Instiq
Chapter 5 · Incident and Event Response·v2.0.0·Updated 6/3/2026·~10 min

What's changed: Deepened DOP-C02 Chapter 5 (added comparison tables, scenarios, FAQs, exam traps, deep-dive paragraphs to each section; localized figures to Japanese)

5.1Event-Driven Automation

Key points

Understand automated responses to events—EventBridge (rules/targets), CloudWatch alarms, EventBridge Scheduler, and SNS/SQS. Trigger actions automatically on state changes.

Incident response starts with detecting events. EventBridge and alarms receive events and trigger actions automatically.

5.1.1Routing events

Diagram of event-driven automation: AWS service state changes (EC2 state transitions, Config rule violations, GuardDuty findings, CodePipeline failures, etc.) arrive at EventBridge as events; rules match patterns and route events to targets (Lambda, SSM Automation, Step Functions, SNS) for automated response; EventBridge Scheduler handles scheduled runs, SNS handles notifications, and SQS buffers.
Event routing with EventBridge
  • EventBridge: filter AWS service state-change events with rules and route to targets.
  • Targets: automate via Lambda / SSM Automation / Step Functions / SNS, etc.
  • EventBridge Scheduler: schedule recurring runs via cron/rate expressions.
  • SNS/SQS: SNS = notification fan-out, SQS = buffering/retries for decoupled processing.
Exam point

Common on DOP-C02: react to service state changes = EventBridge rules, scheduled runs = EventBridge Scheduler (or CloudWatch Events rules), automation targets = Lambda/SSM Automation/Step Functions. A classic pattern routes GuardDuty/Config/CodePipeline findings via EventBridge to automated responses.

Continue reading — free sign-up

You're reading the free preview. Sign up free to read this section in full, plus every chapter (including 4+) and all questions.

Get started freeLog in