Amazon CloudWatch Events
User Guide

Scenario 1: Log the State of an Amazon EC2 Instance

You can use a simple AWS Lambda function that logs the changes in state of an Amazon EC2 instance. You can choose to create a rule that runs whenever there is a state transition, or on a transition to one or more states that are of interest. In this scenario, you log the launch of any new Amazon EC2 instance.

Step 1: Create an AWS Lambda function

To create an AWS Lambda function

  1. Open the AWS Lambda console at

  2. Choose Create a Lambda function, and then on the Select blueprint screen, choose hello-world.

  3. On the Configure function screen, in the Name field, enter SomethingHappened.

  4. In the Lambda function code section, edit the sample code to match the following example:

    console.log('Loading function');
    exports.handler = function(event, context, callback) {
        console.log('Here is the event:', JSON.stringify(event, null, 2));
        callback(null, "Ready");
  5. Under Lambda function handler and role, in the Role field, if you have a lambda_basic_execution_rule, select it. Otherwise, create a new basic execution role.

  6. Choose Next, and then on the Review screen, choose Edit to make any changes. If you're satisfied with the function, choose Create function.

Step 2: Create an Amazon CloudWatch Events Rule

To create a CloudWatch Events rule

  1. Open the CloudWatch console at

  2. In the navigation pane, choose Events.

  3. Choose Create rule, and then under Event selector, choose EC2 instance state-change notification.

  4. Choose Specific state(s), and then Running from the list.

  5. Do one of the following:

    • To make the rule respond to any of your instances in the region, choose Any instance.

    • To make the rule respond to a specific instance, choose Specific instance(s) and then in the text box, enter the instance ID.

  6. Under Targets, choose Add target. In the Select target type list, choose AWS Lambda function.

  7. In the Function list, select the SomethingHappened function that you created in "Step 1: Create an AWS Lambda Function."

  8. Choose Configure input, and then choose one of the following options:

    • Matched event—Sends all of the data fields in the event to CloudWatch Logs.

    • Part of the matched event—Sends only the specified data field of the event to CloudWatch Logs. You specify the part of the event using a string formatted $.first_parameter.second_parameter. For example, to send just the Amazon EC2 instance ID, type $.detail.state in the field.

    • Constant—Sends a JSON-formatted text string that you specify to CloudWatch Logs. For example, to send a text string for the event, type {"Name":"MyInstance"}. The constant must be valid JSON.

  9. Choose Configure details. On the Configure rule details screen, in the Name field, type a name for the rule.

  10. In the Description field, enter a brief description for your rule, for example, Log when an EC2 instance is ready to accept traffic.

  11. If you're satisfied with the rule, choose Create rule.

Step 3: Test Your Amazon CloudWatch Events Rule

You can test your rule by launching an Amazon EC2 instance using the Amazon EC2 console. After waiting a few minutes for the instance to launch and to initialize, check your AWS Lambda metrics in the Amazon CloudWatch console to verify that your function was invoked.

To test your CloudWatch Events rule using the console

  1. Open the Amazon EC2 console at

  2. Launch an Amazon EC2 instance. For more information about how to launch an instance, see Launch Your Instance in the Amazon EC2 User Guide for Linux Instances.

  3. To view your AWS Lambda metrics, open the CloudWatch console

  4. In the navigation pane, under Metrics, choose Lambda to view the metrics generated by your Lambda function.

  5. To view the output from your function, in the navigation pane, choose Logs, and then in the Log Groups list, select the /aws/lambda log group that contains the data.

  6. Under Log Streams, select a log stream to view the data about the instance you launched.