EventBridge:Subscribe to ECS events with EventBridge

Use cases

• Route ECS events of a specific type to DingTalk, Short Message Service, or Alibaba Mail for instant notifications.

• Push events to an HTTP or HTTPS endpoint on the internet or in a Virtual Private Cloud (VPC).

• Aggregate ECS events across multiple Alibaba Cloud accounts into a single event bus.

• Invoke a Function Compute function to run automated remediation or logging when a specific event occurs.

• Buffer high-volume or high-latency events in a Simple Message Queue (formerly MNS) (SMQ) queue before consuming them.

Prerequisites

Before you begin, make sure that you have:

• An activated EventBridge service with the required Resource Access Management (RAM) permissions granted. See Activate EventBridge and grant permissions to a RAM user

Depending on the target service, also prepare the following:

Step 1: Select the system event bus

EventBridge automatically creates a system event bus named default. All events from Alibaba Cloud services are delivered to this bus in real time.

1. Log on to the EventBridge console.

2. In the left-side navigation pane, click Event Buses.

3. In the top navigation bar, select a region.

4. On the Event Buses page, click the default bus name.

Step 2: Create an event rule for ECS events

1. In the left-side navigation pane, click Event Rules, then click Create Rule.

2. Complete the Configure Basic Info step: enter a rule name in the Name field and an optional description in the Description field. Click Next Step.

3. Complete the Configure Event Pattern step: The Event Pattern Debugging code editor displays a sample event for the selected type. For example, selecting ecs:Instance:StateChange Instance Status Changes Within Lifecycle shows: The following table describes the event fields. Click Next Step.

   • For Event Source Type, select Alibaba Cloud Service Event Sources.

   • From the Event Source drop-down list, select acs.ecs Elastic Compute Service (ECS).

   • From the Event Type drop-down list, select one or more event types to subscribe to.

   CloudEvents 1.0 standard fields

   Field	Type	Description
   id	String	Unique event identifier
   source	String	Event source in the format acs.<service>
   specversion	String	CloudEvents specification version (1.0)
   subject	String	Resource path: acs.ecs:<region>:<account-id>:<resource-id>
   time	String	Timestamp when the event occurred (ISO 8601)
   type	String	Event type, such as ecs:Instance:StateChange
   data	Object	Event payload containing resource-specific details

   Alibaba Cloud extension fields

   Field	Type	Description
   aliyunaccountid	String	Alibaba Cloud account ID that owns the resource
   aliyunpublishtime	String	Timestamp when EventBridge published the event
   aliyuneventbusname	String	Name of the event bus (default for system events)
   aliyunregionid	String	Region where the event originated
   aliyunpublishaddr	String	IP address of the publishing node

      {
        "id": "45ef4dewdwe1-7c35-447a-bd93-fab****",
        "source": "acs.ecs",
        "specversion": "1.0",
        "subject": "acs.ecs:cn-hangzhou:123456789098****:215672",
        "time": "2020-11-19T21:04:41Z",
        "type": "ecs:Instance:StateChange",
        "aliyunaccountid": "123456789098****",
        "aliyunpublishtime": "2020-11-19T21:04:42Z",
        "aliyuneventbusname": "default",
        "aliyunregionid": "cn-hangzhou",
        "aliyunpublishaddr": "172.25.XX.XX",
        "data": {
          "instanceName": "iZ0jl0kyquo46h****",
          "instanceType": "ecs.c6.large",
          "privateIpAddress": "172.21.XX.XX",
          "publicIpAddress": "8.37.XX.XX",
          "resourceId": "i-0jl0kyquo46****",
          "resourceType": "ALIYUN::ECS::Instance",
          "spotStrategy": "SpotWithPriceLimit",
          "state": "Running"
        }
      }

4. Complete the Configure Targets step. Select a target service based on your use case. See the scenarios below.

{
  "instanceName": "$.data.instanceName",
  "state": "$.data.state"
}

{
  "msgtype": "text",
  "text": {
    "content": "${instanceName} state is ${state}"
  }
}

Step 3: Trigger a test event

Verify the setup by triggering an ECS event. This example uses the ecs:Instance:StateChange event type.

1. Log on to the ECS console.

2. In the left-side navigation pane, choose Instances & Images > Instances.

3. In the top navigation bar, select the region of the target instance.

4. Find the instance and choose > Instance Status in the Actions column to change the instance state (for example, stop or restart it).

Step 4: Verify event delivery

1. Check event generation: In the EventBridge console, query events by time range, event type, rule name, or event ID. See Query events by event ID.

2. Check delivery status: Click Event Trace in the Actions column for the event to view the delivery trace, which shows the target, delivery status, attempt count, and timestamp.

   

3. Verify the downstream target: Confirm that the event reached its destination:

   • SMQ: Check the queue for new messages.

   • DingTalk: Look for the notification in the chat group.

   • HTTP/HTTPS: Check the endpoint's access logs.

   • Function Compute: Review the function execution logs.

   • EventBridge: Query the target event bus for the forwarded event.

Monitor events and configure alerts

Track delivery metrics and set up alerts in CloudMonitor.

1. Log on to the CloudMonitor console.

2. In the left-side navigation pane, choose Cloud Service Monitoring > Cloud Service Monitoring.

3. In the left-side navigation tree, click Middleware. In the Middleware section, hover over EventBridge and click EventBus.

   

4. Select the region, then click Monitoring Charts in the Actions column of the default event bus.

   

From the monitoring page, configure alert rules for metrics such as API call count, delivery success rate, and delivery latency. See Configure an alert rule.

Clean up resources

To avoid unnecessary charges, delete resources created during this tutorial when they are no longer needed:

• Event rule: In the EventBridge console, go to Event Rules under the default bus and delete the rule.

• Function Compute: Delete the function and service if they were created solely for this tutorial.

• SMQ queue: Delete the queue if it is no longer in use.