Trek10 Team
Caylent Catalysts™
IoT
Connect, understand, and act on data from industrial devices at scale to improve uptime, efficiency, and reliability across manufacturing, energy, and utilities.
Learn how to synthesize an (almost) identical payload using Amazon EventBridge rules.
This blog was originally written and published by Trek10, which is now part of Caylent.
When AWS released suffix filtering for Amazon EventBridge rules in Nov 2022, EventBridge rules for Amazon S3 events reached feature parity with the original Amazon S3 Event Notifications feature except for the cost.
Of course, the event formats aren’t the same which, while understandable, is very unfortunate.
There are situations where you might want to use the flexibility of the newly styled CloudTrail events but with the payload format of the old SNS/SQS events. For instance, you might:
- Want to consume events from an S3 Bucket defined in a different stack (or just want to avoid a circular dependency in a single stack)
- Not care about the cost (or you already have S3 data events enabled for all your buckets)
- Have to forward the events to something that only expects the old event format, e.g. a 3rd party integration you don’t have control over
If you ever find yourself in a situation like this you can use an EventBridge Rule Input Transformation to synthesize the “old style” event. I’ll show you how in this post.
Eliminate Overhead of Your AWS Environment with Serverless on AWS
Here is an S3 Notification Event and an S3 Event for the same PutObject operation for comparison.
Old Style S3 Event:
New Style S3 Event:
The newer event is a CloudTrail event. The older version follows the pattern of many other events such as SNS, SQS, etc.
Event Bridge Rule Input Transformations let you select attributes of the incoming event using JSONPath expressions and then substitute these values into a string to create a new event (the new string can also be a stringified JSON object).
Not all of the attributes from the new event style are present in the old, but the important ones are. Here is my best attempt to create this transformation:
The EventBridge Rule defined by CloudFormation:
Here is a comparison of the old-style event for the same S3 action and the synthesized event:
A few attributes are present in the old style event that are missing in the new event, namely the bucket ownerIdentity, configurationId, the eventTime are slightly different, and the eventName is also different. Unfortunately, there is currently no way to do more complicated logic directly in an Event Rule Input Transformation.
I hope you’ve found this example demonstrating some of the power of the Event Rule Input Transforms to be useful.
Additional reading:
Managed Services
Trek10 Team
Founded in 2013, Trek10 helped organizations migrate to and maximize the value of AWS by designing, building, and supporting cloud-native workloads with deep technical expertise. In 2025, Trek10 joined Caylent, forming one of the most comprehensive AWS-only partners in the ecosystem, delivering end-to-end services across strategy, migration and modernization, product innovation, and managed services.
View Trek10's articles
Related Blog Posts
Datadog Event Mapping
Learn how Datadog Event Mapping works — how to correlate logs, events, and alerts into meaningful context, improve observability, and reduce noise so your team can quickly detect and respond to issues.
Managed Services
Infrastructure & DevOps Modernization
CloudFormation Nested Stacks Primer
Get a practical introduction to AWS CloudFormation nested stacks — how they work, when to use them, and best practices for organizing and managing reusable infrastructure templates at scale.
Managed Services
Infrastructure & DevOps Modernization
Dedicated Hosts vs. Dedicated Instances on AWS: What is the Difference?
Understand the differences between AWS Dedicated Hosts and Dedicated Instances — when to use each, how they impact compliance and licensing, and best practices for controlling tenancy and cost in your cloud environment.
Managed Services
Infrastructure & DevOps Modernization