Everything you need to know about writing, reading, and debugging cron expressions for AWS EventBridge Scheduler — including the 6-field format AWS uses.
AWS EventBridge Scheduler — officially called Amazon EventBridge — is Amazon's fully managed, serverless scheduling service. It lets you schedule tasks — running a Lambda function, invoking an API, triggering an ECS task — at a specific time or on a recurring basis, without managing any infrastructure.
Unlike older AWS solutions like CloudWatch Events (which EventBridge replaced), EventBridge Scheduler is purpose-built for scheduling. It supports two types of schedule expressions: rate expressions (simple recurring intervals) and cron expressions (fine-grained, calendar-based control).
If you need your Lambda to run every 5 minutes, a rate expression works. But if you need it to run every Monday at 9:00 AM UTC, except in December — that's where AWS cron expressions shine.
EventBridge Scheduler can invoke over 270 AWS service targets and more than 6,000 API operations. This means you can schedule not just Lambda, but also SQS, SNS, Step Functions, ECS, Glue, and virtually any AWS service that has an API.
Before diving into cron syntax, it's worth understanding when to use which:
Simple repeating intervals. Easy to write but limited control.
rate(5 minutes) rate(1 hour) rate(7 days)
✓ Good for: heartbeats, polling, simple cleanup jobs
Calendar-based precision. Run at exact times, specific days, months.
cron(0 9 ? * MON-FRI *)
cron(30 18 1 * ? *)
cron(0 0 1 1 ? *)
✓ Good for: business logic, reports, billing cycles, backups
Both are wrapped in cron(...) or rate(...) when entered in the AWS console or via CloudFormation/CDK. The cron() wrapper is unique to AWS — standard Linux crontab does not use it.
This is the most important thing to understand about AWS EventBridge cron: it uses 6 fields, not 5 like standard Linux/Unix cron. The extra field is a Year field at the end.
Here's a concrete example. This expression runs every weekday (Monday–Friday) at 9:00 AM UTC:
cron(0 9 ? * MON-FRI *) │ │ │ │ │ └── Year: every year │ │ │ │ └────────── Day-of-week: Monday to Friday │ │ │ └──────────────── Month: every month │ │ └──────────────────── Day-of-month: ? (not specified) │ └──────────────────────── Hours: 9 AM UTC └──────────────────────────── Minutes: at :00
? (meaning "no specific value"). This is different from standard cron and trips up many developers.
AWS EventBridge cron expressions support a rich set of special characters that give you fine-grained control:
| Character | Meaning | Example | Use in Fields |
|---|---|---|---|
| * | Any/All values | * * * * ? * — every minute | All fields |
| ? | No specific value (placeholder) | ? * MON * — day-of-month not specified | Day-of-month, Day-of-week only |
| - | Range | 10-12 — hours 10, 11, 12 | All fields |
| , | List of values | MON,WED,FRI — those three days | All fields |
| / | Step / increment | 0/15 — every 15 minutes starting at 0 | All fields except Day-of-week |
| L | Last | L in Day-of-month = last day of month | Day-of-month, Day-of-week |
| W | Nearest weekday | 15W — nearest weekday to the 15th | Day-of-month only |
| # | Nth day of month | 2#1 — first Monday of month | Day-of-week only |
AWS EventBridge accepts both numeric values and 3-letter abbreviations for months and days:
| Days of Week | Value | Months | Value |
|---|---|---|---|
| SUN | 1 | JAN | 1 |
| MON | 2 | FEB | 2 |
| TUE | 3 | MAR | 3 |
| WED | 4 | APR | 4 |
| THU | 5 | MAY | 5 |
| FRI | 6 | JUN | 6 |
| SAT | 7 | JUL–DEC | 7–12 |
Below are production-ready AWS EventBridge cron expressions covering the most common scheduling patterns. Every expression uses the cron() wrapper required by AWS.
Use our free generator — it supports all 6 fields including the AWS-specific Year field, and generates the correct cron() wrapper format automatically.
If you're coming from Linux cron jobs, there are several important differences you need to know about before writing AWS EventBridge cron expressions. Getting these wrong is the #1 source of errors for developers migrating from traditional cron setups.
| Feature | Linux Crontab | AWS EventBridge Cron |
|---|---|---|
| Number of fields | 5 | 6 (includes Year) |
| Field order | Min Hour DOM Month DOW | Min Hour DOM Month DOW Year |
| Sunday value | 0 or 7 | 1 (SUN=1, SAT=7) |
| DOM + DOW conflict | Both can be set simultaneously | One must be ? |
| Wrapper syntax | No wrapper needed | Must use cron() |
| Timezone | Server local time | UTC by default |
| Minimum interval | 1 minute | 1 minute |
| Year field | Not supported | 1970–2199 |
| L, W, # characters | Not always supported | Fully supported |
Here are the steps to convert a standard Linux crontab expression:
# Standard Linux crontab (5 fields): 0 9 * * 1-5 # 9 AM Mon-Fri (0=Sunday in Linux) # AWS EventBridge equivalent: cron(0 9 ? * MON-FRI *) # Changes made: # 1. Added ? for Day-of-month (required) # 2. Changed 1-5 to MON-FRI (AWS SUN=1, so 1-5 in AWS = SUN-THU!) # 3. Added * for Year at the end # 4. Wrapped in cron()
# ❌ WRONG — Both Day-of-month AND Day-of-week are set cron(0 9 15 * MON *) # ✅ CORRECT — Use ? for the one you don't need cron(0 9 15 * ? *) # 15th of every month cron(0 9 ? * MON *) # every Monday
# ❌ WRONG — Raw expression without wrapper 0 9 ? * MON-FRI * # ✅ CORRECT — Always wrap in cron() cron(0 9 ? * MON-FRI *)
# ❌ WRONG — Using 0 for Sunday (Linux style) cron(0 9 ? * 0-4 *) # This is SUN-THU in AWS! # ✅ CORRECT — AWS: SUN=1, MON=2, ..., SAT=7 cron(0 9 ? * 2-6 *) # Mon-Fri numeric cron(0 9 ? * MON-FRI *) # Mon-Fri by name (clearer)
AWS EventBridge cron expressions run in UTC by default. If your users are in IST (UTC+5:30) and you want the job at 9 AM IST, you need to schedule it at 3:30 AM UTC:
# 9:00 AM IST = 3:30 AM UTC
cron(30 3 ? * MON-FRI *)
# Run every day at 2:00 AM UTC (off-peak hours)
cron(0 2 * * ? *)
Trigger a Lambda that snapshots your RDS database, compresses the dump, and uploads it to S3. Combined with S3 lifecycle policies, this creates a cost-effective automated backup system.
# Every Monday at 6:00 AM UTC — report ready before US business day
cron(0 6 ? * MON *)
Lambda queries your analytics database, generates a PDF or CSV report, and emails it to stakeholders via SES — all before anyone starts their workday.
# First of every month at midnight UTC
cron(0 0 1 * ? *)
Trigger billing calculations, generate invoices, reset monthly usage counters, and send subscription renewal reminders.
# Every 90 days: Jan 1, Apr 1, Jul 1, Oct 1 at 1 AM UTC
cron(0 1 1 1,4,7,10 ? *)
Automatically rotate IAM access keys, API keys, and other credentials on a quarterly schedule — a security best practice.
# Weekdays at 6 PM UTC (end of US East Coast business day)
cron(0 22 ? * MON-FRI *)
Flush Redis caches, clean up temporary DynamoDB records, or process end-of-day queues to keep your database lean overnight.
# Every day at midnight — check for expired trials
cron(0 0 * * ? *)
Scan your user database for trials that expired in the last 24 hours, downgrade their account tier, and send a conversion email.
No, the minimum resolution for AWS EventBridge Scheduler and CloudWatch Events is 1 minute. If you need sub-minute executions (e.g., every 10 seconds), you will need to trigger a Lambda function every minute and use a loop with sleep() delays inside the code.
When provisioning infrastructure with Terraform, you use the schedule_expression argument inside the aws_cloudwatch_event_rule or aws_scheduler_schedule resource. You must include the wrapper: schedule_expression = "cron(0 9 ? * MON-FRI *)".
Standard EventBridge rules evaluate cron expressions in UTC timezone. If you are not using the newer EventBridge Scheduler (which supports timezone selection), you must calculate the UTC offset manually. For example, 9:00 AM IST (UTC+5:30) is 3:30 AM UTC.
No, the day and month abbreviations (like MON, TUE, JAN, FEB) are case-insensitive. However, standard convention is to use uppercase for readability.
Writing AWS cron expressions by hand is error-prone — especially keeping track of the UTC offset, the ? placeholder rule, and the 6-field format. That's exactly why we built CronRead.
Our generator supports the full AWS EventBridge 6-field cron format, gives you human-readable previews ("Runs every Monday at 9:00 AM UTC"), and validates your expression in real time. No more guessing whether your expression is correct before deploying.
Build, validate, and understand your AWS EventBridge cron expressions instantly. Supports all 6 fields, special characters (L, W, #), and generates the cron() wrapper format.
AWS EventBridge cron expressions give you precise calendar-based control over when your AWS workloads run. The key things to remember are:
1. AWS uses a 6-field format: Minutes Hours Day-of-month Month Day-of-week Year
2. Always wrap your expression in cron()
3. You cannot specify both Day-of-month and Day-of-week — one must be ?
4. Sunday is 1 in AWS (not 0 like Linux). Use named days (MON, TUE…) to avoid confusion.
5. All times are UTC unless you configure a timezone in EventBridge Scheduler.
With these rules in hand and the examples in this guide as a reference, you should be able to write AWS EventBridge cron expressions confidently for any scheduling scenario.