A Rule is a JSON pattern attached to an event bus. EventBridge evaluates every incoming event against every rule on that bus. If the event's fields match the pattern, the event is sent to the rule's configured target(s). If no rule matches, the event is silently dropped (unless you configure a dead-letter queue — more on that shortly).
Content-Based Filtering
Rules use content-based filtering — they look inside the event's JSON fields to decide whether to route it. You only specify the fields you care about; unspecified fields are ignored.
Example 1: Match all events from the order service
{
"source": ["com.mycompany.orders"]
}
This matches any event where source equals com.mycompany.orders, regardless of detail-type or anything in detail.
Example 2: Match only a specific event type
{
"source": ["com.mycompany.orders"],
"detail-type": ["OrderPlaced"]
}
Example 3: Match high-value orders only (numeric filtering)
{
"source": ["com.mycompany.orders"],
"detail-type": ["OrderPlaced"],
"detail": {
"total": [{ "numeric": [">", 100] }]
}
}
Example 4: Match US orders only (prefix matching)
{
"detail": {
"shippingAddress": {
"country": ["US"]
}
}
}
Example 5: Match anything EXCEPT test events (anything-but)
{
"source": [{ "anything-but": ["com.mycompany.test"] }]
}
Advanced Filtering Operators
| Operator | Syntax | Use Case |
|---|---|---|
| Exact match | ["value"] |
Match a specific string |
| Numeric range | [{"numeric": [">=", 0, "<", 100]}] |
Price ranges, status codes |
| Prefix | [{"prefix": "ERROR"}] |
Log level filtering |
| Suffix | [{"suffix": ".jpg"}] |
File type filtering |
| Anything-but | [{"anything-but": ["test"]}] |
Exclude environments |
| Exists | [{"exists": true}] |
Field presence check |
| IP CIDR | [{"cidr": "10.0.0.0/8"}] |
Network-based routing |
Fan-Out: One Event, Many Rules
A single event can match multiple rules simultaneously. Each matching rule independently routes the event to its target. This is fan-out — one OrderPlaced event can simultaneously trigger the Inventory Lambda, the Shipping SQS queue, and the Analytics Firehose stream, all in parallel, with no coordination required.
Key Point: Rule evaluation is parallel and independent — there is no rule priority or ordering. If you need sequential processing (do A, then B, then C), EventBridge alone is not the right tool. Combine it with AWS Step Functions for orchestrated workflows. EventBridge excels at parallel fan-out; Step Functions excels at sequential coordination.