A CloudWatch alarm on a hospital's API should start a Lambda function only when the alarm changes state. Someone suggested an S3 event notification as the trigger. What should invoke the function?
Select an answer to reveal the explanation.
Short Explanation
An alarm changing state is an event, and EventBridge is the switchboard for that event. You do not hang the function off a bucket notification and hope a log file arrives at the same moment. S3 does not see the alarm.
Full Explanation
CloudWatch publishes alarm state changes as events. An EventBridge rule can match that state change and invoke Lambda directly, which is the path the hospital asked for. An S3 event notification fires when an object is created or removed, not when an alarm changes state. A flow-log subscription would run on network records and would not know the alarm state. A person running the function from a laptop is not a trigger. Caveat: the function's resource policy must allow events.amazonaws.com to invoke it, or the rule matches and the invoke is denied. Operational check: put the alarm into ALARM in a test and confirm one Lambda invocation whose event is the alarm state change. The event source is aws.cloudwatch and the detail type is CloudWatch Alarm State Change. Match the alarm name in the pattern so unrelated alarms do not invoke the function. S3 notifications stay useful for objects and have no alarm state to filter on. After the rule exists, a test alarm should show Invocations on the function and the alarm name inside the event.