AWS EventBridge Integration

Kloudfuse integrates with AWS EventBridge to receive real-time events from AWS services, SaaS connectors, and your own applications.

Overview

AWS EventBridge is a serverless event bus that routes events from sources to targets based on rules you define. When an event matches a rule’s pattern, EventBridge delivers it to the configured target — in this case, the Kloudfuse ingestion endpoint.

When to Use EventBridge

EventBridge and CloudWatch Logs serve different purposes. Use EventBridge when you need:

  • Real-time event routing — EventBridge delivers events as they occur, without batching delays.

  • Custom event patterns — route only events matching a specific structure (for example, only EC2 instance state changes to stopped).

  • Cross-account or cross-region events — EventBridge natively supports event routing across AWS accounts and regions.

  • SaaS integrations — EventBridge can receive events from third-party SaaS providers (Zendesk, PagerDuty, Salesforce, and others).

  • Custom application events — your applications can publish custom events to EventBridge and have them appear in Kloudfuse.

Use CloudWatch Logs instead when you need bulk ingestion of log streams or when the source service writes to CloudWatch rather than EventBridge.

Architecture

Event Source (AWS service, SaaS, or custom app)
  → EventBridge Event Bus
    → EventBridge Rule (event pattern filter)
      → EventBridge API Destination
        → Kloudfuse Ingestion Endpoint

An API Destination is an EventBridge concept that represents an HTTP endpoint with authentication. Kloudfuse uses API key authentication for this connection.

Prerequisites

  • A running Kloudfuse installation with an externally reachable HTTPS ingestion endpoint.

  • An API key for authenticating EventBridge to Kloudfuse. Contact your Kloudfuse administrator for the API key value.

Step 1: Create an EventBridge Connection

An EventBridge Connection stores the authentication credentials for the Kloudfuse endpoint.

aws events create-connection \
  --name kloudfuse-connection \
  --authorization-type API_KEY \
  --auth-parameters '{
    "ApiKeyAuthParameters": {
      "ApiKeyName": "Authorization",
      "ApiKeyValue": "<kloudfuse-api-key>"
    }
  }'
bash

Note the ConnectionArn in the response — you will need it in the next step.

Step 2: Create an API Destination

The API Destination defines the Kloudfuse endpoint that EventBridge will call.

CONNECTION_ARN=$(aws events describe-connection \
  --name kloudfuse-connection \
  --query 'ConnectionArn' \
  --output text)

aws events create-api-destination \
  --name kloudfuse-destination \
  --connection-arn "$CONNECTION_ARN" \
  --invocation-endpoint "https://<kloudfuse-ingester-host>/ingester/eventbridge" \
  --http-method POST \
  --invocation-rate-limit-per-second 300
bash

Step 3: Create an EventBridge Rule

A rule defines which events to forward. The example below forwards all EC2 instance state change events.

First, create an IAM role that allows EventBridge to invoke the API Destination:

cat > eventbridge-trust-policy.json <<'EOF'
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": {"Service": "events.amazonaws.com"},
    "Action": "sts:AssumeRole"
  }]
}
EOF

aws iam create-role \
  --role-name EventBridgeKloudfuseRole \
  --assume-role-policy-document file://eventbridge-trust-policy.json

DESTINATION_ARN=$(aws events describe-api-destination \
  --name kloudfuse-destination \
  --query 'ApiDestinationArn' \
  --output text)

aws iam put-role-policy \
  --role-name EventBridgeKloudfuseRole \
  --policy-name InvokeApiDestination \
  --policy-document "{
    \"Version\": \"2012-10-17\",
    \"Statement\": [{
      \"Effect\": \"Allow\",
      \"Action\": \"events:InvokeApiDestination\",
      \"Resource\": \"$DESTINATION_ARN\"
    }]
  }"
bash

Create the rule:

ROLE_ARN=$(aws iam get-role \
  --role-name EventBridgeKloudfuseRole \
  --query 'Role.Arn' \
  --output text)

aws events put-rule \
  --name kloudfuse-ec2-state-changes \
  --event-pattern '{
    "source": ["aws.ec2"],
    "detail-type": ["EC2 Instance State-change Notification"]
  }' \
  --state ENABLED

aws events put-targets \
  --rule kloudfuse-ec2-state-changes \
  --targets "[{
    \"Id\": \"kloudfuse\",
    \"Arn\": \"$DESTINATION_ARN\",
    \"RoleArn\": \"$ROLE_ARN\"
  }]"
bash

To forward a different event type, modify the --event-pattern. See the EventBridge event pattern reference for pattern syntax.

Verify the Integration

Confirm the Rule and Target

aws events list-targets-by-rule \
  --rule kloudfuse-ec2-state-changes \
  --query 'Targets[*].{Id:Id,Arn:Arn}'
bash

Confirm Events are Arriving in Kloudfuse

  1. Trigger an event that matches your rule — for example, start or stop an EC2 instance to fire an EC2 state-change event.

  2. In the Kloudfuse UI, click the Logs tab and select Search from the drop-down.

  3. Set the time picker to the last 15 minutes.

  4. In the search bar, click Advanced Search and enter the following FuseQL query:

    source="eventbridge"
    fuseql

    The event should appear within seconds of being generated.

  5. To filter by a specific event type, query by detail-type:

    source="eventbridge" and detail-type="EC2 Instance State-change Notification"
    fuseql

  6. To count events by source over time:

    source="eventbridge" | count by source
    fuseql

Check EventBridge Delivery Metrics

aws cloudwatch get-metric-statistics \
  --namespace AWS/Events \
  --metric-name SuccessfulInvocations \
  --dimensions Name=RuleName,Value=kloudfuse-ec2-state-changes \
  --start-time "$(date -u -v-1H +%Y-%m-%dT%H:%M:%SZ)" \
  --end-time "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
  --period 300 \
  --statistics Sum
bash

SuccessfulInvocations should be greater than zero after a matching event is triggered. If you see FailedInvocations, check the API Destination URL and API key configuration.