When a citizen uploads a permit PDF to an S3 bucket, several systems must react: virus scan, metadata tagging, and a Slack-style staff alert. Which AWS service routes those events to multiple targets with rules?
Select an answer to reveal the explanation.
Short Explanation
EventBridge is the traffic cop for “something happened” messages — one upload event, many rule-matched destinations without hard-wiring every service to every other. A lone SQS queue is one inbox, ACM is about certificates, and stuffing PDFs into RDS rows is the wrong storage model.
Full Explanation
When a citizen uploads a permit PDF to S3 and several systems must react—virus scan, metadata tagging, and a Slack-style staff alert—Amazon EventBridge is the service that matches events and routes them to multiple targets with rules. EventBridge (including S3 event integration patterns via events/buses and rules) lets one upload event fan out to Lambda functions, SQS queues, SNS topics, or other targets based on rule criteria without hard-wiring every producer to every consumer. That rule-based event routing fits multi-step civic intake workflows.
Amazon SQS alone as a single FIFO queue provides one durable inbox; it does not by itself offer rich rule-based fan-out routing to heterogeneous targets the way EventBridge does (though queues can be targets). AWS Certificate Manager issues TLS certificates for websites; it does not route upload events. Amazon RDS stores relational data and is a poor place to stuff PDF binaries as the primary object store or event router. Wrong storage and wrong security services appear as distractors.
Exam caveat: EventBridge = event bus + rules + many targets; SNS = pub/sub notifications; SQS = queues; S3 notifications can also target Lambda/SNS/SQS directly—but when the stem emphasizes rules routing one event to multiple varied targets, EventBridge is the CLF-friendly answer.
Operational check for permit upload automation: emit or capture object-created events, write EventBridge rules for scan/tag/alert targets, ensure each consumer is idempotent, quarantine malicious files before tagging promotes them, secure the Slack/chat webhook path, and observe failed invocations so a broken scanner does not silently skip civic virus checks.