Amazon CloudWatch Events delivers a near real-time stream of system events that describe changes in Amazon Web Services resources. Using simple rules that you can quickly set up, you can match events and route them to one or more target functions or streams. CloudWatch Events becomes aware of operational changes as they occur. CloudWatch Events responds to these operational changes and takes corrective action as necessary, by sending messages to respond to the environment, activating functions, making changes, and capturing state information.
The Terraform resource aws_cloudwatch_event_target is the binding point between a CloudWatch Events rule, now known as an EventBridge rule, and the AWS resource that should receive matching events. The module that creates CloudWatch Events rules and according targets is commonly referenced in the terraform-aws-cloudwatch-events repository. The module creates CloudWatch Events rules and according targets and exposes outputs for rule ARN and rule name.
Core Resource Definition
The resource provides a CloudWatch Event Target resource. The declaration couples a rule name with an ARN of a target and optional configuration for the delivery.
Example usage from documentation:
hcl
resource "aws_cloudwatch_event_target" "yada" {
target_id = "Yada"
rule = "${aws_cloudwatch_event_rule.console.name}"
arn = "${aws_kinesis_stream.test_stream.arn}"
}
hcl
resource "aws_cloudwatch_event_rule" "console" {
name = "capture-ec2-scaling-events"
description = "Capture all EC2 scaling events"
event_pattern = <<PATTERN
{
"source": [
"aws.autoscaling"
],
"detail-type": [
"EC2 Instance Launch Successful",
"EC2 Instance Terminate Successful",
"EC2 Instance Launch Unsuccessful",
"EC2 Instance Terminate Unsuccessful"
]
}
PATTERN
}
hcl
resource "aws_kinesis_stream" "test_stream" {
name = "terraform-kinesis-test"
shard_count = 1
}
The rule is required and the target ARN is required. The target_id is optional and provides a unique target assignment ID.
Argument Reference and Constraints
Argument reference notes mutual exclusivity and permission requirements.
- Note: input and input_path are mutually exclusive options.
- Note: In order to be able to have your AWS Lambda function or SNS topic invoked by a CloudWatch Events rule, you must setup the right permissions using awslambdapermission or awssnstopic.policy.
- The functionality is identical for EventBridge rule invocation.
- Note: In order to be able to have your AWS Lambda function or SNS topic invoked by an EventBridge rule, you must set up the right permissions using awslambdapermission or awssnstopic_policy.
The following arguments are supported:
| Argument | Description | Required |
|---|---|---|
| rule | The name of the rule you want to add targets to | Required |
| target_id | The unique target assignment ID | Optional |
| arn | The Amazon Resource Name of the target | Required |
| input | Input to the target | Optional |
| input_path | Path to input | Optional |
| runcommandtargets | Configuration for SSM Run Command targets | Optional |
The module variable set includes:
| Variable | Description | Type | Default | Required |
|---|---|---|---|---|
| additionaltagmap | Additional key-value pairs to add to each map in tagsaslistofmaps. Not added to tags or id. This is for some rare cases where resources want additional configuration of tags and therefore take a list of maps with tag key, value, and additional configuration. | map(string) | {} | no |
| attributes | ID element. Additional attributes to add to id, in the order they appear in the list. | list(string) | [] | no |
| cloudwatcheventrule_description | The description of the rule | string | null | no |
| cloudwatcheventrule_pattern | The pattern of the rule | string | null | no |
| cloudwatcheventtarget_arn | The ARN of the target | string | null | no |
| environment | ID element. Environment | string | null | no |
| name | ID element. Usually the name of the resource | string | null | yes |
| namespace | ID element. Namespace | string | null | no |
| stage | ID element. Stage | string | null | no |
| tenant | ID element. A customer identifier, indicating who this instance of a resource is for | string | null | no |
Outputs from the module:
| Name | Description |
|---|---|
| awscloudwatcheventrulearn | The Amazon Resource Name of the rule |
| awscloudwatcheventruleid | The name of the rule |
Module Invocation Pattern
Here's how to invoke this example module in your projects:
hcl
module "cloudwatch_event" {
source = "cloudposse/cloudwatch-events/aws"
version = "0.7.0"
name = var.name
namespace = var.namespace
tenant = var.tenant
environment = var.environment
stage = var.stage
cloudwatch_event_rule_description = var.cloudwatch_event_rule_description
cloudwatch_event_rule_pattern = var.cloudwatch_event_rule_pattern_json
cloudwatch_event_target_arn = module.sns.sns_topic.arn
}
Important guidance from the module author:
In Cloud Posse's examples, we avoid pinning modules to specific versions to prevent discrepancies between the documentation and the latest released versions. However, for your own projects, we strongly advise pinning each module to the exact version you're using. This practice ensures the stability of your infrastructure.
Additionally, we recommend implementing a systematic approach for updating versions to avoid unexpected changes.
Available targets for the module:
- help Help screen
- help/all Display help for all targets
- help/short This help short screen
- lint Lint terraform code
Dependency versions:
| Name | Version |
|---|---|
| terraform | >= 0.13.0 |
| aws | >= 2.0 |
Module dependencies:
| Name | Source | Version |
|---|---|---|
| rule_label | cloudposse/label/null | 0.25.0 |
| this | cloudposse/label/null | 0.25.0 |
Resources created:
| Name | Type |
|---|---|
| awscloudwatchevent_rule.this | resource |
| awscloudwatchevent_target.this | resource |
SSM Run Command Target Configuration
The resource supports runcommandtargets blocks for Systems Manager Automation.
Example with runcommandtargets:
hcl
resource "aws_cloudwatch_event_target" "yada" {
target_id = "Yada"
rule = "${aws_cloudwatch_event_rule.console.name}"
arn = "${aws_kinesis_stream.test_stream.arn}"
run_command_targets {
key = "tag:Name"
values = ["FooBar"]
}
run_command_targets {
key = "InstanceIds"
values = ["i-162058cd308bffec2"]
}
}
An IAM role for SSM lifecycle is often paired with this pattern:
hcl
data "aws_iam_policy_document" "ssm_lifecycle_trust" {
statement {
actions = ["sts:AssumeRole"]
principals {
type = "Service"
identifiers = ["events.amazonaws.com"]
}
}
}
The trust policy allows events.amazonaws.com to assume the role. The permission document restricts ssm:SendCommand actions to specific resources and conditions.
Import Workflows
Importing existing targets is supported with a specific identifier format.
Using terraform import:
hcl
import {
to = aws_cloudwatch_event_target.example
id = "rule-name/target-id"
}
Command line import:
% terraform import aws_cloudwatch_event_target.example rule-name/target-id
For EventBridge targets, import EventBridge Targets using eventbusname/rule-name/target-id. If you omit eventbusname, the default event bus will be used.
Example:
% terraform import aws_cloudwatch_event_target.example rule-name/target-id
This import syntax allows migration of existing CloudWatch Events rules and targets into Terraform state without recreation.
Permission Requirements and Security Considerations
Invoking Lambda or SNS requires explicit permission resources.
- For Lambda: awslambdapermission must allow events.amazonaws.com to invoke the function.
- For SNS: awssnstopic.policy must allow EventBridge to publish.
More info here.
When using SSM Run Command targets, the IAM role assumed by EventBridge must have ssm:SendCommand permissions on the target instances and SSM documents. The example policy includes a condition:
hcl
condition {
test = "StringEquals"
variable = "ec2:ResourceTag/Terminate"
values = ["*"]
}
This demonstrates tag based scoping for automation.
Practical Composition Patterns
The module can be composed with other Cloud Posse modules.
Related projects:
- terraform-aws-sns-topic - Terraform Module to Provide an Amazon Simple Notification Service (SNS)
- terraform-aws-sns-cloudwatch-sns-alarms - Terraform module that configures CloudWatch SNS alerts for SNS
Use Cloud Posse's ready-to-go terraform architecture blueprints for AWS to get up and running quickly.
The module supports labeling through common variables:
- attributes
- additionaltagmap
- namespace
- tenant
- environment
- stage
- name
Tagging strategy is controlled via additionaltagmap and standard label inputs.
Conclusion
The aws_cloudwatch_event_target resource is the connective tissue between event matching and response action in AWS. Understanding the required rule reference, target ARN, and optional targetid is foundational, but operational reliability depends on correct permission wiring for Lambda, SNS, SSM, and Kinesis targets, proper import identifiers for state adoption, and disciplined version pinning when using the Cloud Posse cloudwatch-events module. The module abstraction adds naming conventions, tagging, and output exposure for rule ARN and rule ID, which simplifies multi-environment deployments. The presence of runcommandtargets enables direct automation via Systems Manager, requiring careful IAM trust and resource constraints to avoid over-privileged event driven commands. Import paths using rule-name/target-id and optional eventbus_name/rule-name/target-id ensure existing infrastructure can be brought under Terraform management without destructive recreation. With these patterns in place, teams can build near real-time reactive pipelines that route operational changes to corrective actions while maintaining stable, reproducible infrastructure.