All checks
Low
EventBridge custom event buses should have a resource-based policy attached
Checks that the custom event bus has a resource-based policy attached; any policy passes, whatever it grants. Without one, access rests on the account's IAM policies alone; a policy lets you limit the bus to specified accounts and grant another account access deliberately.
- service
- EventBridge
- severity
- Low
- scope
- evaluated in every region
How to fix it
In the console
EventBridge → Event buses → the event bus → Manage permissions
- Resource-based policy
- Allow events:PutEvents only to named accounts, or to "*" with an aws:PrincipalOrgID condition
With the AWS CLI
aws events put-permission --event-bus-name <event-bus-name> --policy file://event-bus-policy.json --region <region>With Terraform
resource "aws_cloudwatch_event_bus_policy" "this" {
event_bus_name = var.event_bus_name
policy = data.aws_iam_policy_document.event_bus.json
}See which of your accounts this check is failing on.
Book a live scan