AWS EventBridge event bus blocks cross-account access

Check ID: eventbridge_bus_cross_account_access
Provider: AWS
Service: eventbridge
Severity: HIGH
Categories: identity-access, trust-boundaries
Resource type: AwsEventsEventbus

What this check verifies

EventBridge event bus has a resource policy that grants cross-account event delivery to principals outside the account, including broad or public access. Focus is on buses whose policies permit external accounts to send events.

Risk

Cross-account event injection can erode integrity and availability. Spoofed events may trigger rules and invoke downstream targets, causing unintended actions, data exposure via targets, lateral movement through over-privileged roles, and cost or service disruption from event floods.

Recommendation

Apply least privilege on the event bus resource policy: allow only specific account IDs or org scope (e.g., aws:PrincipalOrgID) and avoid wildcard Principal or *. Constrain rules to trusted senders using the account field and vetted sources, and add monitoring/throttling for defense in depth.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws events remove-permission —event-bus-name <event_bus_name> —statement-id <statement_id>

# Terraform: restrict EventBridge event bus to same account only
resource "aws_cloudwatch_event_permission" "<example_resource_name>" {
  statement_id   = "<example_resource_id>"
  action         = "events:PutEvents"
  principal      = "<example_resource_id>" # Critical: set to your own AWS account ID to block cross-account access
  event_bus_name = "<example_resource_name>"
}

# CloudFormation: restrict EventBridge event bus to same account only
Resources:
  <example_resource_name>:
    Type: AWS::Events::EventBusPolicy
    Properties:
      StatementId: <example_resource_id>
      Action: events:PutEvents
      Principal: !Ref AWS::AccountId  # Critical: allows only this AWS account, blocking cross-account access
      EventBusName: <example_resource_name>

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = eventbridge_bus_cross_account_access. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

EMR cluster is not publicly accessible AWS EventBridge event bus policy blocks public access

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires