View a markdown version of this page

Permissions by scenario - Amazon EventBridge

Permissions by scenario

Each role in a Custom Event Bus deployment needs a small, specific set of grants. This page lists them by scenario so that you can copy the set for the role you are creating. For example, a producer's role needs events:PutEvents or events:PutRawEvents on the bus ARN. If the bus uses a customer managed key, the key's policy must also allow the events.amazonaws.com principal.

The following table lists the permission grants for each scenario. In the ARN patterns, replace region, account, and name with your own values.

Permission grants by scenario

Scenario

Who needs the grant

Grants

Publish to a bus

The producer's identity

events:PutEvents or events:PutRawEvents on the bus ARN. events:DescribeEventBus to confirm the bus is ACTIVE.

Publish Avro or Protobuf with a schema registry

The role in PutRawEvents RoleArn

Read access to the schema in the registry. For a Glue registry, grant the Glue Schema Registry read actions. For a Confluent registry, grant the secret and network access it requires. The role trusts events.amazonaws.com. See Supported content types: JSON, Avro, Protobuf, and raw bytes.

Publish to a bus in another account

The producer's identity, and the bus

The publish action in the producer's identity policy. The bus must also grant the same action to the producer's account through an AWS RAM share or the bus resource policy.

Create and manage subscribers

The subscriber owner's identity

events:CreateSubscriber on the bus and on arn:aws:events:region:account:subscriber/name/*. iam:PassRole on the delivery role. events:DescribeSubscriber, events:UpdateSubscriber, and events:DeleteSubscriber on the subscriber. events:UpdateSubscriber on the bus if the update includes a FilterConfiguration. events:TagResource if the create carries tags.

Deliver to a target

The delivery role

Trust for events.amazonaws.com. The target's action. sqs:SendMessage on the dead-letter queue. The target's key actions if the target is encrypted. See The delivery role.

Attach an event source

The event source owner's identity, the dead-letter queue, and the key

events:CreateEventSource on the bus and on the event source. A queue policy must allow events.amazonaws.com to call sqs:SendMessage on the dead-letter queue. If the bus is encrypted, the key policy must allow events.amazonaws.com. See Event sources for a Custom Event Bus.

Administer a bus

The bus owner's identity

events:CreateEventBus, events:UpdateEventBus, events:DeleteEventBus, events:PutResourcePolicy, events:GetResourcePolicy, events:DeleteResourcePolicy, events:ListResourcePolicies, and events:RevokeResource. ram:CreateResourceShare and related AWS RAM actions to share it.

Encrypt a bus with your own key

The key policy

The bus creator's identity needs kms:DescribeKey. That identity, all producers, all subscriber owners, and the events.amazonaws.com principal need kms:Decrypt, kms:Encrypt, kms:GenerateDataKeyWithoutPlaintext, kms:ReEncryptFrom, and kms:ReEncryptTo, scoped to the bus with the aws:events:event-busv2:arn encryption context. See Configuring permissions to use a Customer Managed KMS Key.

For the full action list and condition keys, see Actions, resources, and condition keys for the Custom Event Bus. For sharing, see Sharing a Custom Event Bus with other accounts.