Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Encrypting EventBridge event buses with Amazon KMS keys

You can specify that EventBridge use an Amazon KMS to encrypt your data stored on an event bus, rather than use an Amazon owned key as is the default. You can specify a customer managed key when you create or update an event bus. You can also update the default event bus to use a customer managed key for encryption as well. For more information, see KMS key options.

When you specify a customer managed key for an event bus, EventBridge uses that key to encrypt the following:

If you specify a customer managed key for an event bus, you have the option of specifying a dead-letter queue (DLQ) for the event bus. EventBridge then delivers any custom or partner events that generate encryption or decryption errors to that DLQ. For more information, see DLQs for encrypted events.

You can also specify using customer managed keys for encrypting event bus archives. For more information, see Encrypting archives.

Event bus encryption context

An encryption context is a set of key–value pairs that contain arbitrary nonsecret data. When you include an encryption context in a request to encrypt data, Amazon KMS cryptographically binds the encryption context to the encrypted data. To decrypt the data, you must pass in the same encryption context.

You can also use the encryption context as a condition for authorization in policies and grants.

If you use a customer managed key to protect your EventBridge resources, you can use the encryption context to identify use of the KMS key in audit records and logs. It also appears in plaintext in logs, such as Amazon CloudTrail and Amazon CloudWatch Logs.

For event buses, EventBridge uses the same encryption context in all Amazon KMS cryptographic operations. The context includes a single key–value pair, which contains the event bus ARN.

"encryptionContext": {
    "kms:EncryptionContext:aws:events:event-bus:arn": "event-bus-arn"
}

Amazon KMS key policy for event bus

The following example key policy provides the required permissions for an event bus:

As a security best practice, we recommend you include condition keys in the key policy to helps ensure that EventBridge uses the KMS key only for the specified resource or account. For more information, see Security considerations.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowEventBridgeToValidateKeyPermission",
      "Effect": "Allow",
      "Principal": {
      "Service": "events.amazonaws.com"
       },
      "Action": [
        "kms:DescribeKey"
        ],
      "Resource": "*"
    },
  {
    "Sid": "AllowEventBridgeToEncryptEvents",
    "Effect": "Allow",
    "Principal": {
      "Service": "events.amazonaws.com"
    },
    "Action": [
      "kms:GenerateDataKey",
      "kms:Decrypt"
    ],
    "Resource": "*",
    "Condition": {
      "StringEquals": {
          "kms:EncryptionContext:aws:events:event-bus:arn": "arn:aws-cn:events:us-east-1:123456789012:event-bus/event-bus-arn",
          "aws:SourceArn": "arn:aws-cn:events:us-east-1:123456789012:event-bus/event-bus-name"
        }
      } 
    }
  ] }

Amazon KMS key permissions for event bus actions

To create or update an event bus encrypted using a customer managed key, you must have the following permissions to the specified customer managed key:

In addition, to perform certain event bus actions on an event bus encrypted using a customer managed key, you must have kms:Decrypt permission for the specified customer managed key. These actions include: