AWS EventBridge ExecModule

Overview

AwsEventBridgeModule brings governed event routing into ValkyrAI workflows. It covers the highest-value Amazon EventBridge event-bus surface: bounded custom-event publication, event-bus and rule discovery, rule creation and deletion, target attachment and removal, and event-pattern testing. It uses the native map ABI, annotation-backed Workflow Studio discovery, and a verified IntegrationAccount rather than accepting credentials in workflow input.

The connector implements ten operations:

• put_events submits one to ten custom events in one provider request.
• list_event_buses, list_rules, and list_targets provide bounded opaque-token pagination.
• describe_rule returns one normalized rule without echoing unbounded provider data.
• put_rule creates or replaces a rule with an event pattern, schedule, or both.
• delete_rule permanently deletes a rule after explicit confirmation.
• put_targets adds or updates up to five rule targets.
• remove_targets removes selected targets after explicit confirmation.
• test_event_pattern evaluates a JSON event against a JSON pattern without changing routing state.

This capability complements n8n's event-driven AWS workflow model and ValkyrAI's AWS Lambda, SNS, and SQS connectors. It adds a native EventBridge control surface with stricter account binding, payload bounds, operation-specific fields, replay boundaries, destructive confirmations, and redacted output.

Usage

1. Choose the AWS account, region, event bus, rules, and targets the workflow is allowed to use.
2. Create a least-privilege IAM principal restricted to only those EventBridge actions and resources.
3. Store its access key ID and secret access key in an AWS IntegrationAccount; verify it and keep it in READY status.
4. Add AwsEventBridgeModule to the workflow and bind that account through ExecModuleConfig.authConfig.integrationAccount.
5. Choose one operation and supply only that operation's documented fields. Unexpected fields fail before provider access.
6. Put approval and exact-resource reconciliation around event publishing and every rule or target mutation.

Never place AWS access keys or session tokens in module input. Credential-shaped fields are rejected before any EventBridge request.

Inputs

Name	Type	Required for	Default	Constraints
operation	string	Every execution	None	One of the ten documented operations.
region	string	Every execution	None	AWS region such as us-west-2; custom endpoints are not accepted.
eventBusName	string	Optional bus-scoped operations	default	Event-bus name or ARN, at most 1,600 characters.
namePrefix	string	Optional bus/rule list filter	None	Bounded EventBridge name characters.
ruleName	string	Rule and target operations	None	1-64 letters, digits, dots, underscores, or hyphens.
description	string	Optional put_rule field	None	At most 512 characters; no control characters.
eventPattern	object or JSON string	test_event_pattern; optional put_rule	None	Must normalize to a JSON object and remain within 4,096 UTF-8 bytes.
event	object or JSON string	test_event_pattern	None	Must normalize to a JSON object within 256 KiB.
scheduleExpression	string	Optional put_rule field	None	Bounded rate(...) or cron(...) expression.
state	string	Optional put_rule field	enabled	enabled or disabled.
roleArn	string	Optional put_rule field	None	Valid bounded IAM role ARN.
entries	array	put_events	None	One to ten event objects.
targets	array	put_targets	None	One to five unique target objects.
targetIds	array	remove_targets	None	One to five unique target IDs.
paginationToken	string	Optional list field	None	Opaque provider token, at most 4,096 characters.
limit	integer	Optional list field	100	From 1 through 1,000 total returned items.
returnAll	boolean	Optional list field	false	Follow provider pages until limit or exhaustion.
force	boolean	Optional delete/remove field	false	Passes the provider force flag for managed resources.
confirmDelete	boolean	delete_rule	false	Must be exactly true.
confirmRemove	boolean	remove_targets	false	Must be exactly true.

Each entries item accepts:

Field	Required	Constraints
source	Yes	1-256 EventBridge source characters.
detailType	Yes	Non-blank, at most 128 characters.
detail	Yes	JSON value, serialized and bounded within the 256 KiB entry envelope.
resources	No	At most ten bounded resource references.
time	No	ISO-8601 instant such as 2026-09-06T08:00:00Z.
traceHeader	No	Bounded AWS trace header.

Each targets item accepts unique id, required arn, optional roleArn, and either constant JSON input or a dot-notation inputPath such as $.detail. Constant input and input path are mutually exclusive. The connector intentionally omits service-specific target parameter trees; use a narrower reviewed extension when ECS, Batch, Kinesis, SQS message-group, Redshift, SageMaker, or API Gateway parameters are required.

Outputs

Every execution returns stable status, operation, and attempts fields.

Name	Type	When present	Description
status	string	Always	success or error.
operation	string	Always	Normalized operation.
attempts	integer	Always	Provider calls including pages and retry-safe reads.
resultType	string	Success	events, event_buses, rules, rule, targets, or event_pattern.
items	array	List success	Bounded normalized buses, rules, or targets.
count	integer	List success	Returned item count.
hasMore	boolean	List success	Whether EventBridge returned another page token.
paginationToken	string	Another page exists	Opaque provider continuation token.
data	object	Non-list success	Normalized acceptance, rule, target, or match result.
requestId	string	AWS supplies one	Bounded provider reference for reconciliation.
error	object	Failure	Safe {code, message, httpStatus?, retryable} details.

put_events, put_targets, and remove_targets can return provider-level partial failures. Their result reports requested or accepted counts, failedEntryCount, partialFailure, and bounded entry identifiers/error codes. Event detail, target constant input, and provider error messages are never copied into output.

IntegrationAccount Requirements

Bind one AWS IntegrationAccount through the normalized ExecModule authentication relationship:

Field	Requirement
Provider	Amazon Web Services / EventBridge
status	Must be READY.
verified	Must be true.
apiKey SecureField	AWS access key ID.
password SecureField	AWS secret access key.

Grant only the actions enabled for the workflow:

• Event publication and validation: events:PutEvents and events:TestEventPattern.
• Discovery: events:ListEventBuses, events:ListRules, events:DescribeRule, and events:ListTargetsByRule.
• Rule lifecycle: events:PutRule and events:DeleteRule.
• Target lifecycle: events:PutTargets and events:RemoveTargets.
• IAM: iam:PassRole only for the specific role ARNs a rule or target must assume.

Restrict resources to exact event buses and rules wherever the AWS action supports resource-level permissions. The current connector supports a long-lived access-key pair. Temporary session credentials, STS role assumption, workload identity, custom endpoints, and multi-account credential chaining are deferred.

Configuration

The awsAccount relationship is the only credential configuration. Region, bus, operation, and routing fields belong in mapped input or module parameters.

{
  "version": "1.0.0",
  "authConfig": {
    "authStrategy": 1,
    "integrationAccount": "integration-account:aws-eventbridge-production"
  },
  "payloadConfig": {
    "parameters": "{\"operation\":\"put_events\",\"region\":\"us-west-2\",\"eventBusName\":\"business-events\"}"
  }
}

The relationship value is illustrative. Persisted workflows bind the generated IntegrationAccount relationship, never plaintext credentials.

Operations

Operation	Provider behavior	Side effect and retry behavior
put_events	Submits one batch of up to ten events.	External side effect, one provider attempt, no automatic replay.
list_event_buses	Lists bounded event-bus metadata.	Read-only; each page retries transient failures up to three attempts.
list_rules	Lists bounded rules for the selected bus.	Read-only; bounded pagination and retry.
describe_rule	Reads one exact rule.	Read-only; bounded retry.
put_rule	Creates or replaces the named rule definition.	Single attempt; omitted fields can clear prior provider state. Reconcile by exact name before replay.
delete_rule	Permanently deletes one rule after confirmation.	Destructive, single attempt; targets normally must be removed first.
list_targets	Lists bounded targets for one rule.	Read-only; bounded pagination and retry.
put_targets	Adds or replaces up to five selected targets.	Single attempt; partial provider failures are surfaced.
remove_targets	Removes selected targets after confirmation.	Destructive, single attempt; partial provider failures are surfaced.
test_event_pattern	Tests one JSON event against one pattern.	Read-only; bounded retry.

Errors and Failure Modes

Code	Typical cause	Retryable	Resolution
VALIDATION_ERROR	Missing/malformed region, JSON, bus, rule, event, target, pagination value, confirmation, or unexpected operation field.	No	Correct the named input; no provider request was sent.
UNSUPPORTED_OPERATION	Unknown operation.	No	Select a documented operation.
INTEGRATION_ACCOUNT_ERROR	Account missing, unverified, not READY, or missing key material.	No	Repair and bind the AWS account.
AWS_EVENTBRIDGE_HTTP_400	Invalid event pattern, target, schedule, resource state, managed rule, or provider quota.	Usually no	Inspect the exact operation and resource state before changing input.
AWS_EVENTBRIDGE_HTTP_403	IAM denies the action, bus, rule, target, or iam:PassRole.	No	Grant only the missing permission under the intended conditions.
AWS_EVENTBRIDGE_HTTP_404	Referenced bus, rule, or target no longer exists.	No	Reconcile the exact resource before creating or stopping.
AWS_EVENTBRIDGE_HTTP_429 / 500 / 503	Throttle, concurrent modification, or transient provider pressure.	Reads retry; writes report ambiguity	Inspect provider state and request evidence before any replay.
NETWORK_ERROR	DNS, TLS, timeout, or connectivity failure.	Reads retry; writes report ambiguity	Treat publication or mutation acceptance as unknown until reconciled.
EXECUTION_ERROR	Unexpected bounded runtime failure.	No automatic replay	Preserve operation and request evidence for investigation.

Provider exception text is never copied into workflow output, preventing event contents, target input, credentials, or unbounded provider payloads from leaking through errors.

Example

Publish an approved order event to a custom bus:

{
  "operation": "put_events",
  "region": "us-west-2",
  "eventBusName": "business-events",
  "entries": [
    {
      "source": "com.valkyrlabs.orders",
      "detailType": "OrderApproved",
      "detail": {
        "orderId": "A-1042",
        "approved": true,
        "riskTier": "reviewed"
      },
      "resources": [
        "arn:aws:orders:us-west-2:123456789012:order/A-1042"
      ],
      "time": "2026-09-06T08:00:00Z"
    }
  ]
}

Expected result shape:

{
  "status": "success",
  "operation": "put_events",
  "attempts": 1,
  "resultType": "events",
  "data": {
    "acceptedCount": 1,
    "failedEntryCount": 0,
    "partialFailure": false,
    "entries": [
      {"index": 0, "eventId": "provider-event-id"}
    ]
  },
  "requestId": "aws-request-reference"
}

The receipt means EventBridge accepted the event entry; it does not prove that a rule matched it or that every downstream target completed. Correlate target-specific telemetry and dead-letter delivery outside this connector.

Notes

• Pagination: bus, rule, and target lists return one page unless returnAll=true; the connector follows opaque tokens with unchanged filters and stops at limit.
• Rate limits: quotas vary by region, account, action, and target. Read calls use at most three attempts with short bounded backoff. Publications and mutations never retry automatically.
• API limits: the connector caps event batches at ten, targets at five, list output at 1,000, event entries at 256 KiB, rule patterns at 4,096 bytes, and constant target input at 8,192 bytes.
• Idempotency: discovery and pattern tests are replay-safe. put_events, put_rule, delete_rule, put_targets, and remove_targets can have side effects and are single-attempt.
• Partial failure: EventBridge may accept some event or target entries while rejecting others. Inspect per-entry identifiers/error codes and reconcile accepted resources before submitting a narrowed recovery request.
• Rule replacement: put_rule replaces omitted provider fields with null rather than preserving the previous definition. Read the current rule and submit the complete intended state.
• Eventual consistency: new or changed rules and targets can require a short propagation period before matching or invocation reflects the update.
• Managed rules: AWS-managed rules reject ordinary changes; force is exposed only for explicitly confirmed cleanup operations.
• Destructive behavior: delete_rule and remove_targets require explicit confirmation. Deleting a rule normally requires target removal first.
• Target delivery: target invocation, retry, age limits, IAM role assumption, dead-letter queues, and downstream success are separate from API acceptance.
• Security: event detail and target input can contain confidential data. The connector does not echo them, and workflows must retain ACL-scoped output and logs.
• Deferred operations: event-bus create/update/delete, archives/replays, schema registry, partner event sources, API destinations, connections, permissions, tags, global endpoints, pipes, scheduler resources, input transformers, dead-letter/retry configuration, and service-specific target parameter trees are not implemented.
• Provider verification boundary: deterministic tests cover validation, JSON normalization, pagination, rule/target operation families, retry boundaries, destructive confirmations, credential/provider-error redaction, registration, and metadata. Live EventBridge behavior remains unverified until an authorized AWS account and reviewed non-production bus/rules/targets are supplied.
• Functional reference: n8n demonstrates broad AWS workflow composition through service nodes and generic authenticated requests. ValkyrAI adds a native EventBridge module focused on the event-bus API, with stronger account, scope, output, replay, and deletion controls.
• Runtime boundary: merged source and published documentation do not update the deployed Workflow Studio catalog until a ValkyrAI backend release exposes AwsEventBridgeModule through /v1/modules/metadata.

Related Documentation

• ExecModule catalog
• AWS Lambda ExecModule
• AWS SNS ExecModule
• AWS SQS ExecModule
• n8n AWS workflow integrations
• Amazon EventBridge API
• Integration Account Console