Introduction

Infrastructure visibility is a critical requirement in modern cloud environments. Operational activities such as instance modifications, service restarts, and configuration changes can directly impact workload availability and compliance posture.

Rather than relying on periodic polling mechanisms, organizations can adopt an event-driven architecture to capture infrastructure events in near real time.

This article demonstrates how Alibaba Cloud EventBridge and Function Compute can be used to build a lightweight observability pipeline for ECS operational events.

Solutions Overview

The proposed solution leverages Alibaba Cloud EventBridge and Function Compute to establish an event-driven observability pipeline for ECS infrastructure operations.

When an administrative action is performed on an ECS instance, such as modifying instance attributes, starting or stopping an instance, or updating configuration settings, Alibaba Cloud ActionTrail automatically generates an event record. The event is then published to EventBridge through the default system event bus.

EventBridge acts as the event routing layer of the architecture. Based on predefined event patterns, EventBridge evaluates incoming events and forwards matching events to the designated Function Compute target. This filtering mechanism ensures that only relevant infrastructure activities are processed.

Function Compute serves as the event processing engine. Upon receiving an event, the function extracts operational metadata such as the event name, affected ECS instance, source service, and request details. The processed information is subsequently written to logs and can be extended to trigger downstream operational workflows.

By combining EventBridge and Function Compute, organizations can implement a lightweight, serverless monitoring architecture capable of capturing infrastructure changes in near real time while eliminating the operational overhead associated with traditional polling-based monitoring solutions.

Architecture Design

diagram
Figure 1. Event-driven observability architecture for Alibaba Cloud ECS using EventBridge and Function Compute.
The workflow begins when an administrative action is performed on an ECS instance. Activities such as modifying instance attributes, updating configurations, or executing lifecycle operations generate management events that are automatically recorded through Alibaba Cloud ActionTrail.

These events are published to EventBridge through the default system event bus. Acting as the central event routing layer, EventBridge evaluates incoming events against predefined matching rules and forwards relevant events to downstream targets.

Function Compute serves as the event processing layer within the architecture. Once invoked by EventBridge, the function receives the complete event payload and extracts operational metadata such as the event name, affected ECS instance, and request details. The processed information is then written to logs, providing visibility into infrastructure activities in near real time.

Although this implementation focuses on event collection and processing, the architecture can be further extended into an operational intelligence layer. The event stream generated by EventBridge and Function Compute can be integrated with notification services, centralized logging platforms, observability tools, ITSM solutions, security monitoring systems, or automated remediation workflows. This extensibility enables organizations to evolve from basic event monitoring toward a broader event-driven operations model without modifying the underlying ECS workloads.

Configuring EventBridge for ECS Event Routing

To capture ECS operational activities, an EventBridge rule was created on the default event bus. The rule is configured to monitor ECS management events generated through ActionTrail and selectively route relevant events for downstream processing.

For this implementation, the event pattern targets ECS console operations, allowing the solution to capture administrative actions performed against ECS resources.

The following event pattern was configured:

{
  "source": [
    "acs.ecs"
  ],
  "type": [
    "ecs:ActionTrail:ConsoleOperation"
  ]
}

This configuration enables EventBridge to identify ECS operational events and automatically invoke the designated Function Compute target whenever a matching event is detected.

By implementing filtering at the EventBridge layer, the architecture ensures that only relevant infrastructure events are processed, reducing unnecessary execution and improving overall operational efficiency.

EventBridge Rule Configuration

Screenshot_2026_06_12_at_18_09_11
Screenshot_2026_06_12_at_18_07_46

Implementing Event Processing with Function Compute

To process incoming ECS events, a Function Compute Event Function was deployed as the downstream target of the EventBridge rule.

Function Compute provides a fully managed serverless execution environment that automatically processes events without requiring dedicated infrastructure. Once EventBridge identifies a matching event, the complete payload is delivered directly to the function for processing.

The implementation extracts key operational metadata from the event payload, including the operation type and affected ECS instance.

import logging
import json

logger = logging.getLogger()

def handler(event, context):
    payload = json.loads(event)

    logger.info(
        f"Event Name: {payload['data']['eventName']}"
    )

    logger.info(
        f"Instance ID: {payload['data']['requestParameters']['InstanceId']}"
    )

    return "OK"

This lightweight processing model provides immediate visibility into infrastructure activities while establishing a foundation for more advanced event-driven operational workflows.
Screenshot_2026_06_12_at_18_10_24

Function Compute Event Function

Screenshot_2026_06_12_at_18_14_44

Event Processing Logic

Screenshot_2026_06_12_at_18_16_17

Event Validation and Testing

To validate the end-to-end event processing workflow, an administrative operation was performed on an ECS instance by modifying the instance name through the Alibaba Cloud Console.

This operation generated an ECS management event with the following operation type:

ModifyInstanceAttribute

Once the operation was submitted, Alibaba Cloud ActionTrail automatically recorded the activity and published the corresponding event to EventBridge. The event matched the configured routing rule and was subsequently delivered to Function Compute for processing.

To verify successful event delivery, EventBridge Event Trace was used to inspect the event lifecycle. The trace confirmed that the event was successfully received, matched against the routing rule, and delivered to the configured Function Compute target without errors.

The successful delivery status demonstrates that the event routing configuration is functioning as expected and that ECS operational events can be processed in near real time using a serverless architecture.

ECS Instance Modification

Screenshot_2026_06_12_at_18_17_22

Event Trace Result

Screenshot_2026_06_12_at_18_18_38

Reviewing Event Processing Results

After the event was delivered by EventBridge, Function Compute processed the incoming payload and extracted key operational metadata from the ECS event.

Function execution logs confirmed that the event was successfully received and parsed by the function. The extracted information included both the operation type and the affected ECS instance identifier.

Example output:

===== EVENT RECEIVED =====

Event Name: ModifyInstanceAttribute

Instance ID: i-k1a7s06x6knww33r2jj6

This result validates that the complete event-driven workflow is functioning correctly, from ECS event generation through EventBridge routing and Function Compute processing.

The same architecture can be extended to support additional event types, operational analytics, notification systems, governance controls, and automated remediation workflows.

Function Compute Logs

Screenshot_2026_06_12_at_18_20_24

Conclusion

Event-driven architectures provide an efficient approach to infrastructure observability by eliminating the need for continuous polling and enabling near real-time event processing.

By combining Alibaba Cloud EventBridge and Function Compute, organizations can establish a lightweight and scalable mechanism for capturing ECS operational activities, routing infrastructure events, and processing operational metadata through a fully managed serverless platform.

This implementation demonstrates how Alibaba Cloud native services can be combined to build a scalable event-driven observability pipeline for ECS operations. By leveraging EventBridge for event routing and Function Compute for serverless processing, organizations can establish a foundation for operational monitoring, governance, and automation without introducing additional infrastructure management overhead.

Community

Event-Driven Infrastructure Observability for Alibaba Cloud ECS Using EventBridge and Function Compute

Introduction

Solutions Overview

Architecture Design

Configuring EventBridge for ECS Event Routing

EventBridge Rule Configuration

Implementing Event Processing with Function Compute

Function Compute Event Function

Event Processing Logic

Event Validation and Testing

ECS Instance Modification

Event Trace Result

Reviewing Event Processing Results

Function Compute Logs

Conclusion

Read previous post:

Read next post:

Della L. Wardhani

You may also like

Comments

Della L. Wardhani

Related Products

ECS(Elastic Compute Service)

Function Compute

Container Compute Service (ACS)

Realtime Compute for Apache Flink