EventBridge global endpoint has event replication enabled

Check ID: eventbridge_global_endpoint_event_replication_enabled
Provider: AWS
Service: eventbridge
Severity: MEDIUM
Categories: resilience
Resource type: AwsEventsEndpoint

What this check verifies

EventBridge global endpoints are configured with event replication ENABLED (not DISABLED) so custom events are replicated to both the primary and secondary Regions.

Risk

No event replication degrades availability and increases RPO during Regional outages.

Events can be lost or delayed if the primary Region fails
Automatic recovery to the primary may not occur, prolonging failover
Cross-Region inconsistency can affect data integrity

Recommendation

Turn on event replication for global endpoints to ensure Regional resilience. Keep event buses, rules, and targets aligned across Regions. Use a dedicated IAM role with least privilege for replication. Design consumers for idempotency with unique IDs. Regularly test failover and monitor health as part of defense in depth.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws events update-endpoint --name <endpoint-name> --replication-config State=ENABLED --role-arn <role-arn>

# Terraform (awscc): Enable event replication on an EventBridge global endpoint
resource "awscc_events_endpoint" "example" {
  name = "<example_resource_name>"

  event_buses = [
    { event_bus_arn = "arn:aws:events:us-east-1:<example_resource_id>:event-bus/<example_resource_name>" },
    { event_bus_arn = "arn:aws:events:us-west-2:<example_resource_id>:event-bus/<example_resource_name>" }
  ]

  routing_config = {
    failover_config = {
      primary   = { health_check = "arn:aws:route53:::healthcheck/<example_resource_id>" }
      secondary = { route        = "us-west-2" }
    }
  }

  replication_config = { state = "ENABLED" }  # Critical: enables event replication
  role_arn           = "arn:aws:iam::<example_resource_id>:role/<example_resource_name>"  # Critical: role used by replication
}

# CloudFormation: Enable event replication on an EventBridge global endpoint
Resources:
  Endpoint:
    Type: AWS::Events::Endpoint
    Properties:
      Name: <example_resource_name>
      EventBuses:
        - EventBusArn: arn:aws:events:us-east-1:<example_resource_id>:event-bus/<example_resource_name>
        - EventBusArn: arn:aws:events:us-west-2:<example_resource_id>:event-bus/<example_resource_name>
      RoutingConfig:
        FailoverConfig:
          Primary:
            HealthCheck: arn:aws:route53:::healthcheck/<example_resource_id>
          Secondary:
            Route: us-west-2
      ReplicationConfig:
        State: ENABLED  # Critical: enables event replication
      RoleArn: arn:aws:iam::<example_resource_id>:role/<example_resource_name>  # Critical: role used by replication

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = eventbridge_global_endpoint_event_replication_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

AWS EventBridge event bus policy blocks public access AWS EventBridge schema registry blocks cross-account access

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires