Crontab Syntax Explained: Building 5-Part & 6-Part Cron Schedules for Linux, Kubernetes & AWS

Automating Background Tasks with Cron

From database backups and cache warming to automated billing runs and SSL certificate renewals, scheduled background jobs are the heartbeat of backend engineering and DevOps infrastructure. Since the early days of Unix in the 1970s, the cron daemon has been the gold standard for time-based job scheduling.

Yet even experienced senior engineers frequently search for crontab syntax cheat sheets. The subtle differences between 5-field Unix cron, 6-field Kubernetes CronJobs, and AWS EventBridge schedules can easily lead to jobs firing at unexpected intervals or running twice simultaneously.

In this guide, we break down crontab syntax, demonstrate practical production recipes, and explain how modern cloud platforms interpret cron expressions.

Build, explain, and preview upcoming run times visually with our free Cron Expression Generator.

Anatomy of the Standard 5-Field Linux Cron Expression

A standard Unix/Linux crontab entry consists of five time fields followed by the shell command to execute:

┌───────────── Minute (0 - 59)
│ ┌───────────── Hour (0 - 23)
│ │ ┌───────────── Day of Month (1 - 31)
│ │ │ ┌───────────── Month (1 - 12 or JAN - DEC)
│ │ │ │ ┌───────────── Day of Week (0 - 6 or SUN - SAT, 0 = Sunday)
│ │ │ │ │
* * * * *  /usr/bin/python3 /opt/scripts/backup.py

The Four Core Cron Operators:

1. Asterisk (*): Represents "every" unit. * * * * * means execute every single minute.
2. Comma (,): Separates discrete list values. 0 8,12,18 * * * means execute at 8:00 AM, 12:00 PM, and 6:00 PM.
3. Hyphen (-): Defines inclusive ranges. 0 9-17 * * 1-5 means hourly from 9 AM to 5 PM, Monday through Friday.
4. Forward Slash (/): Defines step intervals. */15 * * * * means every 15 minutes.

Production Cron Recipes Cheat Sheet

The Subtle "Day of Month" vs. "Day of Week" Trap

One of the most common pitfalls in standard cron is setting both Day of Month and Day of Week:

// What does this do?
0 0 15 * 5  /scripts/audit.sh

Most developers assume this means "Run on the 15th of the month ONLY IF it is a Friday".

This is incorrect! In standard POSIX crontab, when both Day of Month and Day of Week are specified, the relationship is a logical OR, not an AND. The script will execute on the 15th of the month, AND on every single Friday!

To enforce an AND condition in Linux, check the day in your shell script:

0 0 15 * *  [ $(date +%u) -eq 5 ] && /scripts/audit.sh

Translating Cron Across Cloud Platforms

1. Kubernetes CronJob Specification

Kubernetes uses standard 5-part cron syntax in the spec.schedule field. Crucially, always configure a concurrency policy to prevent overlapping executions if a job takes longer than the interval:

apiVersion: batch/v1
kind: CronJob
metadata:
  name: nightly-cache-purge
spec:
  schedule: "0 2 * * *"
  concurrencyPolicy: Forbid  # Prevents job stacking
  jobTemplate:
    spec:
      template:
        spec:
          containers:
          - name: purge
            image: alpine:latest
            command: ["/bin/sh", "-c", "echo 'Cache purged'"]
          restartPolicy: OnFailure

2. AWS EventBridge & CloudWatch (6-Part Syntax)

AWS EventBridge adds a mandatory 6th field for Year and requires replacing either Day-of-Month or Day-of-Week with a question mark (?):

cron(Minutes Hours Day-of-month Month Day-of-week Year)
cron(0 12 ? * MON-FRI *)  # Weekdays at 12:00 PM UTC

Visual builders eliminate configuration errors. Generate, explain, and copy deployment syntax for Linux, Kubernetes, and AWS using our Cron Expression Generator.