AWS EventBridge x Rootly Integration

Rootly now integrates with AWS EventBridge, allowing you to stream incident and alert lifecycle events from Rootly directly into your AWS account in real time. This gives you a scalable, event-driven way to connect incident response with your AWS infrastructure — without building custom pipelines.

Why it matters

Incident response doesn’t end in Rootly. Teams need to trigger downstream automation, update dashboards, notify external systems, and feed data into analytics pipelines. Connecting those systems typically requires custom integrations or manual processes.

With AWS EventBridge + Rootly, you can:

Stream incident and alert events to EventBridge as they happen — creation, updates, mitigation, resolution.
Route events to any AWS target including Lambda, Step Functions, SQS, SNS, API Gateway, and more.
Filter using EventBridge rules to route specific event types to specific targets based on event metadata.
Eliminate custom webhooks and reduce operational overhead by using AWS’s native event bus.

This enables a fully event-driven automation model powered by your existing AWS ecosystem.

How it works

Create the integration in Rootly: Add your AWS Account ID and region, and Rootly creates a partner event source in your account.

Associate the event source in AWS: Link the partner event source to an event bus in the EventBridge console.
Create EventBridge rules: Route Rootly events to any supported AWS target using event patterns and filters.

Sending AWS events into Rootly

To go the other direction → forwarding AWS events into Rootly to trigger alerts → route EventBridge events to an SNS topic subscribed to Rootly’s AWS SNS alert source.

For CloudWatch alarms, use the dedicated AWS CloudWatch alert source.

View the docs to get started and learn more.

What else shipped

Improvements

On-Call

Alert source payload fields containing URLs now automatically render as clickable links.

Incident Response

Alert liquid variables now include a timeline property containing alert events, enabling richer workflow templates.
Incident fields for services, teams, and functionalities can now be cleared after being set.
The Communications module refresh button now updates Liquid variable values in real time.
Users can now set a preferred name in their profile, displayed across Slack and web.
The toggle controlling Slack updates in the Communications module has been removed, simplifying configuration.

API & CLI

Incident Response

The GET /incidents endpoint now normalizes timestamps correctly when filtering by updated_at.
Built-in incident fields can now be deleted via the API.

Terraform

On-Call

Fixed an issue where customers could not manage the default escalation path when multiple defaults existed via Terraform.

Incident Response

Status page custom DNS external domains now persist correctly when set via Terraform or the API.
The Update Jira Issue Terraform resource now includes an integration selector for multi-integration setups.

MCP Server

Improved hosted auth validation and Code Mode execute error handling.
Patched vulnerable authlib and requests dependencies.
Reduced oversized shift and collection payloads and added pagination to list_shifts.
Added MCP-level pagination to list_shifts, including pagination metadata and validation for invalid page numbers.
Added incident update and readback support for PIR workflows.
Added updateIncident for post-incident review lifecycle updates.
Added getIncident and incident readback support for post-incident review verification purposes.
Validate hosted Authorization headers earlier and log auth header state to make malformed token issues easier to diagnose.
Hardened Code Mode execute by normalizing common client-prefixed tool names and returning clearer parser, import, and runtime errors.
Trimmed get_shift_incidents results to avoid oversized responses.
Preserved incidents that started before a shift but were resolved during it.
Updated search_incidents to include retrospective progress status in readback results.

Fixes

On-Call

Fixed an RBAC bug that prevented users without Alert Sources Read permission from creating alert routes.
Alert ownership filters now correctly match on ANY selected condition instead of ALL.
Duplicate mobile device registrations no longer appear in the device selector dropdown.
Switching a custom field between multi-select and single-select with many options no longer causes a blank screen error.
Fixed a runtime error that occurred when no active handoff day was found within a 7-day window.

Incident Response

Adding a second third-party integration on the same page no longer results in a 404 error.
Removing an incident role assignment in Slack no longer removes all roles from the Assign Roles popover.
Fixed a missing template error when loading service, functionality, and group status pages after a system reboot.
Status page subscriber signup is no longer blocked when reCAPTCHA challenges are inaccessible.
Fixed a permissions error that prevented Rootly AI from accessing incident channels.
Incident updates made via the Slack form now correctly add events to the incident timeline.
Fixed an error that prevented meetings from being ended through the Rootly UI.
The Add members to incident channel team setting now runs correctly when a team is added to an incident.
Fixed a crash on the /rootly Slack command for new users.
Fixed a 500 error when retrieving Linear states in workflow actions.
Fixed a service status discrepancy on status pages using custom domains.
The SCIM SSO default role no longer shows a stale value in the Edit Role UI.
Fixed a Notion database access error that occurred during workflow runs.
Fixed a 500 error that prevented the AWS SNS alert source page from loading on the Integrations page.
Users can now correctly set update workflow permissions via Incident Permission Sets.