Events in Amazon EventBridge

  • Latest Dynatrace
  • Explanation

Amazon EventBridge (EB) is a centralized fully managed serverless event router. It's common to use it as a destination event bus, mainly in event-driven use cases (infrastructure or application). During the events onboarding, Dynatrace will (by default) create few resources:

  • An EventBridge rule which registers events pattern(s) that will be attached to the default EventBridge bus.
  • An API destination which acts as the rule destination.
  • A connection to the Dynatrace API destination, from AWS to the Dynatrace platform.

Onboard Amazon EventBridge events

AWS Organizations

For AWS Organizations member accounts—do not update the CFN stack directly. Such an update should be carried out by the AWS Organizations delegated admin.

While creating a new connection:

  1. At the CloudFormation deployment step, find the Event ingest parameter section.
  2. Set the Enable events ingest parameter to TRUE.
  3. Set the Regions to ingest events from.
  4. Set (or keep the default) Amazon EventBridge bus name. You can create you own EventBridge bus to replace the default.
  5. Set (or keep just the aws.health) EventBridge sources list. For example, add a comma-separated list of event sources: aws.health, aws.ec2, and so on.

For an existing AWS connection:

  1. Go to the AWS CloudFormation console and locate the primary CloudFormation stack (the name follows the connection name, for example MyProd3East).
  2. Initiate a stack update.
  3. Use Existing Stack.
  4. Set the Enable events ingest parameter to TRUE.
  5. Set the Regions to ingest events from.
  6. Set (or keep the default) Amazon EventBridge bus name. You can create you own EventBridge bus to replace the default.
  7. Set (or keep just the aws.health) EventBridge sources list. For example, add a comma-separated list of event sources: aws.health, aws.ec2, and so on.
  8. Start the update.

Modify or remove Amazon EventBridge events configuration

You might want to modify/remove EventBridge events ingest or add/remove AWS Regions.

  1. Go to the AWS CloudFormation console and locate the primary CloudFormation stack (the name follows the connection name, for example MyProd3East).

  2. Initiate a stack update.

  3. Use Existing Stack.

  4. In Parameters > Events ingest, set the Enable events ingest parameter to TRUE Or FALSE.

    If set to TRUE modify the Regions to ingest events from (comma-separated) and/or the EventBridge sources list (comma-separated).

  5. Start the update.

type of event sources

It is possible to include any type of event sources even custom event sources that may be created to support custom event-driven use-cases.

Events workflow logic

When the rule is triggered, events will be published to the Dynatrace platform purpose-built event ingest API (API destination). Event records will follow the below Dynatrace platform logic:

  • All successfully published events—which do not include any Amazon Resource Name (ARN) name of the affected resource(s)—are designed to be linked to the AWS Account entity (node).
  • All successfully published events—with their payload containing any AWS resource Amazon Resource Name (ARN) name(s) of the affected resource(s)—are designed to be linked to the respective entities (nodes).
Events in context

Successfully linking the EventBridge events to any entity (node) enables signals in context, allowing to query the events (using DQL) and view their affected AWS resources or originating AWS account source.

Where to find the events in Dynatrace?

Native event

An event for which the Dynatrace platform is able to link to the relevant affected AWS resource entity (node).

Generic event

An event for which the Dynatrace platform is not able to link to the relevant affected AWS resource entity (node), and is only able to link it to the AWS account entity (node).

From any notebook use this simple DQL:

fetch events
| filter dt.da.source == "aws-event-ingest"

EventBridge event examples

AWS health event with affected ARN resource (native event)

{
    "version": "0",
    "id": "121345678-1234-1234-1234-123456789012",
    "detail-type": "AWS Health Event",
    "source": "aws.health",
    "account": "123456789012",
    "time": "2026-01-01T00:00:00Z",
    "region": "us-west-2",
    "resources": [
        "i-1234567890abcdef0"
    ],
    "detail": {
        "eventArn": "arn:aws:health:us-west-2::event/AWS_EC2_INSTANCE_STORE_DRIVE_PERFORMANCE_DEGRADED_90353408594353980",
        "service": "EC2",
        "eventTypeCode": "AWS_EC2_INSTANCE_STORE_DRIVE_PERFORMANCE_DEGRADED",
        "eventTypeCategory": "issue",
        "eventScopeCode": "ACCOUNT_SPECIFIC",
        "communicationId": "01b0993207d81a09dcd552ebd1e633e36cf1f09a-1",
        "startTime": "Thu, 1 Jan 2026 00:00:00 GMT",
        "endTime": "Thu, 1 Jan 2022 01:00:00 GMT",
        "statusCode": "open",
        "eventRegion": "us-east-1",
        "eventDescription": [{
            "language": "en_US",
            "latestDescription": "A description of the event will be provided here"
        }],
        "affectedEntities": [{
            "entityValue": "i-1234567890abcdef0"
        }],
        "page": "1",
        "totalPages": "1",
        "backupEvent": "true",
        "affectedAccount": "111111111111"
    }
}
event affected resource and origin are different

The event will be linked to the EC2 instance ID: i-1234567890abcdef0 entity (node) which resides inside the AWS Account ID: 111111111111, AWS Region: us-east-1.

The event originated from the AWS Account ID: 123456789012, AWS Region: us-west-2.

The event linking will only be possible if AWS Account ID: 111111111111 has been successfully onboarded as an AWS connection and the topology service is active.

AWS health event with no affected ARN resource (generic event)

{
    "version": "0",
    "id": "121345678-1234-1234-1234-123456789012",
    "detail-type": "AWS Health Event",
    "source": "aws.health",
    "account": "123456789012",
    "time": "2026-01-01T00:00:00Z",
    "region": "us-west-2",
    "resources": [],
    "detail": {
        "eventArn": "arn:aws:health:ap-southeast-2::event/AWS_ELASTICLOADBALANCING_API_ISSUE_90353408594353980",
        "service": "ELASTICLOADBALANCING",
        "eventTypeCode": "AWS_ELASTICLOADBALANCING_API_ISSUE",
        "eventTypeCategory": "issue",
        "eventScopeCode": "ACCOUNT_SPECIFIC",
        "communicationId": "01b0993207d81a09dcd552ebd1e633e36cf1f09a-1",
        "startTime": "Thu, 1 Jan 2026 00:00:00 GMT",
        "endTime": "Thu, 1 Jan 2026 01:00:00 GMT",
        "statusCode": "open",
        "eventRegion": "us-east-1",
        "eventDescription": [{
            "language": "en_US",
            "latestDescription": "A description of the event will be provided here"
        }],
        "page": "1",
        "totalPages": "1",
        "backupEvent": "true",
        "affectedAccount": "111111111111"
    }
}
event affected resource and origin are different

The event will be linked to the AWS Account ID: 111111111111 entity (node). No affected resource.

The event originated from AWS Account ID: 123456789012, AWS Region: us-west-2.

The event linking will only be possible if AWS Account ID: 111111111111 has been successfully onboarded as an AWS connection and the topology service is active.

AWS EC2 event with affected ARN resource (native event)

{
    {
    "version": "0",
    "id": "12345678-1234-1234-1234-123456789012",
    "detail-type": "EC2 Instance Rebalance Recommendation",
    "source": "aws.ec2",
    "account": "123456789012",
    "time": "2026-01-01T00:00:00Z",
    "region": "us-east-2",
    "resources": ["arn:aws:ec2:us-east-2:123456789012:instance/i-1234567890abcdef0"],
    "detail": {
        "instance-id": "i-1234567890abcdef0"
    }
}
What if an event affected resource and origin are the same?

The event will be linked to an EC2 instance ID: i-1234567890abcdef0 entity (node) which resides inside the AWS Account ID: 123456789012, AWS Region: us-east-2.

The event originated from AWS Account ID: 123456789012, AWS Region us-east-2.

The event linking will only be possible if AWS Account ID: 123456789012 has been successfully onboarded as an AWS connection and the topology service is active.

Related tags
Infrastructure Observability