AWS EventBridge schema registry blocks cross-account access

# Restrict EventBridge Schema Registry policy to same account only
resource "aws_schemas_registry_policy" "<example_resource_name>" {
  registry_name = "<example_resource_name>"

  # Critical: Principal limited to same account to remove cross-account access
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect    = "Allow"
      Principal = { AWS = "arn:aws:iam::<example_account_id>:root" }
      Action    = "schemas:*"
      Resource  = "*"
    }]
  })
}

# CloudFormation: Restrict EventBridge Schema Registry policy to same account only
Resources:
  <example_resource_name>RegistryPolicy:
    Type: AWS::EventSchemas::RegistryPolicy
    Properties:
      RegistryName: <example_resource_name>
      # Critical: Principal limited to this AWS account to prevent cross-account access
      Policy: !Sub |
        {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Principal": { "AWS": "arn:${AWS::Partition}:iam::${AWS::AccountId}:root" },
              "Action": "schemas:*",
              "Resource": "*"
            }
          ]
        }