Check ID:
Provider: AWS
Service:
Severity: HIGH
Categories:
Resource type:
eventbridge_bus_exposedProvider: AWS
Service:
eventbridgeSeverity: HIGH
Categories:
internet-exposedResource type:
AwsEventsEventbusWhat this check verifies
EventBridge event bus resource policy is evaluated for public access, such as aPrincipal: "*" or overly broad conditions that allow any AWS account to publish events or manage rules on the bus.
Risk
Publicly accessible event buses enable event injection and unauthorized rule changes, undermining integrity and enabling lateral movement. Attackers can trigger downstream targets, causing data exposure, service disruption, and unexpected costs through high-volume events.Recommendation
Apply least privilege resource policies: limit principals to specific accounts or your organization, and constrain actions and event attributes (e.g.,source, detail-type). Avoid Principal: "*".
Use defense in depth with rule patterns that include the expected account. Monitor policy changes and bus activity.
Remediation
- CLI
- Terraform
- Native IaC
- Dashboard steps
aws events remove-permission —event-bus-name <event_bus_name> —statement-id <statement_id>
References
- https://docs.aws.amazon.com/AmazonCloudWatch/latest/events/CloudWatchEvents-CrossAccountEventDelivery.html
- https://docs.aws.amazon.com/AmazonCloudWatch/latest/events/CWE_GettingStarted.html
- https://www.trendmicro.com/trendaivisiononecloudriskmanagement/knowledge-base/aws/CloudWatchEvents/event-bus-exposed.html
- https://aws.amazon.com/blogs/compute/simplifying-cross-account-access-with-amazon-eventbridge-resource-policies/
Where this check fires
This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable byCheck ID = eventbridge_bus_exposed. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks