Skip to content

EventBridge custom event buses should have a resource-based policy attached

Identifier

eventbridge-attach-resource-based-policy

Category

Protect > Secure access management > Resource not publicly accessible

Description

This control checks whether Amazon EventBridge custom event buses have a resource-based policy attached using the aws_cloudwatch_event_bus_policy resource. Resource-based policies are essential for controlling who can send or receive events from your custom event bus, especially in cross-account scenarios.

Attaching a policy ensures that only explicitly authorized principals can interact with your event bus, helping to enforce least privilege and protect sensitive event data.

Non Compliant Example

Terraform
1
2
3
resource "aws_cloudwatch_event_bus" "foo" {
  name = "messages"
}

Remediation

Use the aws_cloudwatch_event_bus_policy resource to attach a policy that defines access:

Terraform
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
resource "aws_cloudwatch_event_bus" "foo" {
  name = "test-messages"
}

data "aws_iam_policy_document" "foo" {
  statement {
    sid    = "DevAccountAccess"
    effect = "Allow"
    actions = [
      "events:PutEvents",
    ]
    resources = [
      aws_cloudwatch_event_bus.foo.arn
    ]

    principals {
      type        = "AWS"
      identifiers = [local.account_id]
    }
  }
}

resource "aws_cloudwatch_event_bus_policy" "foo" {
  policy         = data.aws_iam_policy_document.foo.json
  event_bus_name = aws_cloudwatch_event_bus.foo.name
}

Extra Resources