Transform an EventBridge Event Before It Reaches Amazon SQS

Introduction

Hi, I'm miruky.

An EventBridge rule normally forwards its matching event to a target. An input transformer changes that behavior: JSONPath variables select values from the original event, and an input template builds the payload that the target receives instead.

This Console run first sends a deliberately nonmatching control event, then sends one matching synthetic order event to a Standard SQS queue. The matching source event contains orderId, total, and an unwanted customerNote; the queue receives only the order ID, total, EventBridge timestamp, and a fixed source label.

The exercise uses two custom events and a small number of SQS requests. Check the linked EventBridge and SQS pricing pages for current rates and free-tier terms before running it.

1. Create an event bus and a queue

The run uses the English AWS Console and keeps EventBridge, SQS, and every validation action in us-east-1.

The header confirms United States (N. Virginia) while the EventBridge Console is in English. This fixes the Region shared by the bus, rule, and queue.

Open Amazon EventBridge, choose Event buses, and search for miruky-lddnesdcjdgblgrp. An exact-name result should not exist before creation.

The exact filter for miruky-lddnesdcjdgblgrp returns no event bus. That empty result establishes the resource boundary before creation.

Choose Create event bus and enter miruky-lddnesdcjdgblgrp. Keep Use AWS owned key, leave every optional log destination unselected, and keep the Archives toggle off. Do not add a resource policy, schema discovery, or tags for this short run.

The form shows miruky-lddnesdcjdgblgrp, the AWS owned key, no selected log destination, and the archive toggle off. Only the custom bus is created in this step.

In Amazon SQS, search for the exact name miruky-gqnaikvhwcffylgd and stop if it already exists. Otherwise, create a Standard queue with that name. For this short run of synthetic, non-sensitive data, disable the default SQS-managed server-side encryption. EventBridge does not support an SQS target encrypted with an AWS owned key. Leave the remaining delivery settings at their defaults.

The queue form pairs Standard with miruky-gqnaikvhwcffylgd and shows server-side encryption disabled. No delivery-setting override or dead-letter queue is added. This is an exercise boundary, not a production recommendation. For an encrypted production target, use a customer managed KMS key and grant EventBridge the required KMS permissions.

2. Build the rule and its input transformer

Return to EventBridge and choose Create rule on miruky-lddnesdcjdgblgrp. The current Console offers an Enhanced builder and an Advanced builder. Choose Advanced builder, enter miruky-imfnycrrfauwoztn, and confirm the custom event bus. In Build event pattern, choose Other and use this pattern:

{
  "source": ["demo.orders"],
  "detail-type": ["OrderCreated"]
}

The rule accepts only the fixed source and detail type used in this run. It does not inspect the individual fields inside detail.

The rule builder shows miruky-lddnesdcjdgblgrp, demo.orders, and OrderCreated together. The pattern is limited to the fixed source and detail type.

For the target, choose AWS service, SQS queue, and miruky-gqnaikvhwcffylgd. The current target widget creates an IAM execution role with narrowly scoped permission to send to the selected queue. It does not expose a role-name field, so the Console-generated name differs on every run. I left the queue access policy unchanged and used this execution-role path.

The Execution role block confirms that EventBridge has an identity-based path to call SQS. The cropped image excludes role and queue ARNs as well as account-specific identifiers.

Under Additional settings, choose Input transformer. For the optional sample event, I used the matching synthetic event shown later in this article. Then define these variables:

{
  "orderId": "$.detail.orderId",
  "time": "$.time",
  "total": "$.detail.total"
}

Use the variables in this input template. The angle-bracket tokens are EventBridge placeholders. Quote placeholders that must remain JSON strings; leave the numeric placeholder unquoted:

{
  "event_time": "<time>",
  "id": "<orderId>",
  "amount": <total>,
  "source": "eventbridge"
}

The preview keeps time and orderId as strings and total as a number. No JSONPath points to customerNote, the original event object, the account attribute, or the Region value.

The preview contains event_time, id, amount, and source after applying the three JSONPath variables. It contains no customerNote field or original event envelope.

Finish the wizard and open the rule. Confirm that it is enabled, belongs to the custom bus, and lists the generated SQS queue as its target.

The rule details show Enabled, miruky-lddnesdcjdgblgrp, and miruky-gqnaikvhwcffylgd. Account-scoped resource identifiers are excluded from the view.

3. Prove that a nonmatching source does not reach SQS

Give a new or updated EventBridge target a short period to propagate. From Event buses, open the actions for miruky-lddnesdcjdgblgrp and choose Send events. Enter source demo.orders.unmatched, detail type OrderCreated, and this event detail:

{
  "orderId": "order-control",
  "total": 1,
  "customerNote": "do-not-forward"
}

The source string is intentionally different from the rule's exact demo.orders value. The detail type and JSON shape remain valid, which isolates the event-pattern decision to that one field.

The form shows demo.orders.unmatched, OrderCreated, and the synthetic control detail. The source value cannot satisfy the rule's exact demo.orders array entry.

Choose Send and wait for the ingestion confirmation. EventBridge can accept an event on the custom bus even when none of that bus's rules match it.

The Console reports that the control event was sent successfully to miruky-lddnesdcjdgblgrp. That confirmation proves ingestion only; it does not claim that the SQS target ran.

Wait 60 seconds, then open the queue's Send and receive messages page. Set the polling duration to 20 seconds and complete two polls. The queue started empty, so both polls should return no message for this source value. A single immediate empty response would be weaker evidence because delivery and Console updates are asynchronous.

Both long polls return no available message after the accepted control event. Together with EventBridge's exact string matching, the result establishes the controlled failure: the event reached the bus, but the source mismatch prevented this rule from invoking SQS.

4. Send a matching event and inspect the transformed body

Return to Send events. Enter source demo.orders, detail type OrderCreated, and this event detail:

{
  "orderId": "order-001",
  "total": 42,
  "customerNote": "do-not-forward"
}

All three values are synthetic. The extra note provides a visible negative control: it belongs to the source event but should not cross the transformer boundary.

The form shows demo.orders, OrderCreated, order-001, 42, and do-not-forward. The unwanted note is present at the source boundary before transformation.

Choose Send and wait for the success confirmation. A successful PutEvents result means EventBridge accepted the event; the SQS receive is the separate delivery proof.

The Console reports that the event was sent successfully to miruky-lddnesdcjdgblgrp. This confirms ingestion, not delivery to SQS.

Open the SQS queue, choose Send and receive messages, and poll for messages. The delivered body should have exactly four top-level keys:

{
  "event_time": "EVENTBRIDGE_GENERATED_TIME",
  "id": "order-001",
  "amount": 42,
  "source": "eventbridge"
}

The observed event_time is an ISO 8601 value carried by the EventBridge event. Verify that the body does not contain customerNote, account, region, resources, detail-type, or the original EventBridge event ID.

The cropped body contains event_time, id, amount, and source, with order-001, 42, and eventbridge as the fixed values. It does not contain customerNote, do-not-forward, account, region, resources, or detail-type.

That body is the useful distinction: the rule matched the original event, but SQS received the template output instead of the complete envelope.

Wrap-up

The nonmatching control event reached the custom bus but produced no SQS message. The matching event carried three detail values plus the EventBridge envelope; the rule extracted orderId, total, and time, added a fixed source label, and delivered a four-key JSON body to SQS. The unwanted note and account-scoped envelope attributes never appeared in the target payload.

Input transformers are helpful when a target needs a small, stable contract rather than every field produced upstream. They do not validate missing JSONPath values when the rule is created, so the source shape and transformed output still need an end-to-end test like this one.

Thanks for reading this far.

See you in the next one.

Disclosure: This article was written with AI assistance and independently verified against the linked primary sources and observed results.

References

• Amazon EventBridge input transformation
• Configuring an input transformer when creating a rule
• Tutorial: Use input transformers to transform events in EventBridge
• Event pattern syntax
• Creating an event bus in Amazon EventBridge
• Event bus targets in Amazon EventBridge
• IAM roles for sending events to targets in Amazon EventBridge
• Creating rules using the Enhanced Builder
• Configuring SQS-managed server-side encryption
• Amazon EventBridge pricing
• Amazon SQS pricing