EventBridge Scheduler with Terraform: Cron, One-Time Schedules, IAM and Retries

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
  region = "eu-central-1"
}

data "aws_caller_identity" "current" {}

variable "report_function_arn" {
  type        = string
  description = "Lambda function that builds the nightly usage report"
}

# Groups scope IAM and tags, and are what aws:SourceArn can match on.
resource "aws_scheduler_schedule_group" "billing" {
  name = "billing"
}

resource "aws_sqs_queue" "jobs" {
  name                       = "billing-jobs"
  visibility_timeout_seconds = 300
  sqs_managed_sse_enabled    = true
}

# Invocations that fail after the retry policy land here.
resource "aws_sqs_queue" "scheduler_dlq" {
  name                      = "billing-scheduler-dlq"
  message_retention_seconds = 1209600
  sqs_managed_sse_enabled   = true
}

data "aws_iam_policy_document" "scheduler_trust" {
  statement {
    actions = ["sts:AssumeRole"]
    principals {
      type        = "Service"
      identifiers = ["scheduler.amazonaws.com"]
    }
    # Confused deputy protection: only schedules in this account and group.
    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = [data.aws_caller_identity.current.account_id]
    }
    condition {
      test     = "ArnEquals"
      variable = "aws:SourceArn"
      values   = [aws_scheduler_schedule_group.billing.arn]
    }
  }
}

resource "aws_iam_role" "scheduler" {
  name               = "billing-scheduler"
  assume_role_policy = data.aws_iam_policy_document.scheduler_trust.json
}

data "aws_iam_policy_document" "scheduler_targets" {
  statement {
    actions   = ["lambda:InvokeFunction"]
    resources = [var.report_function_arn]
  }
  statement {
    actions   = ["sqs:SendMessage"]
    resources = [aws_sqs_queue.jobs.arn, aws_sqs_queue.scheduler_dlq.arn]
  }
}

resource "aws_iam_role_policy" "scheduler_targets" {
  role   = aws_iam_role.scheduler.id
  policy = data.aws_iam_policy_document.scheduler_targets.json
}

# Nightly report at 03:30 Vienna time, outside the hour clocks change in,
# invoked at any point in the following 15 minutes.
resource "aws_scheduler_schedule" "usage_report" {
  name       = "nightly-usage-report"
  group_name = aws_scheduler_schedule_group.billing.name

  schedule_expression          = "cron(30 3 * * ? *)"
  schedule_expression_timezone = "Europe/Vienna"

  flexible_time_window {
    mode                      = "FLEXIBLE"
    maximum_window_in_minutes = 15
  }

  target {
    arn      = var.report_function_arn
    role_arn = aws_iam_role.scheduler.arn
    input    = jsonencode({ report = "usage", window = "previous-day" })

    retry_policy {
      maximum_retry_attempts       = 3
      maximum_event_age_in_seconds = 3600
    }
    dead_letter_config {
      arn = aws_sqs_queue.scheduler_dlq.arn
    }
  }
}

# Every hour, drop a sync job on the queue for the worker service.
resource "aws_scheduler_schedule" "hourly_sync" {
  name       = "hourly-usage-sync"
  group_name = aws_scheduler_schedule_group.billing.name

  schedule_expression = "rate(1 hour)"

  flexible_time_window {
    mode = "OFF"
  }

  target {
    arn      = aws_sqs_queue.jobs.arn
    role_arn = aws_iam_role.scheduler.arn
    input    = jsonencode({ job = "sync-usage" })

    dead_letter_config {
      arn = aws_sqs_queue.scheduler_dlq.arn
    }
  }
}

# One-time: end a trial at a fixed moment, then delete the schedule.
resource "aws_scheduler_schedule" "trial_end" {
  name       = "trial-end-acct-4821"
  group_name = aws_scheduler_schedule_group.billing.name

  schedule_expression          = "at(2026-12-01T09:00:00)"
  schedule_expression_timezone = "Europe/Vienna"
  action_after_completion      = "DELETE"

  flexible_time_window {
    mode = "OFF"
  }

  target {
    arn      = aws_sqs_queue.jobs.arn
    role_arn = aws_iam_role.scheduler.arn
    input    = jsonencode({ job = "end-trial", account_id = "acct_4821" })
  }
}

import { Service } from "encore.dev/service";
export default new Service("billing");

// billing/jobs.ts
import { api } from "encore.dev/api";
import { CronJob } from "encore.dev/cron";
import log from "encore.dev/log";
import { Bucket } from "encore.dev/storage/objects";
import { SQLDatabase } from "encore.dev/storage/sqldb";

const db = new SQLDatabase("billing", { migrations: "./migrations" });
const reports = new Bucket("usage-reports");

// Writes yesterday's usage per account. Same day, same key, same content,
// so a repeated call overwrites the file with identical data.
export const usageReport = api({ expose: false }, async (): Promise<void> => {
  const day = new Date(Date.now() - 86_400_000).toISOString().slice(0, 10);
  const lines = ["account_id,units"];
  const rows = db.query<{ account_id: string; units: number }>`
    SELECT account_id, SUM(units)::bigint AS units FROM usage
    WHERE recorded_at::date = ${day}::date
    GROUP BY account_id ORDER BY account_id
  `;
  for await (const r of rows) lines.push(`${r.account_id},${r.units}`);
  await reports.upload(`daily/${day}.csv`, Buffer.from(lines.join("\n")), {
    contentType: "text/csv",
  });
});

// Ends trials whose time is up. The WHERE clause makes it safe to run often
// and safe to run twice, and replaces one one-time schedule per account.
export const endDueTrials = api({ expose: false }, async (): Promise<void> => {
  const ended = db.query<{ id: string }>`
    UPDATE accounts SET plan = 'free'
    WHERE plan = 'trial' AND trial_ends_at <= now()
    RETURNING id
  `;
  for await (const a of ended) log.info("trial ended", { accountID: a.id });
});

// Both schedules are managed by the Encore platform and run in UTC.
const _report = new CronJob("usage-report", {
  title: "Nightly usage report",
  schedule: "30 1 * * *",
  endpoint: usageReport,
});

const _trials = new CronJob("end-due-trials", {
  title: "End expired trials",
  every: "10m",
  endpoint: endDueTrials,
});