@reventlessdev/reventless-aws 3.0.0-alpha.380 → 3.0.0-alpha.381

package/CHANGELOG.md

@@ -3,6 +3,18 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.381 (2026-10-15)
+
+* feat!: schedules take a Schedule.time, run on EventBridge Scheduler on AWS ([2d74557](https://github.com/ReventlessDev/reventless-core/commit/2d74557a6304917ded8f2b9f4107af9298c91ac0))
+
+### BREAKING CHANGES
+
+* Schedule.rate is replaced by Schedule.time, and a
+schedule's `rate` field is now `time`. A once-only time already past
+never fires, locally as on AWS.
+
+
+
 # 3.0.0-alpha.380 (2026-10-12)
 
 **Note:** Version bump only for package @reventlessdev/reventless-aws

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.380",
+  "version": "3.0.0-alpha.381",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "bin": {
@@ -22,19 +22,19 @@
     "sury": "11.0.0",
     "uuid": "^13.0.0",
     "yaml": "^2.8.3",
-    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.30",
-    "@reventlessdev/rescript-jest": "1.0.0-alpha.12",
-    "@reventlessdev/rescript-effect": "0.1.0-alpha.35",
+    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.31",
+    "@reventlessdev/rescript-effect": "1.0.0-alpha.0",
     "@reventlessdev/rescript-node": "2.0.0-alpha.22",
-    "@reventlessdev/rescript-pulumi-aws": "3.0.0-alpha.27",
+    "@reventlessdev/rescript-jest": "1.0.0-alpha.12",
+    "@reventlessdev/rescript-pulumi-aws": "3.0.0-alpha.28",
+    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.23",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.1",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.294",
-    "@reventlessdev/rescript-web": "1.0.0-alpha.7",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.191",
     "@reventlessdev/reventless-interop": "3.0.0-alpha.40",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.158",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.163",
-    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.23"
+    "@reventlessdev/rescript-web": "1.0.0-alpha.7",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.192",
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.159",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.164",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.295"
   },
   "devDependencies": {
     "rescript": "12.3.1",

package/src/Platform.res

@@ -1108,9 +1108,9 @@ module MakeWithConfig = (
 
   let makeScheduler = () => {
     let component = Scheduler.make()
-    // Surface the IAM role ARN so bundled Task Lambdas can call PutRule with
-    // the right `roleArn`. ScheduledPublisher_CloudWatchEvents stashes it as
-    // `outputs.resource.urn` (no dedicated field on Scheduler.outputs).
+    // Surface the scheduler role ARN, which also names the schedule group, so
+    // bundled Lambdas can create schedules. ScheduledPublisher_EventBridgeScheduler
+    // stashes it as `outputs.resource.urn` (no dedicated field on Scheduler.outputs).
     let outputs = component->ReventlessCore.Component.outputs
     hooks.schedulerRoleUrn := outputs.resource.urn
     component->ReventlessCore.Component.operations

package/src/adapter/AWS.res

@@ -4,6 +4,7 @@ type service =
   | AppSync
   | IAM
   | CloudwatchEventRule
+  | EventBridgeScheduler
   | DynamoDb
   | DynamoDbStream
   | SQS
@@ -27,6 +28,7 @@ let toString: service => string = service =>
   | AppSync => "aws:AppSync"
   | IAM => "aws:IAM"
   | CloudwatchEventRule => "aws:CloudwatchEventRule"
+  | EventBridgeScheduler => "aws:EventBridgeScheduler"
   | S3 => "aws:S3"
   }
 
@@ -43,6 +45,7 @@ let toPrincipal: service => string = service =>
   | AppSync => "appsync.amazonaws.com"
   | IAM => "iam.amazonaws.com"
   | CloudwatchEventRule => "events.amazonaws.com"
+  | EventBridgeScheduler => "scheduler.amazonaws.com"
   | S3 => "s3.amazonaws.com"
   }
 
@@ -90,6 +93,10 @@ module CloudwatchEventRule = {
   let service = CloudwatchEventRule->toString
   let principal = CloudwatchEventRule->toPrincipal
 }
+module EventBridgeScheduler = {
+  let service = EventBridgeScheduler->toString
+  let principal = EventBridgeScheduler->toPrincipal
+}
 module S3 = {
   let service = S3->toString
   let principal = S3->toPrincipal

package/src/adapter/AWS.res.mjs

@@ -9,6 +9,8 @@ function toString(service) {
       return "aws:IAM";
     case "CloudwatchEventRule" :
       return "aws:CloudwatchEventRule";
+    case "EventBridgeScheduler" :
+      return "aws:EventBridgeScheduler";
     case "DynamoDb" :
       return "aws:DynamoDb";
     case "DynamoDbStream" :
@@ -38,6 +40,8 @@ function toPrincipal(service) {
       return "iam.amazonaws.com";
     case "CloudwatchEventRule" :
       return "events.amazonaws.com";
+    case "EventBridgeScheduler" :
+      return "scheduler.amazonaws.com";
     case "DynamoDb" :
     case "DynamoDbStream" :
       return "dynamodb.amazonaws.com";
@@ -155,15 +159,24 @@ let CloudwatchEventRule = {
   principal: principal$10
 };
 
-let service$11 = "aws:S3";
+let service$11 = "aws:EventBridgeScheduler";
 
-let principal$11 = "s3.amazonaws.com";
+let principal$11 = "scheduler.amazonaws.com";
 
-let S3 = {
+let EventBridgeScheduler = {
   service: service$11,
   principal: principal$11
 };
 
+let service$12 = "aws:S3";
+
+let principal$12 = "s3.amazonaws.com";
+
+let S3 = {
+  service: service$12,
+  principal: principal$12
+};
+
 let Tags;
 
 export {
@@ -181,6 +194,7 @@ export {
   AppSync,
   IAM,
   CloudwatchEventRule,
+  EventBridgeScheduler,
   S3,
 }
 /* No side effect */

package/src/adapter/CommandTopic/CommandTopicChannel_Helpers.res

@@ -1,8 +1,9 @@
 open PulumiAws.PolicyDocument
 open Adapter_Helpers
 
-let createQueuePolicyDocument = (~name, ~queueArn: string, ~lambdaArn: string) => {
-  let accountId = queueArn->accountIdOfQueueArn
+// EventBridge Scheduler delivers to the queue as the scheduler role, which holds
+// sqs:SendMessage itself, so the queue's own policy admits only its Lambda.
+let createQueuePolicyDocument = (~name, ~queueArn: string, ~lambdaArn: string) =>
   PulumiAws.PolicyDocument.make(
     ~id=name ++ "QueuePolicy",
     ~statements=[
@@ -18,30 +19,8 @@ let createQueuePolicyDocument = (~name, ~queueArn: string, ~lambdaArn: string) =
           arnEquals: [("AWS:SourceArn", ConditionValue(lambdaArn))]->Dict.fromArray,
         },
       },
-      {
-        // ScheduledPublisher creates EventBridge rules at runtime
-        // (PutRule/PutTargets) targeting this queue directly, and EventBridge
-        // authorises SQS targets against the queue's resource policy — so the
-        // grant cannot name a single rule ARN. Scope it to rules in this
-        // account instead: SourceAccount closes the cross-account hole,
-        // ArnLike narrows the in-account surface to Events rules.
-        sid: "AllowCloudWatchEventsToSendToQueue",
-        effect: Allow,
-        principal: Principals({
-          service: PrincipalId(AWS.CloudwatchEventRule.principal),
-        }),
-        actions: Actions(["sqs:SendMessage"]),
-        resources: Resource(queueArn),
-        conditions: {
-          stringEquals: [("aws:SourceAccount", ConditionValue(accountId))]->Dict.fromArray,
-          arnLike: [
-            ("aws:SourceArn", ConditionValue(`arn:aws:events:*:${accountId}:rule/*`)),
-          ]->Dict.fromArray,
-        },
-      },
     ],
   )->toJsonString
-}
 
 let createQueuePolicy = (
   queue: PulumiAws.SQS.Queue.t,
@@ -138,19 +117,20 @@ let createLambdaPolicy = (
             )
           : None
 
-      let allowLambdaWriteCloudWatchEvents = PulumiAws.PolicyDocument.make(
-        ~id=name ++ "LambdaCloudWatchEventsPolicy",
+      // The scheduler role is not known here, so the grant names every
+      // scheduler group in the account rather than this platform's one.
+      let allowLambdaManageSchedules = PulumiAws.PolicyDocument.make(
+        ~id=name ++ "LambdaSchedulerPolicy",
         ~statements=[
           {
-            sid: "AllowLambdaWriteCloudWatchEvents",
+            sid: "AllowLambdaManageSchedules",
             effect: Allow,
-            actions: Actions([
-              "events:PutRule",
-              "events:PutTargets",
-              "events:DeleteRule",
-              "events:RemoveTargets",
-            ]),
-            resources: Resource("*"),
+            actions: Actions(ScheduledPublisher_EventBridgeScheduler_Runtime.manageActions),
+            resources: Resource(
+              queueArn
+              ->accountIdOfQueueArn
+              ->ScheduledPublisher_EventBridgeScheduler_Runtime.schedulesOfAccount,
+            ),
           },
         ],
       )
@@ -172,17 +152,17 @@ let createLambdaPolicy = (
         ],
       )
 
-      let allowLambdaPassRoleToEvents = PulumiAws.PolicyDocument.make(
-        ~id=name ++ "LambdaPassRoleToCloudWatchEventsRule",
+      let allowLambdaPassRoleToScheduler = PulumiAws.PolicyDocument.make(
+        ~id=name ++ "LambdaPassRoleToScheduler",
         ~statements=[
           {
-            sid: "AllowLambdaPassRoleToEvents",
+            sid: "AllowLambdaPassRoleToScheduler",
             effect: Allow,
             actions: Action("iam:PassRole"),
             resources: Resource("*"),
             conditions: {
               stringEquals: Dict.fromArray([
-                ("iam:PassedToService", ConditionValue("events.amazonaws.com")),
+                ("iam:PassedToService", ConditionValue(AWS.EventBridgeScheduler.principal)),
               ]),
             },
           },
@@ -197,8 +177,8 @@ let createLambdaPolicy = (
             [
               Some(PulumiAws.Lambda.defaultLoggingPolicyDocument),
               Some(allowLambdaReceiveSQS),
-              Some(allowLambdaWriteCloudWatchEvents),
-              Some(allowLambdaPassRoleToEvents),
+              Some(allowLambdaManageSchedules),
+              Some(allowLambdaPassRoleToScheduler),
               allowLambdaReadWriteDynamoDb,
               allowSQSSendLambda,
             ]->Array.keepSome,

package/src/adapter/CommandTopic/CommandTopicChannel_Helpers.res.mjs

@@ -12,11 +12,10 @@ import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/sr
 import * as CommandTopic$ReventlessCore from "@reventlessdev/reventless-core/src/components/CommandTopic/CommandTopic.res.mjs";
 import * as Adapter_Helpers$ReventlessAws from "../Adapter_Helpers.res.mjs";
 import * as Util_EventSourceMapping$ReventlessAws from "../../util/Util_EventSourceMapping.res.mjs";
+import * as ScheduledPublisher_EventBridgeScheduler_Runtime$ReventlessAws from "../ScheduledPublisher/ScheduledPublisher_EventBridgeScheduler_Runtime.res.mjs";
 
 function createQueuePolicyDocument(name, queueArn, lambdaArn) {
-  let accountId = Adapter_Helpers$ReventlessAws.accountIdOfQueueArn(queueArn);
-  return PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + "QueuePolicy", [
-    {
+  return PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + "QueuePolicy", [{
       Sid: "AllowLambdaToAccessQueue",
       Principal: {
         Service: AWS$ReventlessAws.Lambda.principal
@@ -34,27 +33,7 @@ function createQueuePolicyDocument(name, queueArn, lambdaArn) {
             lambdaArn
           ]])
       }
-    },
-    {
-      Sid: "AllowCloudWatchEventsToSendToQueue",
-      Principal: {
-        Service: AWS$ReventlessAws.CloudwatchEventRule.principal
-      },
-      Effect: "Allow",
-      Action: ["sqs:SendMessage"],
-      Resource: queueArn,
-      Condition: {
-        StringEquals: Object.fromEntries([[
-            "aws:SourceAccount",
-            accountId
-          ]]),
-        ArnLike: Object.fromEntries([[
-            "aws:SourceArn",
-            `arn:aws:events:*:` + accountId + `:rule/*`
-          ]])
-      }
-    }
-  ]));
+    }]));
 }
 
 function createQueuePolicy(queue, name, lambda, opts) {
@@ -74,6 +53,7 @@ function createLambdaPolicy(lambdaRole, name, queue, resources, opts) {
     Adapter$ReventlessCore.resourcesToResolvedOutput(resources)
   ]).apply(param => {
     let resources = param[1];
+    let queueArn = param[0];
     let allowSQSSendLambda = Adapter_Helpers$ReventlessAws.sqsResources(resources).length !== 0 ? PolicyDocument$PulumiAws.make(undefined, name + "RemoteSQSLambdaPolicy", [{
           Sid: "AllowLambdaSendMessageSQS",
           Effect: "Allow",
@@ -99,16 +79,11 @@ function createLambdaPolicy(lambdaRole, name, queue, resources, opts) {
             dynamoDbResource.urn + "/index/*"
           ])
         }]) : undefined;
-    let allowLambdaWriteCloudWatchEvents = PolicyDocument$PulumiAws.make(undefined, name + "LambdaCloudWatchEventsPolicy", [{
-        Sid: "AllowLambdaWriteCloudWatchEvents",
+    let allowLambdaManageSchedules = PolicyDocument$PulumiAws.make(undefined, name + "LambdaSchedulerPolicy", [{
+        Sid: "AllowLambdaManageSchedules",
         Effect: "Allow",
-        Action: [
-          "events:PutRule",
-          "events:PutTargets",
-          "events:DeleteRule",
-          "events:RemoveTargets"
-        ],
-        Resource: "*"
+        Action: ScheduledPublisher_EventBridgeScheduler_Runtime$ReventlessAws.manageActions,
+        Resource: ScheduledPublisher_EventBridgeScheduler_Runtime$ReventlessAws.schedulesOfAccount(Adapter_Helpers$ReventlessAws.accountIdOfQueueArn(queueArn))
       }]);
     let allowLambdaReceiveSQS = PolicyDocument$PulumiAws.make(undefined, name + "SQSLambdaPolicy", [{
         Sid: "AllowLambdaReceiveSQS",
@@ -119,17 +94,17 @@ function createLambdaPolicy(lambdaRole, name, queue, resources, opts) {
           "sqs:GetQueueAttributes",
           "sqs:ChangeMessageVisibility"
         ],
-        Resource: param[0]
+        Resource: queueArn
       }]);
-    let allowLambdaPassRoleToEvents = PolicyDocument$PulumiAws.make(undefined, name + "LambdaPassRoleToCloudWatchEventsRule", [{
-        Sid: "AllowLambdaPassRoleToEvents",
+    let allowLambdaPassRoleToScheduler = PolicyDocument$PulumiAws.make(undefined, name + "LambdaPassRoleToScheduler", [{
+        Sid: "AllowLambdaPassRoleToScheduler",
         Effect: "Allow",
         Action: "iam:PassRole",
         Resource: "*",
         Condition: {
           StringEquals: Object.fromEntries([[
               "iam:PassedToService",
-              "events.amazonaws.com"
+              AWS$ReventlessAws.EventBridgeScheduler.principal
             ]])
         }
       }]);
@@ -137,8 +112,8 @@ function createLambdaPolicy(lambdaRole, name, queue, resources, opts) {
       policy: PolicyDocument$PulumiAws.mergePolicyDocuments(name + "LambdaPolicy", Stdlib_Array.keepSome([
         Lambda$PulumiAws.defaultLoggingPolicyDocument,
         allowLambdaReceiveSQS,
-        allowLambdaWriteCloudWatchEvents,
-        allowLambdaPassRoleToEvents,
+        allowLambdaManageSchedules,
+        allowLambdaPassRoleToScheduler,
         allowLambdaReadWriteDynamoDb,
         allowSQSSendLambda
       ])),

package/src/adapter/Runtime/EventCollectorEntryPoint_Ops.res

@@ -575,10 +575,12 @@ let makeQueryEngine = (pluginReadModelTableName: string): Reventless.QueryEngine
 }
 
 let makeScheduler = (schedulerRoleArn: string): ReventlessCore.Scheduler.operations => {
-  createSchedule: ScheduledPublisher_CloudWatchEvents_Runtime.createSchedule(
+  createSchedule: ScheduledPublisher_EventBridgeScheduler_Runtime.createSchedule(
+    ~roleArn=schedulerRoleArn,
+  ),
+  deleteSchedule: ScheduledPublisher_EventBridgeScheduler_Runtime.deleteSchedule(
     ~roleArn=schedulerRoleArn,
   ),
-  deleteSchedule: ScheduledPublisher_CloudWatchEvents_Runtime.deleteSchedule,
 }
 
 let makeCommandTopicResources = (config: handlerConfig): array<

package/src/adapter/Runtime/EventCollectorEntryPoint_Ops.res.mjs

@@ -18,7 +18,7 @@ import * as Util_PluginMessage_Runtime$ReventlessAws from "../../plugin/runtime/
 import * as CommandTopicChannel_SQS_Runtime$ReventlessAws from "../CommandTopic/CommandTopicChannel_SQS_Runtime.res.mjs";
 import * as EventTopicPublisher_SNS_Runtime$ReventlessAws from "../EventTopic/EventTopicPublisher_SNS_Runtime.res.mjs";
 import * as EventCollectorChannel_SQS_Runtime$ReventlessAws from "../EventCollector/EventCollectorChannel_SQS_Runtime.res.mjs";
-import * as ScheduledPublisher_CloudWatchEvents_Runtime$ReventlessAws from "../ScheduledPublisher/ScheduledPublisher_CloudWatchEvents_Runtime.res.mjs";
+import * as ScheduledPublisher_EventBridgeScheduler_Runtime$ReventlessAws from "../ScheduledPublisher/ScheduledPublisher_EventBridgeScheduler_Runtime.res.mjs";
 
 function setRequestId(prim) {
   HandlerFactoryHelpersMjs.setRequestId(prim);
@@ -445,8 +445,8 @@ function makeQueryEngine(pluginReadModelTableName) {
 
 function makeScheduler(schedulerRoleArn) {
   return {
-    createSchedule: ScheduledPublisher_CloudWatchEvents_Runtime$ReventlessAws.createSchedule(schedulerRoleArn),
-    deleteSchedule: ScheduledPublisher_CloudWatchEvents_Runtime$ReventlessAws.deleteSchedule
+    createSchedule: ScheduledPublisher_EventBridgeScheduler_Runtime$ReventlessAws.createSchedule(schedulerRoleArn),
+    deleteSchedule: ScheduledPublisher_EventBridgeScheduler_Runtime$ReventlessAws.deleteSchedule(schedulerRoleArn)
   };
 }
 

package/src/adapter/Runtime/PluginExtensionPointEntryPoint.res

@@ -131,10 +131,11 @@ let queryEngine: Reventless.QueryEngine.operations = {
 
 // Reconstruct scheduler
 let scheduler: ReventlessCore.Scheduler.operations = {
-  createSchedule: ScheduledPublisher_CloudWatchEvents_Runtime.createSchedule(
-    ~roleArn=config.schedulerRoleArn->Option.getOr(""),
-  ),
-  deleteSchedule: ScheduledPublisher_CloudWatchEvents_Runtime.deleteSchedule,
+  let roleArn = config.schedulerRoleArn->Option.getOr("")
+  {
+    createSchedule: ScheduledPublisher_EventBridgeScheduler_Runtime.createSchedule(~roleArn),
+    deleteSchedule: ScheduledPublisher_EventBridgeScheduler_Runtime.deleteSchedule(~roleArn),
+  }
 }
 
 // CommandTopic resources for scheduler targets

package/src/adapter/Runtime/PluginExtensionPointEntryPoint.res.mjs

@@ -10,7 +10,7 @@ import * as PluginExtensionPointSpec$ReventlessInfra from "@reventlessdev/revent
 import * as Util_PluginMessage_Runtime$ReventlessAws from "../../plugin/runtime/Util_PluginMessage_Runtime.res.mjs";
 import * as PluginExtensionPoint_Plugin$ReventlessCore from "@reventlessdev/reventless-core/src/plugin/connect/PluginExtensionPoint_Plugin.res.mjs";
 import * as CommandTopicChannel_SQS_Runtime$ReventlessAws from "../CommandTopic/CommandTopicChannel_SQS_Runtime.res.mjs";
-import * as ScheduledPublisher_CloudWatchEvents_Runtime$ReventlessAws from "../ScheduledPublisher/ScheduledPublisher_CloudWatchEvents_Runtime.res.mjs";
+import * as ScheduledPublisher_EventBridgeScheduler_Runtime$ReventlessAws from "../ScheduledPublisher/ScheduledPublisher_EventBridgeScheduler_Runtime.res.mjs";
 
 function setRequestId(prim) {
   HandlerFactoryHelpersMjs.setRequestId(prim);
@@ -93,11 +93,15 @@ let queryEngine = {
   query: queryEngine_query
 };
 
-let scheduler_createSchedule = ScheduledPublisher_CloudWatchEvents_Runtime$ReventlessAws.createSchedule(Stdlib_Option.getOr(config.schedulerRoleArn, ""));
+let roleArn = Stdlib_Option.getOr(config.schedulerRoleArn, "");
+
+let scheduler_createSchedule = ScheduledPublisher_EventBridgeScheduler_Runtime$ReventlessAws.createSchedule(roleArn);
+
+let scheduler_deleteSchedule = ScheduledPublisher_EventBridgeScheduler_Runtime$ReventlessAws.deleteSchedule(roleArn);
 
 let scheduler = {
   createSchedule: scheduler_createSchedule,
-  deleteSchedule: ScheduledPublisher_CloudWatchEvents_Runtime$ReventlessAws.deleteSchedule
+  deleteSchedule: scheduler_deleteSchedule
 };
 
 let schedulerQueueArn = Stdlib_Option.getOr(config.schedulerQueueArn, "");

package/src/adapter/Runtime/TaskBucketEntryPoint_Ops.res

@@ -6,13 +6,8 @@
 // the read of its `callback` export. HANDLER_CONFIG parsing, the S3-event →
 // task-action dispatch (an exhaustive match over Reventless.Task.taskAction —
 // the former JS `switch (action.TAG)` with its unreachable "unknown TAG" arm), the
-// per-aggregate command publishing, and the CloudWatch Events scheduler ops
+// per-aggregate command publishing, and the EventBridge Scheduler ops
 // live here, fully type-checked.
-//
-// The former `.mjs` carried a hand-maintained mirror of
-// `toScheduleExpression` ("kept in sync manually"); typed code calls
-// ScheduledPublisher_CloudWatchEvents_Runtime directly — the layer ships it —
-// so the mirror is gone.
 
 @module("./HandlerFactoryHelpers.mjs") @scope("log")
 external logWarn: (string, StreamRoutedEntryPoint_Ops.dispatchOpts) => unit = "warn"
@@ -80,9 +75,9 @@ let buildPublishCommands = (map: dict<string>): dict<ReventlessCore.CommandTopic
   )
   ->Dict.fromArray
 
-// ── Scheduler ops (CloudWatch Events) ───────────────────────────────────────
+// ── Scheduler ops (EventBridge Scheduler) ───────────────────────────────────────
 // Resolved lazily on the first schedule action (tasks without schedules never
-// touch the CloudWatch client) and cached for the container lifetime.
+// touch the Scheduler client) and cached for the container lifetime.
 
 type schedulerOps = {
   createSchedule: Reventless.Schedule.schedule => promise<unit>,
@@ -103,8 +98,8 @@ let makeSchedulerOps = (config: option<schedulerEnvConfig>): option<schedulerOps
     ) {
     | (Some(roleArn), Some(targetArn), Some(targetName))
       if roleArn != "" && targetArn != "" && targetName != "" =>
-      // The single resolved resource the shared CloudWatch Events runtime
-      // targets: `urn` is the PutTargets ARN, `name` the target id.
+      // The single resolved resource the shared scheduler runtime
+      // targets: `urn` is the target queue ARN.
       let resources: array<ReventlessInfra.Adapter.resolvedResource> = [
         {
           name: targetName,
@@ -121,9 +116,12 @@ let makeSchedulerOps = (config: option<schedulerEnvConfig>): option<schedulerOps
       ]
       let ops = {
         createSchedule: schedule =>
-          ScheduledPublisher_CloudWatchEvents_Runtime.createSchedule(~roleArn)(resources, schedule),
+          ScheduledPublisher_EventBridgeScheduler_Runtime.createSchedule(~roleArn)(
+            resources,
+            schedule,
+          ),
         deleteSchedule: name =>
-          ScheduledPublisher_CloudWatchEvents_Runtime.deleteSchedule(resources, name),
+          ScheduledPublisher_EventBridgeScheduler_Runtime.deleteSchedule(~roleArn)(resources, name),
       }
       schedulerOpsCache := Some(ops)
       Some(ops)

package/src/adapter/Runtime/TaskBucketEntryPoint_Ops.res.mjs

@@ -6,7 +6,7 @@ import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as HandlerFactoryHelpersMjs from "./HandlerFactoryHelpers.mjs";
 import * as TaskBucket_S3_Runtime$ReventlessAws from "../Task/TaskBucket_S3_Runtime.res.mjs";
 import * as CommandTopicChannel_SQS_Runtime$ReventlessAws from "../CommandTopic/CommandTopicChannel_SQS_Runtime.res.mjs";
-import * as ScheduledPublisher_CloudWatchEvents_Runtime$ReventlessAws from "../ScheduledPublisher/ScheduledPublisher_CloudWatchEvents_Runtime.res.mjs";
+import * as ScheduledPublisher_EventBridgeScheduler_Runtime$ReventlessAws from "../ScheduledPublisher/ScheduledPublisher_EventBridgeScheduler_Runtime.res.mjs";
 
 function logWarn(prim0, prim1) {
   HandlerFactoryHelpersMjs.log.warn(prim0, prim1);
@@ -80,8 +80,8 @@ function makeSchedulerOps(config) {
         configuration: {},
         tags: {}
       }];
-    let ops_createSchedule = schedule => ScheduledPublisher_CloudWatchEvents_Runtime$ReventlessAws.createSchedule(match$1)(resources, schedule);
-    let ops_deleteSchedule = name => ScheduledPublisher_CloudWatchEvents_Runtime$ReventlessAws.deleteSchedule(resources, name);
+    let ops_createSchedule = schedule => ScheduledPublisher_EventBridgeScheduler_Runtime$ReventlessAws.createSchedule(match$1)(resources, schedule);
+    let ops_deleteSchedule = name => ScheduledPublisher_EventBridgeScheduler_Runtime$ReventlessAws.deleteSchedule(match$1)(resources, name);
     let ops = {
       createSchedule: ops_createSchedule,
       deleteSchedule: ops_deleteSchedule

package/src/adapter/Runtime/TaskRuntime_Builder_PerBucket.res

@@ -82,9 +82,9 @@ let forBucketCallback = (
     ~opts={Pulumi.ComponentResource.parent: resource},
   )
 
-  // Grant the Task Lambda role permission to manage CloudWatch Events rules
-  // and pass the scheduler role to events. Only needed when a schedulerConfig
-  // is present (Tasks with side effects).
+  // Grant the Task Lambda role permission to manage the schedules in the
+  // scheduler's group and pass the scheduler role to them. Only needed when a
+  // schedulerConfig is present (Tasks with side effects).
   switch schedulerConfig {
   | None => ()
   | Some({schedulerRoleUrn}) =>
@@ -97,10 +97,12 @@ let forBucketCallback = (
             ~id=`${fullName}SchedulerPolicy`,
             ~statements=[
               {
-                sid: "AllowCloudWatchEvents",
+                sid: "AllowManageSchedules",
                 effect: Allow,
-                actions: Action("events:*"),
-                resources: AllResources,
+                actions: Actions(ScheduledPublisher_EventBridgeScheduler_Runtime.manageActions),
+                resources: Resource(
+                  arn->ScheduledPublisher_EventBridgeScheduler_Runtime.schedulesOfRoleArn,
+                ),
               },
               {
                 sid: "AllowPassSchedulerRole",

package/src/adapter/Runtime/TaskRuntime_Builder_PerBucket.res.mjs

@@ -8,6 +8,7 @@ import * as Component$ReventlessCore from "@reventlessdev/reventless-core/src/co
 import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
 import * as Util_Bundle$ReventlessAws from "../../util/Util_Bundle.res.mjs";
 import * as RuntimeEnvironment_Lambda$ReventlessAws from "./RuntimeEnvironment_Lambda.res.mjs";
+import * as ScheduledPublisher_EventBridgeScheduler_Runtime$ReventlessAws from "../ScheduledPublisher/ScheduledPublisher_EventBridgeScheduler_Runtime.res.mjs";
 
 function forBucketCallback(param, connect, memorySizeOpt, timeoutOpt, name, callbackModulePath, publishToAggregatesQueueUrls, schedulerConfig, task) {
   let memorySize = memorySizeOpt !== undefined ? memorySizeOpt : 4096;
@@ -38,10 +39,10 @@ function forBucketCallback(param, connect, memorySizeOpt, timeoutOpt, name, call
       new (Aws.iam.RolePolicy)(fullName + `SchedulerPolicy`, {
         policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, fullName + `SchedulerPolicy`, [
           {
-            Sid: "AllowCloudWatchEvents",
+            Sid: "AllowManageSchedules",
             Effect: "Allow",
-            Action: "events:*",
-            Resource: "*"
+            Action: ScheduledPublisher_EventBridgeScheduler_Runtime$ReventlessAws.manageActions,
+            Resource: ScheduledPublisher_EventBridgeScheduler_Runtime$ReventlessAws.schedulesOfRoleArn(arn)
           },
           {
             Sid: "AllowPassSchedulerRole",

package/src/adapter/ScheduledPublisher/ScheduledPublisher.res

@@ -1,2 +1,2 @@
-module CloudWatchEvents = ScheduledPublisher_CloudWatchEvents
-module CloudWatchEvents_Runtime = ScheduledPublisher_CloudWatchEvents_Runtime
+module EventBridgeScheduler = ScheduledPublisher_EventBridgeScheduler
+module EventBridgeScheduler_Runtime = ScheduledPublisher_EventBridgeScheduler_Runtime

package/src/adapter/ScheduledPublisher/ScheduledPublisher.res.mjs

@@ -1,12 +1,12 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
 
-let CloudWatchEvents;
+let EventBridgeScheduler;
 
-let CloudWatchEvents_Runtime;
+let EventBridgeScheduler_Runtime;
 
 export {
-  CloudWatchEvents,
-  CloudWatchEvents_Runtime,
+  EventBridgeScheduler,
+  EventBridgeScheduler_Runtime,
 }
 /* No side effect */