Amazon EventBridge input transformation

aws.events.rule-arn — The Amazon Resource Name (ARN) of the EventBridge rule.

aws.events.rule-name — The Name of the EventBridge rule.

aws.events.event.ingestion-time — The time at which the event was received by EventBridge. This is an ISO 8601 timestamp. This variable is generated by EventBridge and can't be overwritten.

aws.events.event — The original event payload as JSON (without the detail field). Can only be used as a value for a JSON field, as it's contents are not escaped.

aws.events.event.json — The full original event payload as JSON. (with the detail field). Can only be used as a value for a JSON field, as it's contents are not escaped.

For Strings, quotes are required.

There is no validation when creating JSON path for your template.

If you specify a variable to match a JSON path that doesn't exist in the event, that variable isn't created and won't appear in the output.

JSON properties like aws.events.event.json can only be used as the value of a JSON field, not inline in other strings.

EventBridge doesn't escape values extracted by Input Path, when populating the Input Template for a target.

If a JSON path references a JSON object or array, but the variable is referenced in a string, EventBridge removes any internal quotes to ensure a valid string. For example, for a variable <detail> pointed at $.detail, "Detail is <detail>" would result in EventBridge removing quotes from the object.

Therefore, if you want to output a JSON object based on a single JSON path variable, you must place it as a key. In this example, {"detail": <detail>}.

Quotes are not required for variables that represent strings. They are permitted, but EventBridge automatically adds quotes to string variable values during transformation, to ensure the transformation output is valid JSON. EventBridge does not add quotes to variables that represent JSON objects or arrays. Do not add quotes for variables that represent JSON objects or arrays.

For example, the following input template includes variables that represent both strings and JSON objects:

{
  "ruleArn" : <aws.events.rule-arn>,
  "ruleName" : <aws.events.rule-name>,
  "originalEvent" : <aws.events.event.json>
}

Resulting in valid JSON with proper quotation:

{
  "ruleArn" : "arn:aws:events:us-east-2:123456789012:rule/example",
  "ruleName" : "example",
  "originalEvent" : {
    ... // commented for brevity
  }
}

For (non-JSON) text output as multi-line strings, wrap each separate line in your input template in double quotes.

For example, if you were matching Amazon Inspector Finding events against the following event pattern:

{
  "detail": {
    "severity": ["HIGH"],
    "status": ["ACTIVE"]
  },
  "detail-type": ["Inspector2 Finding"],
  "source": ["inspector2"]
}

And using the following input path:

{
  "account": "$.detail.awsAccountId",
  "ami": "$.detail.resources[0].details.awsEc2Instance.imageId",
  "arn": "$.detail.findingArn",
  "description": "$.detail.description",
  "instance": "$.detail.resources[0].id",
  "platform": "$.detail.resources[0].details.awsEc2Instance.platform",
  "region": "$.detail.resources[0].region",
  "severity": "$.detail.severity",
  "time": "$.time",
  "title": "$.detail.title",
  "type": "$.detail.type"
}

You could use the input template below to generate multi-line string output:

"<severity> severity finding <title>"
"Description: <description>"
"ARN: \"<arn>\""
"Type: <type>"
"AWS Account: <account>"
"Region: <region>"
"EC2 Instance: <instance>"
"Platform: <platform>"
"AMI: <ami>"