Six fields, not five
EventBridge appends a year field: cron(minute hour day-of-month month day-of-week year). A standard 0 9 * * 1-5 becomes cron(0 9 ? * MON-FRI *).
The whole expression is wrapped in cron(...) when you pass it to a schedule rule.
The ? rule catches everyone
You cannot use * in both day-of-month and day-of-week. One of them must be ?, meaning 'no specific value'. If you specify days of the week, day-of-month must be ?, and vice versa. Supplying * for both is a validation error, not a warning.
Day-of-week numbering is offset by one
EventBridge counts 1 = Sunday through 7 = Saturday, where POSIX cron uses 0 = Sunday through 6 = Saturday. A literal copy-paste from a standard crontab shifts every job by a day. Use the three-letter names (MON, TUE) instead — they're unambiguous and EventBridge accepts them.
rate() is often the better choice
For simple fixed intervals, rate(5 minutes) is clearer than a cron step and has none of the field-numbering traps. Reach for cron() only when you need a specific wall-clock time or calendar day.
EventBridge Scheduler (the newer service, as opposed to classic EventBridge Rules) also supports a ScheduleExpressionTimezone parameter with full DST handling — worth using if local time matters.
Frequently asked questions
How many fields does an AWS EventBridge cron expression have?
Six. EventBridge adds a year field after day-of-week, unlike standard 5-field POSIX cron.
Why does my EventBridge cron expression fail validation?
Almost always the day-field rule: you cannot use * in both day-of-month and day-of-week. One must be ?.
Is 1 Monday or Sunday in EventBridge?
Sunday. EventBridge numbers 1–7 as Sunday–Saturday, one higher than POSIX cron's 0–6. Use MON-style names to avoid the off-by-one.
Related cron expressions
Browse the full cron expression reference, or build your own expression from scratch.