A team sends a high volume of application events to a custom Amazon EventBridge event bus, and only events whose detail field severity equals critical should drive an AWS Lambda remediation, while all other severities must be ignored. During spikes the Lambda function was throttled because matching events arrived faster than its concurrency allowed, and bursts were lost. The team wants the filtering done by EventBridge rather than inside the function, and they want spikes absorbed so no critical event is dropped, with the least custom code. Which TWO actions together meet this requirement? (Select TWO.)
- AKeep the rule matching every event and add an if statement at the top of the Lambda function that returns immediately when the severity is not critical.
- BRaise the Lambda function's reserved concurrency to the account maximum and target it directly so EventBridge can invoke enough environments to handle any spike.
- CDefine the rule with an event pattern that matches only events where the detail severity field equals critical, so the function is invoked exclusively for critical events. Correct
- DSet the rule target to an Amazon SQS queue that buffers the matching events, and configure the Lambda function with an event source mapping that reads the queue at its own pace. Correct
Why A is wrong: Filtering inside the function still invokes it for every event, wasting concurrency and contradicting the requirement that EventBridge perform the filtering before the target is reached.
Why B is wrong: Higher concurrency reduces throttling but consumes the whole account pool and still drops events once EventBridge exhausts retries during an extreme spike, whereas a queue buffers the burst without losing events.
Why C is correct: An event pattern filters at the bus, so a pattern on detail.severity equal to critical means EventBridge invokes the target only for matching events rather than relying on the function to discard the rest.
Why D is correct: Routing matches into an SQS queue absorbs bursts durably, and a Lambda event source mapping polls the queue within the function's concurrency so a spike accumulates in the queue rather than being dropped.