Understanding AWS EventBridge Cron Expressions
An AWS EventBridge cron expression defines when a schedule fires. It has six required fields, wrapped in cron(...), and is used by Amazon EventBridge Rules, EventBridge Scheduler, CloudWatch Events, and Lambda. Unlike Linux crontab (5 fields), AWS always includes a year field and requires the ? wildcard in one day field.
cron(minutes hours day-of-month month day-of-week year)
┌───────────── minutes (0-59)
│ ┌───────────── hours (0-23)
│ │ ┌───────────── day-of-month (1-31)
│ │ │ ┌───────────── month (1-12 or JAN-DEC)
│ │ │ │ ┌───────────── day-of-week (1-7 or SUN-SAT)
│ │ │ │ │ ┌───────── year (1970-2199)
│ │ │ │ │ │
0 18 ? * MON-FRI *
AWS Cron vs Linux Cron: Key Differences
Field Count and Wrapper
Linux crontab uses 5 fields. AWS uses 6 fields inside cron(...). A bare 5-field string like 0 9 * * 1-5 is rejected. Convert it to cron(0 9 ? * MON-FRI *). Need the standard format? Use our Cron Expression Generator.
The ? Requirement
You cannot set both day-of-month and day-of-week. One must be ?. This is the most common AWS scheduling mistake. If you constrain weekdays, put ? in day-of-month. If you constrain a date, put ? in day-of-week.
Day-of-Week Numbering
AWS numbers weekdays 1-7 where 1 = Sunday (same as Quartz). You can also use names: SUN, MON, TUE, WED, THU, FRI, SAT. Linux cron uses 0-6 with Sunday = 0.
Timezone
EventBridge Rules always use UTC. EventBridge Scheduler lets you pick a timezone. Confirm which product you are configuring before scheduling for a local business window.
AWS Special Characters Explained
? (No Specific Value)
Required in either day-of-month or day-of-week. Example: cron(0 18 ? * MON-FRI *) means 6 PM UTC on weekdays.
L (Last)
In day-of-month, L is the last day of the month. In day-of-week, 6L is the last Friday. Example: cron(0 0 L * ? *) fires at midnight on the last day of every month.
W (Nearest Weekday)
In day-of-month only. 15W means the nearest weekday to the 15th. LW means the last weekday of the month.
# (Nth Occurrence)
In day-of-week only. 3#2 means the second Tuesday of the month (3 = Tuesday). You can define only one # expression in the field — lists with # are invalid.
Rate Expressions
For fixed intervals, AWS also supports rate expressions: rate(value unit). Units are minute/minutes, hour/hours, or day/days. Use the singular form when value is 1: rate(1 hour), not rate(1 hours). Examples: rate(5 minutes), rate(12 hours), rate(1 day).
Where to Use AWS Cron Expressions
- EventBridge Rules: Schedule expression in the console or
ScheduleExpression API parameter.
- EventBridge Scheduler: Preferred for new workloads. Supports timezones and one-time schedules.
- Lambda: Event source schedules that invoke your function on a cron or rate.
- Terraform:
aws_cloudwatch_event_rule or aws_scheduler_schedule with schedule_expression.
- CloudFormation / CDK: Same
cron(...) and rate(...) strings in schedule properties.
Common AWS Cron Mistakes
- Missing year field: Pasting a 5-field Linux expression. Always add year (usually
*).
- Both day fields set: Forgetting
?. One of day-of-month or day-of-week must be ?.
- Missing cron() wrapper: AWS expects
cron(0 18 ? * MON-FRI *), not the bare fields alone (in console/API schedule fields).
- Timezone surprise: Scheduling for 9 AM local when the rule runs in UTC.
- Using L/W/# in Linux cron: These only work in AWS (and Quartz). Standard crontab rejects them.