How to Write EventBridge cron Expressions: What ? Means, Weekday Numbers, Japan Time and Converting from crontab

An EventBridge cron expression is “six fields” wrapped in cron( )

EventBridge schedules are written with either cron( ) or rate( ). Inside cron( ) go six values separated by spaces: crontab’s five fields plus a “year”. The year field can’t be omitted, so if any year will do, still put * at the end.

For example, “weekdays (Mon–Fri) at 0:00 (UTC)” is “cron(0 0 ? * MON-FRI *)”. Compared with crontab’s “0 0 * * 1-5”, the day of month has become ?, the weekday is an English abbreviation, and there’s an extra * for the year at the end. Those three are the places you always need to change when moving from crontab.

The ? rule: one of day of month or weekday must be ?

The most common source of errors in EventBridge is ?. It means “not specified in this field (the other field decides)”, and goes in exactly one of the day of month (3rd) or day of week (5th). You can’t make both *, and you can’t make both ?.

The rule of thumb is simple: “if the weekday decides, make the day of month ?; if the date decides, make the weekday ?; for every day, make the day of month * and the weekday ?”. Because of this, neither crontab’s “either day of month or weekday (OR)” nor Spring’s “both (AND)” can be written in one rule. Something like “the 1st of every month and every Friday” has to be split into a date rule and a weekday rule.

Weekday numbers start with 1 for Sunday: one off from crontab

In crontab, 0 is Sunday and 1 is Monday, but in EventBridge 1 is Sunday, 2 is Monday…7 is Saturday. Copy the numbers over and every weekday moves one day earlier.

Put crontab’s “1-5” into EventBridge unchanged and you get Sunday to Thursday (SUN-THU): the Monday job runs on Sunday and nothing runs on Friday, a confusing bug. In EventBridge, writing English abbreviations such as MON-FRI means you never have to think about the off-by-one, so it’s the recommended style.

Month-end, weekdays and nth weekdays with L, W and #

EventBridge cron expressions can directly express things crontab can’t, such as “month-end” or “the nth weekday”. They come up often in daily and monthly batches, so it’s handy to know the common forms.

# and L combine with weekday numbers, so the “1 is Sunday” offset matters here too. Write the second Tuesday as “2#2” with crontab habits and you get the second Monday. W runs on “the nearest weekday within the same month if the given day falls on a weekend”, and never crosses into another month. November 15, 2026 is a Sunday, so 15W runs on Monday the 16th.

How rate expressions differ: “every” counts from when you start

For a simple interval you can use rate( ) instead of cron. Write a number and a unit (minute, hour or day), as in rate(5 minutes), rate(1 hour) or rate(7 days).

• Use the singular for 1 and the plural for 2 or more. rate(1 hours) and rate(5 minute) are errors
• The interval counts from when the rule was created (or enabled), so you can’t align runs to times like “minute 0 of every hour”
• To run at exactly minutes 0, 15, 30 and 45 of every hour, use cron(0/15 * * * ? *), not rate(15 minutes)
• There are no week or month units, so weekly and monthly jobs are written with cron

In EventBridge cron expressions, it’s common to write the start of a step as a number, like “0/15” (it means the same as “*/15”). A good split is cron for work that’s easier to handle later if times line up, such as log aggregation, and rate for work where only the interval matters, such as health checks.

Running on Japan time: rules use UTC, Scheduler lets you choose a time zone

EventBridge offers two ways to create schedules: the long-standing “EventBridge rules” and “EventBridge Scheduler”, added in 2022. The cron syntax is the same, but they handle time zones differently.

To match Japan time with a rule, write the UTC time 9 hours earlier, just as with GitHub Actions. Japan time 0:00–8:59 falls on the previous day in UTC, so move the weekday back one as well. For example, weekdays at 8:00 Japan time is 23:00 UTC Sunday–Thursday, so “cron(0 23 ? * SUN-THU *)”. The detailed steps are explained in running GitHub Actions cron on Japan time. If you’re creating something new, Scheduler, which lets you set the time zone, is safer because there’s no offset arithmetic to get wrong.

Conversion table for crontab, Kubernetes, Spring and systemd

Here is the same schedule written for each of the common systems. Times are in each system’s configured time zone (EventBridge rules and GitHub Actions use UTC).

• Kubernetes CronJob uses the same five fields as crontab. From 1.27 you can set Japan time with spec.timeZone: Asia/Tokyo; writing CRON_TZ= inside schedule isn’t supported
• Spring has six fields, with seconds first. You can set a time zone with zone, as in @Scheduled(cron = "0 0 9 * * MON-FRI", zone = "Asia/Tokyo")
• systemd timer’s OnCalendar takes the form “weekday year-month-day hour:minute:second”. ~01 means “the 1st day counting from the end of the month”, that is, the last day

In the cron expression checker, choose AWS EventBridge as the syntax and paste your expression: it flags a missing ? or shifted weekday numbers and shows the meaning in plain language with the upcoming run times. Enter a crontab expression and you can see it converted to EventBridge, Kubernetes, Spring and systemd syntax all at once. For ports that involve the day-of-month/weekday OR difference, also see cron’s day-of-month/weekday OR rule and how to write nth weekdays and month-end.

FAQ

What does ? mean in an EventBridge cron expression?

It means “not specified in this field”, and must go in exactly one of the day of month or day of week. If the weekday decides, make the day of month ?; if the date decides, make the weekday ?. For every day, make the day of month * and the weekday ?, as in cron(0 9 * * ? *). Both * or both ? is an error.

How do I run EventBridge at 9:00 Japan time?

EventBridge rules are read in UTC, so subtract 9 hours and write cron(0 0 * * ? *). With EventBridge Scheduler, write cron(0 9 * * ? *) and set the time zone (ScheduleExpressionTimezone) to Asia/Tokyo, and it runs at 9:00 Japan time.

Which number is Monday in EventBridge weekdays?

1 is Sunday, 2 is Monday…7 is Saturday. That’s one off from crontab (0 is Sunday, 1 is Monday), so weekdays are 2-6. To avoid mixing up the numbers, it’s best to use English abbreviations such as MON-FRI.

Should I use cron or rate to run EventBridge every 5 minutes?

If only the interval matters, rate(5 minutes) is simpler. But rate counts from when the rule was created, so runs won’t line up with minutes 0, 5, 10 of each hour. If you want aligned times, use cron(0/5 * * * ? *).

How do I convert crontab’s “0 9 * * 1-5” to EventBridge?

Make the day of month ?, the weekday MON-FRI (2-6 as numbers), and add a * for the year at the end: cron(0 9 ? * MON-FRI *). And because EventBridge rules are read in UTC, if you want 9:00 Japan time, set the hour to 0: cron(0 0 ? * MON-FRI *).