A payments service has an EventBridge rule whose Lambda target shows failed invocations. The function logs never record a start. What should the operator inspect?
Select an answer to reveal the explanation.
Short Explanation
The invitation never reached the function, so arguing about how much memory it might have used misses the closed door. You have failed invocations and no log line showing the function started, which points to invoke permission and to the dead-letter queue, not to a code crash. Widening the event pattern only changes which events match.
Full Explanation
EventBridge can invoke Lambda only when the function's resource policy allows that rule to call the function. If the grant is missing, the invoke fails before the code runs, the function logs stay empty, and the rule counts a failed invocation. Events that still cannot be delivered after the target's retries go to the dead-letter queue configured on the rule target, when one is set, and that queue holds the payload and the error. With no dead-letter queue configured, those events are dropped once retries end, which is why the target settings matter even before you read a log. Function memory and timeout apply after the code has started, so they do not explain a failure with no start log. A wider event pattern matches more events and does not grant invoke permission. An archive stores events that arrived on a bus, and it is not the record of a denied invoke. Caveat: a function that starts and then throws leaves log lines and is a code failure, so an empty log is the clue that this one is delivery. Operational check: confirm the resource policy allows this rule, and read one message from the target dead-letter queue for the error.