AWS EventBridge Rule AND operator

In this article you’ll find an answers to these questions:

• eventbridge rule check not null not empty
• eventbridge rule multiple conditions
• eventbridge rule and operation
• eventbridge rule and operator
• eventbridge rule and logic
• eventbridge custom filtering

Suppose you want to use two checks for a specific field. Consider the following test event:

{
  "id": "<required>",
  "account": "<required>",
  "source": "<required>",
  "time": "2016-01-10T01:29:23Z",
  "region": "<required>",
  "resources": "<required>",
  "detail-type": "<required>",
  "custom": "sometext"
}

After some struggling, you may end up with a rule that looks something like this:

{
  "custom": [
    { "prefix": "start-" }, { "suffix": "-finish" }
  ]
}

At a glance, this rule should match events only when event field custom looks this way: start-sometext-finish.

However, using the EventBridge Rule Emulator we spoke about before, you can figure out that it’s not the case. Your event will be matched to the rule in these cases:

• start-sometext
• sometext-finish
• start-sometext-finish

The reason beside this is that AWS EventBridge doesn’t have AND operation (link 1, link 2). Syntax like this: [] is actually being used to express OR operation.

You may also try this option:

{
  "custom": [ { "prefix": "start-" } ],
  "custom": [ { "suffix": "-finish" } ]
}

But this won’t work as well. The second expression will completely overwrite the first.

In simple cases, I suggest you use a wildcard operator https://aws.amazon.com/about-aws/whats-new/2023/10/amazon-eventbridge-wildcard-filters-rules. Note that it’s a wildcard and not a regex. Therefore, you are limited to using only the * operation, which means zero or any number of symbols:

{
  "custom": [ { "wildcard": "start-*-finish" } ]
}

Answering the another question we raised before, it’s not really possible to check if a field:

• exist
• not null
• not empty

all together. Instead, you can think about the possibility of an appliance wildcard operator. For instance, if you have to check the GUID field for those constraints, You know, that GUID has dashes in it. Therefore, you may use the following construct:

{
  "custom": [ { "wildcard": "*-*" } ]
}

In other cases, you have to make a Lambda and execute filtering there.

If you still have any questions, feel free to ask me in the comments under this article or write me at promark33@gmail.com.

​