Event source permissions for Amazon EventBridge Pipes
When settings up a pipe, you can use an existing execution role, or have EventBridge create one for you with the needed permissions. The permissions EventBridge Pipes requires vary based on the source type, and are listed below. If you’re setting up your own execution role, you must add these permissions yourself.
Note
If you’re unsure of the exact well-scoped permissions required to access the source, use the EventBridge Pipes console to create a new role, then inspect the actions listed in the policy.
Topics
DynamoDB execution role permissions
For DynamoDB Streams, EventBridge Pipes requires the following permissions to manage resources that are related to your DynamoDB data stream.
To send records of failed batches to the pipe dead-letter queue, your pipe execution role needs the following permission:
Kinesis execution role permissions
For Kinesis, EventBridge Pipes requires the following permissions to manage resources that are related to your Kinesis data stream.
To send records of failed batches to the pipe dead-letter queue, your pipe execution role needs the following permission:
Amazon MQ execution role permissions
For Amazon MQ, EventBridge Pipes requires the following permissions to manage resources that are related to your Amazon MQ message broker.
Amazon MSK execution role permissions
For Amazon MSK, EventBridge requires the following permissions to manage resources that are related to your Amazon MSK topic.
Note
If you're using IAM role-based authentication, your execution role will need the permissions listed in IAM role-based authentication in addition the ones listed below.
Self managed Apache Kafka execution role permissions
For self managed Apache Kafka, EventBridge requires the following permissions to manage resources that are related to your self managed Apache Kafka stream.
Required permissions
To create and store logs in a log group in Amazon CloudWatch Logs, your pipe must have the following permissions in its execution role:
Optional permissions
Your pipe might also need permissions to:
Describe your Secrets Manager secret.
Access your Amazon Key Management Service (Amazon KMS) customer managed key.
Access your Amazon VPC.
Secrets Manager and Amazon KMS permissions
Depending on the type of access control that you're configuring for your Apache Kafka brokers, your pipe might need permission to access your Secrets Manager secret or to decrypt your Amazon KMS customer managed key. To access these resources, your function's execution role must have the following permissions:
VPC permissions
If only users within a VPC can access your self managed Apache Kafka cluster, your pipe must have permission to access your Amazon VPC resources. These resources include your VPC, subnets, security groups, and network interfaces. To access these resources, your pipe's execution role must have the following permissions:
Amazon SQS execution role permissions
For Amazon SQS, EventBridge requires the following permissions to manage resources that are related to your Amazon SQS queue.
Enrichment and target permissions
To make API calls on the resources that you own, EventBridge Pipes needs appropriate
permission. EventBridge Pipes uses the IAM role that you specify on the pipe for enrichment
and target calls using the IAM principal pipes.amazonaws.com.