AWS cron expressions: the EventBridge 6-field format

If you schedule anything on AWS — EventBridge rules, EventBridge Scheduler, or the older CloudWatch Events — the cron syntax is not the Unix one. AWS uses six fields wrapped in cron(...), adds a ? wildcard and a year field, evaluates everything in UTC (for classic rules), and numbers weekdays differently. This page walks through each difference so you can convert confidently. For plain 5-field cron, use our cron expression generator instead.

The six fields

Position	Field	Values	Wildcards
1	Minutes	0–59	`, - * /`
2	Hours	0–23	`, - * /`
3	Day of month	1–31	`, - * / ? L W`
4	Month	1–12 or JAN–DEC	`, - * /`
5	Day of week	1–7 or SUN–SAT (1 = Sunday)	`, - * / ? L #`
6	Year	1970–2199	`, - * /`

Example: cron(0 12 * * ? *) — every day at 12:00 UTC. The trailing * is the year; you will almost always leave it as *, but it lets you build schedules like “first of January 2027 only”: cron(0 0 1 1 ? 2027).

The `?` rule

AWS does not let you constrain day-of-month and day-of-week in the same expression — not even with * in both. Exactly one of the two must be ?, which reads as “no specific value; the other day field decides”. So “every Monday at 09:00” is cron(0 9 ? * MON *), and “the 1st of each month at 09:00” is cron(0 9 1 * ? *). This sidesteps the notorious Unix OR-behaviour between the two day fields by simply forbidding the combination.

Sunday is 1, not 0

Unix cron counts Sunday as 0 (or 7) and Monday as 1. AWS counts Sunday as 1 through Saturday as 7. A Unix 1-5 (Mon–Fri) becomes 2-6 — or better, write MON-FRI, which means the same thing in both dialects and cannot be misread.

Extra characters: L, W and #

L in day-of-month = last day of the month; in day-of-week, 6L = the last Friday.
W = nearest weekday: 15W fires on the weekday closest to the 15th.
# = nth weekday: MON#2 (or 2#2) is the second Monday of the month.

None of these exist in portable 5-field cron — they are the main reason some AWS schedules cannot be translated back to a crontab one-liner.

Conversion table: Unix ⇄ AWS

Schedule	Unix (5-field)	AWS EventBridge
Every 5 minutes	`/5 * * *`	`cron(/5 * * ? *)`
Daily at midnight (UTC)	`0 0 * * *`	`cron(0 0 * * ? *)`
Hourly on the hour	`0 * * * *`	`cron(0 * * * ? *)`
Weekdays 09:30	`30 9 * * 1-5`	`cron(30 9 ? * MON-FRI *)`
1st of month, 00:00	`0 0 1 * *`	`cron(0 0 1 * ? *)`

The mechanical steps: (1) keep minute/hour/month as-is; (2) decide which day field you are using and put ? in the other; (3) shift numeric weekdays by one or switch to names; (4) append the year *. For simple rates AWS also offers rate(5 minutes) expressions, which are often clearer than cron for “every N” schedules.

UTC, and the timezone trap

Classic EventBridge rules evaluate cron in UTC — cron(0 0 * * ? *) is midnight UTC, which is 09:00 in Seoul and 19:00 in winter (20:00 in summer) in New York. The newer EventBridge Scheduler accepts a timezone per schedule and even handles DST for you. When migrating a crontab from a server that ran in local time, translate the hours explicitly; “the report suddenly arrives 9 hours early” is the classic symptom of skipping this step.

FAQ

How many fields does an AWS cron expression have?

Six: minutes, hours, day-of-month, month, day-of-week, year — wrapped as cron(...) in EventBridge. Standard Unix cron has five and no year field, which is why pasting an AWS expression into a normal crontab fails.

What does the ? mean in AWS cron?

? means "no specific value" and exists because EventBridge does not allow both day-of-month and day-of-week to be specified (or both to be *) in the same expression. You give a value in one of the two and put ? in the other.

Is AWS cron in UTC or local time?

EventBridge rules evaluate cron expressions in UTC. EventBridge Scheduler (the newer scheduling service) additionally lets you pick a timezone per schedule. If your rule seems to fire at the "wrong" hour, a UTC offset is almost always the reason.

What number is Sunday in AWS cron?

In the day-of-week field AWS uses 1-7 with 1 = Sunday (SUN), so Monday is 2 and Saturday is 7. That is different from Unix cron, where Sunday is 0 (or 7) and Monday is 1 — adjust the numbers when converting, or use the three-letter names to stay unambiguous.

Can AWS cron run more often than once a minute?

No. The finest resolution of an EventBridge cron or rate expression is one minute. For sub-minute work you would fan out inside your target (for example, a Lambda that loops with delays) or use a different service.