventBridge can send events to SQS queues. Step Functions can poll SQS using a Task state with the SqsReceiveMessage API.

SNS: EventBridge can publish to SNS topics. Step Functions can publish via SNS task.

CloudWatch: Step Functions logs execution history to CloudWatch Logs (for Express workflows) and CloudWatch Metrics (for both). EventBridge emits metrics to CloudWatch.

API Gateway: EventBridge can invoke API Gateway REST APIs. Step Functions can be integrated with API Gateway to start executions via HTTP requests.

Walk-Through

1

Define the Event Pattern

First, you define the event pattern that will trigger the workflow. In EventBridge, this is a JSON object that specifies the criteria for matching events. For example, to match all EC2 instance state changes to 'running', the pattern includes the source 'aws.ec2', detail-type 'EC2 Instance State-change Notification', and detail.state 'running'. The pattern can include multiple values for a field (OR logic) and nested conditions. This step is crucial because it determines which events enter the workflow. The exam often tests the ability to write correct event patterns, especially using operators like 'exists', 'numeric', and 'anything-but'.

2

Create the EventBridge Rule

After defining the pattern, you create a rule in EventBridge that associates the pattern with one or more targets. The rule is the binding that connects the event bus to the state machine. You can create rules via the AWS Console, CLI, or SDK. Each rule can have up to 5 targets. The rule also includes optional input transformation, which modifies the event payload before sending it to the target. For Step Functions, the entire event is passed as input to the state machine unless you use an input transformer. The rule's name must be unique within the event bus.

3

Design the State Machine

You design the state machine using Amazon States Language (ASL) JSON. This involves defining states, transitions, and error handling. For example, a state machine for processing an order might include states: ValidateOrder (Lambda task), CheckInventory (Lambda), ProcessPayment (Lambda), and ShipOrder (ECS task). You need to specify the ARN of each resource, input/output paths, retry policies, and catch blocks. The state machine definition size is limited to 64 KB for Standard workflows. The exam often tests your ability to interpret ASL and identify correct state definitions.

4

Configure Step Functions as EventBridge Target

In the EventBridge rule, you add Step Functions as a target. You specify the ARN of the state machine and optionally an IAM role that EventBridge assumes to start executions. The role must have `states:StartExecution` permission. EventBridge starts a new execution for each matching event. If the state machine is already executing, a new execution is created (they do not conflict). For Standard workflows, each execution is independent. For Express workflows, executions are faster but less durable.

5

Test and Monitor the Workflow

After setup, you test by generating an event that matches the pattern (e.g., start an EC2 instance). You can monitor execution in Step Functions console, viewing the execution history, input, output, and any errors. EventBridge provides metrics like `Invocations` and `FailedInvocations`. Step Functions emits metrics like `ExecutionsStarted` and `ExecutionsFailed`. Use CloudWatch Logs for Express workflows. The exam may ask how to debug failed executions, such as checking IAM permissions or event pattern mismatches.

What This Looks Like on the Job

In a real-world e-commerce platform, EventBridge and Step Functions are used to orchestrate order processing. When a customer places an order, a custom application publishes an event to a custom EventBridge bus. The event includes order details. An EventBridge rule matches this event and triggers a Step Functions state machine. The state machine first validates the order by calling a Lambda function. If valid, it checks inventory via a DynamoDB query (Task state). If inventory is sufficient, it processes payment via a third-party API (using an activity task or Lambda). Finally, it sends a notification via SNS and updates the order status. This decouples the frontend from backend processing, ensuring resilience. Misconfiguration often occurs when the event pattern is too broad, causing unintended invocations, or when IAM roles lack permissions, leading to failed executions. Another common scenario is in data processing pipelines. For example, a media company ingests video uploads from S3. An S3 event is sent to EventBridge (via S3 Event Notifications). The rule triggers a Step Functions workflow that transcodes the video using Elastic Transcoder, generates thumbnails via Lambda, and stores metadata in DynamoDB. The workflow includes parallel states for transcoding and thumbnail generation, and wait states for long transcoding jobs. Performance considerations include setting appropriate timeouts (e.g., 30 minutes for transcoding) and using Express workflows for high-volume, short-duration tasks. A common issue is forgetting to handle partial failures—if thumbnail generation fails, the entire workflow may fail unless a Catch block redirects to a compensation state. In financial services, EventBridge and Step Functions manage trade settlements. A trade execution event triggers a state machine that validates compliance, checks counterparty risk, settles via clearing house API, and updates ledger. Step Functions' retry mechanism handles transient API failures with exponential backoff. The exam emphasizes understanding execution history retention: Standard workflows retain history for 90 days, useful for audits. Express workflows log to CloudWatch, which is cheaper but less durable.

How DVA-C02 Actually Tests This

The DVA-C02 exam tests EventBridge and Step Functions under objective 1.6: 'Develop event-driven and workflow solutions'. Key areas include:

1.

EventBridge event patterns: Know how to write patterns using exact match, prefix, suffix, numeric, exists, and anything-but. The exam often presents a scenario and asks which pattern matches the described event. Common wrong answer: using a single string when an array is required (e.g., "source": ["aws.ec2"] not "source": "aws.ec2").

2.

Input transformers: Understand that you can modify the event payload before it reaches the target. The exam may ask how to pass only specific fields to a state machine. Wrong answer: thinking the entire event is always passed.

3.

Step Functions state types: Know the difference between Task, Choice, Wait, Parallel, Map, Pass, Succeed, Fail. Common trap: confusing Map with Parallel. Map iterates over an array; Parallel runs multiple branches concurrently.

4.

Error handling: Retry and Catch are critical. Know that Retry uses exponential backoff with jitter by default (starting at 1 second, doubling). Catch allows routing to a fallback state. Wrong answer: thinking Catch can retry (it cannot; it handles after retries exhausted).

5.

Standard vs Express workflows: Standard: long-running, exactly-once, durable, up to 1 year. Express: short-running, at-least-once, up to 5 minutes. Common exam question: which workflow to use for an audit trail? Answer: Standard (because of execution history). For high-volume IoT data? Express (cheaper, faster).

6.

Integration patterns: EventBridge can trigger Step Functions and vice versa. Know that Step Functions can call EventBridge PutEvents API. Wrong answer: thinking EventBridge can only trigger Lambda.

7.

Limits: EventBridge event size 256 KB, Step Functions input/output 256 KB, definition size 64 KB (Standard). These numbers appear verbatim.

8.

Edge cases: If a state machine execution times out, it fails. If a Lambda task fails due to permissions, Step Functions catches it if configured. The exam may test that EventBridge does not guarantee order—if order matters, use SQS FIFO or Step Functions with sequential tasks.

To eliminate wrong answers, analyze the mechanism: EventBridge is stateless—it just routes events. Step Functions is stateful—it tracks execution. If the question involves complex orchestration with retries, choose Step Functions. If it's simple event filtering and routing, choose EventBridge.

Key Takeaways

EventBridge routes events based on event patterns; patterns use JSON matching with operators like 'prefix', 'numeric', 'exists'.

EventBridge event size limit is 256 KB; Step Functions input/output size limit is also 256 KB.

Step Functions Standard workflows are exactly-once and durable; Express workflows are at-least-once and faster.

Step Functions state machine definition size limit is 64 KB for Standard, 10 KB for Express with publish version.

Use Retry with exponential backoff (default 1s, doubles) and Catch for fallback in Step Functions.

EventBridge can trigger Step Functions directly; Step Functions can emit events to EventBridge via PutEvents.

Map state iterates over an array; Parallel state runs multiple branches concurrently.

For ordered event processing, use SQS FIFO or Step Functions sequential tasks, as EventBridge does not guarantee order.

Step Functions execution history for Standard is retained for 90 days; for Express, logs go to CloudWatch.

EventBridge supports input transformation to modify event payload before delivery to target.

Easy to Mix Up

These come up on the exam all the time. Here's how to tell them apart.

Standard Workflows

Up to 1 year execution duration

Exactly-once execution

Execution history stored for 90 days

Priced per state transition

Ideal for long-running, auditable processes

Express Workflows

Up to 5 minutes execution duration

At-least-once execution (duplicates possible)

Execution history in CloudWatch Logs

Priced per execution and duration

Ideal for high-volume, short tasks

Watch Out for These

Mistake

EventBridge guarantees exactly-once delivery.

Correct

EventBridge delivers events at least once. Duplicates can occur, so targets must be idempotent. For exactly-once, use Step Functions Standard workflows or SQS FIFO.

Mistake

Step Functions can only invoke Lambda functions.

Correct

Step Functions integrates with over 200 AWS services, including ECS, DynamoDB, SQS, SNS, and API Gateway. Task states can call any AWS API via the SDK integration.

Mistake

EventBridge and CloudWatch Events are the same service.

Correct

EventBridge is the evolution of CloudWatch Events. CloudWatch Events is still available but limited. EventBridge adds schema registry, archives, replay, and partner integrations. The exam uses EventBridge terminology.

Mistake

Express workflows have execution history stored for 90 days.

Correct

Express workflows log execution history to CloudWatch Logs, not Step Functions internal storage. The retention is based on CloudWatch Logs settings (default indefinite). Standard workflows store history for 90 days.

Mistake

A state machine can have multiple start states.

Correct

A state machine has exactly one start state, defined by the `StartAt` field. To have multiple entry points, use separate state machines.

Do You Actually Know This?

Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.

Frequently Asked Questions

Can EventBridge send events to multiple targets?

Yes, a single EventBridge rule can have up to 5 targets. When an event matches the pattern, it is sent to all targets simultaneously. If you need more than 5 targets, create multiple rules with the same pattern or use a fan-out pattern with SNS or SQS.

What is the difference between EventBridge and SQS?

EventBridge is a serverless event bus for routing events based on content, with filtering and transformation. SQS is a message queue for decoupling applications, with pull-based semantics and exactly-once (FIFO) or at-least-once delivery. EventBridge pushes events to targets; SQS requires consumers to poll. Use EventBridge for event-driven routing, SQS for buffering and decoupling.

How do I retry a failed Step Functions task?

Define a Retry block in the Task state. Example: `"Retry": [ { "ErrorEquals": ["States.ALL"], "IntervalSeconds": 2, "MaxAttempts": 3, "BackoffRate": 2 } ]`. This retries up to 3 times with exponential backoff starting at 2 seconds. For non-retryable errors, use Catch to route to a fallback state.

Can Step Functions call an external HTTP API?

Yes, using the `arn:aws:states:::http:invoke` resource in a Task state. This allows calling any public HTTP endpoint. You must specify the endpoint URL, method, and optionally headers and body. This is useful for integrating with third-party APIs without Lambda.

What is the maximum execution time for a Step Functions Standard workflow?

Standard workflows can run up to 1 year. Express workflows are limited to 5 minutes. If your workflow exceeds the limit, it will fail. For longer processes, design the workflow to handle partial execution or use a different approach.

How do I pass data between states in Step Functions?

Data flows via the state's input and output. Each state receives the previous state's output as input. You can manipulate data using `InputPath`, `OutputPath`, `ResultPath`, and `Parameters`. For example, `"InputPath": "$.payload"` extracts only the payload field from the input.

Can EventBridge filter events based on nested fields?

Yes, event patterns support nested JSON matching. For example, to match `detail.user.id` equals 123, use `"detail": { "user": { "id": [123] } }`. You can also use numeric matching: `"detail": { "count": [{ "numeric": [">=", 10] }] }`.

Terms Worth Knowing

Ready to put this to the test?

You've just covered EventBridge and Step Functions — now see how well it sticks with free DVA-C02 practice questions. Full explanations included, no account needed.

Done with this chapter?