Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for Amazon EventBridge

Amazon EventBridge (service prefix: events) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon EventBridge
Actions defined by Amazon EventBridge
Permission-only actions for Amazon EventBridge
Resource types defined by Amazon EventBridge
Condition keys for Amazon EventBridge

API operations defined by Amazon EventBridge

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
ActivateEventSource	events:ActivateEventSource			Write
CancelReplay	events:CancelReplay			Write
CreateApiDestination	events:CreateApiDestination			Write
CreateArchive	events:CreateArchive			Write
CreateConnection	events:CreateConnection			Write
CreateEndpoint	events:CreateEndpoint			Write
CreateEndpoint	iam:PassRole	iam:PassedToService	events.amazonaws.com	Write
CreateEventBus	events:CreateEventBus			Write
CreateEventBus	events:TagResource			Tagging, Write
CreatePartnerEventSource	events:CreatePartnerEventSource			Write
DeactivateEventSource	events:DeactivateEventSource			Write
DeauthorizeConnection	events:DeauthorizeConnection			Write
DeleteApiDestination	events:DeleteApiDestination			Write
DeleteArchive	events:DeleteArchive			Write
DeleteConnection	events:DeleteConnection			Write
DeleteEndpoint	events:DeleteEndpoint			Write
DeleteEventBus	events:DeleteEventBus			Write
DeletePartnerEventSource	events:DeletePartnerEventSource			Write
DeleteRule	events:DeleteRule			Write
DescribeApiDestination	events:DescribeApiDestination			Read
DescribeArchive	events:DescribeArchive			Read
DescribeConnection	events:DescribeConnection			Read
DescribeEndpoint	events:DescribeEndpoint			Read
DescribeEventBus	events:DescribeEventBus			Read
DescribeEventSource	events:DescribeEventSource			Read
DescribePartnerEventSource	events:DescribePartnerEventSource			Read
DescribeReplay	events:DescribeReplay			Read
DescribeRule	events:DescribeRule			Read
DisableRule	events:DisableRule			Write
EnableRule	events:EnableRule			Write
ListApiDestinations	events:ListApiDestinations			List
ListArchives	events:ListArchives			List
ListConnections	events:ListConnections			List
ListEndpoints	events:ListEndpoints			List
ListEventBuses	events:ListEventBuses			List
ListEventSources	events:ListEventSources			List
ListPartnerEventSourceAccounts	events:ListPartnerEventSourceAccounts			List
ListPartnerEventSources	events:ListPartnerEventSources			List
ListReplays	events:ListReplays			List
ListRuleNamesByTarget	events:ListRuleNamesByTarget			List
ListRules	events:ListRules			List
ListTagsForResource	events:ListTagsForResource			List
ListTargetsByRule	events:ListTargetsByRule			List
PutEvents	events:PutEvents			Write
PutPartnerEvents	events:PutPartnerEvents			Write
PutPermission	events:PutPermission			Permissions management, Write
PutRule	events:PutRule			Write
	events:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	events.amazonaws.com	Write
PutTargets	events:PutTargets			Write
PutTargets	iam:PassRole	iam:PassedToService	events.amazonaws.com	Write
RemovePermission	events:RemovePermission			Permissions management, Write
RemoveTargets	events:RemoveTargets			Write
StartReplay	events:StartReplay			Write
TagResource	events:TagResource			Tagging, Write
TestEventPattern	events:TestEventPattern			Read
UntagResource	events:UntagResource			Tagging, Write
UpdateApiDestination	events:UpdateApiDestination			Write
UpdateArchive	events:UpdateArchive			Write
UpdateConnection	events:UpdateConnection			Write
UpdateEndpoint	events:UpdateEndpoint			Write
UpdateEndpoint	iam:PassRole	iam:PassedToService	events.amazonaws.com	Write
UpdateEventBus	events:UpdateEventBus			Write

Actions defined by Amazon EventBridge

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in Amazon. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
ActivateEventSource	Grants permission to activate partner event sources	event-source*		Write
CancelReplay	Grants permission to cancel a replay	replay*		Write
CreateApiDestination	Grants permission to create a new api destination	api-destination*		Write
CreateApiDestination	Grants permission to create a new api destination	connection*		Write
CreateArchive	Grants permission to create a new archive	alias		Write
		archive*
		event-bus*	aws:ResourceTag/${TagKey}
		key
CreateConnection	Grants permission to create a new connection	connection*		Write
CreateEndpoint	Grants permission to create an endpoint	endpoint*	events:EventBusArn	Write
CreateEventBus	Grants permission to create event buses	event-bus	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateEventBus	Grants permission to create event buses	event-busv2	aws:RequestTag/${TagKey} aws:TagKeys	Write
CreatePartnerEventSource	Grants permission to create partner event sources	event-source*		Write
DeactivateEventSource	Grants permission to deactivate event sources	event-source*		Write
DeauthorizeConnection	Grants permission to deauthorize a connection, deleting its stored authorization secrets	connection*		Write
DeleteApiDestination	Grants permission to delete an api destination	api-destination*		Write
DeleteArchive	Grants permission to delete an archive	archive*		Write
DeleteConnection	Grants permission to delete a connection	connection*		Write
DeleteEndpoint	Grants permission to delete an endpoint	endpoint*		Write
DeleteEventBus	Grants permission to delete event buses	event-bus	aws:ResourceTag/${TagKey}	Write
DeleteEventBus	Grants permission to delete event buses	event-busv2		Write
DeletePartnerEventSource	Grants permission to delete partner event sources	event-source*		Write
DeleteRule	Grants permission to delete rules	rule-on-custom-event-bus	aws:ResourceTag/${TagKey} events:creatorAccount events:ManagedBy	Write
DeleteRule	Grants permission to delete rules	rule-on-default-event-bus	aws:ResourceTag/${TagKey} events:creatorAccount events:ManagedBy	Write
DescribeApiDestination	Grants permission to retrieve details about an api destination	api-destination*		Read
DescribeApiDestination		connection*		Read
DescribeArchive	Grants permission to retrieve details about an archive	archive*		Read
DescribeConnection	Grants permission to retrieve details about a conection	connection*		Read
DescribeEndpoint	Grants permission to retrieve details about an endpoint	endpoint*		Read
DescribeEventBus	Grants permission to retrieve details about event buses	event-bus	aws:ResourceTag/${TagKey}	Read
DescribeEventBus	Grants permission to retrieve details about event buses	event-busv2		Read
DescribeEventSource	Grants permission to retrieve details about event sources	event-source*		Read
DescribePartnerEventSource	Grants permission to retrieve details about partner event sources	event-source*		Read
DescribeReplay	Grants permission to retrieve the details of a replay	replay*		Read
DescribeRule	Grants permission to retrieve details about rules	rule-on-custom-event-bus	aws:ResourceTag/${TagKey} events:creatorAccount	Read
DescribeRule	Grants permission to retrieve details about rules	rule-on-default-event-bus	aws:ResourceTag/${TagKey} events:creatorAccount	Read
DisableRule	Grants permission to disable rules	rule-on-custom-event-bus	aws:ResourceTag/${TagKey} events:creatorAccount events:ManagedBy	Write
DisableRule	Grants permission to disable rules	rule-on-default-event-bus	aws:ResourceTag/${TagKey} events:creatorAccount events:ManagedBy	Write
EnableRule	Grants permission to enable rules	rule-on-custom-event-bus	aws:ResourceTag/${TagKey} events:creatorAccount events:ManagedBy	Write
EnableRule	Grants permission to enable rules	rule-on-default-event-bus	aws:ResourceTag/${TagKey} events:creatorAccount events:ManagedBy	Write
ListApiDestinations	Grants permission to retrieve a list of api destinations			List
ListArchives	Grants permission to retrieve a list of archives			List
ListConnections	Grants permission to retrieve a list of connections			List
ListEndpoints	Grants permission to retrieve a list of endpoints			List
ListEventBuses	Grants permission to retrieve a list of the event buses in your account			List
ListEventSources	Grants permission to to retrieve a list of event sources shared with this account			List
ListPartnerEventSourceAccounts	Grants permission to retrieve a list of Amazon Web Services account IDs associated with an event source	event-source*		List
ListPartnerEventSources	Grants permission to retrieve a list partner event sources			List
ListReplays	Grants permission to retrieve a list of replays			List
ListRuleNamesByTarget	Grants permission to retrieve a list of the names of the rules associated with a target			List
ListRules	Grants permission to retrieve a list of the Amazon EventBridge rules in the account			List
ListTagsForResource	Grants permission to retrieve a list of tags associated with an Amazon EventBridge resource	event-bus	aws:ResourceTag/${TagKey} events:creatorAccount	List
		event-busv2	events:creatorAccount
		publisher	events:creatorAccount
		rule-on-custom-event-bus	aws:ResourceTag/${TagKey} events:creatorAccount
		rule-on-default-event-bus	aws:ResourceTag/${TagKey} events:creatorAccount
		subscriber	events:creatorAccount
ListTargetsByRule	Grants permission to retrieve a list of targets defined for a rule	rule-on-custom-event-bus	aws:ResourceTag/${TagKey} events:creatorAccount	List
ListTargetsByRule		rule-on-default-event-bus	aws:ResourceTag/${TagKey} events:creatorAccount	List
PutEvents	Grants permission to send custom events to Amazon EventBridge	event-bus	aws:ResourceTag/${TagKey} events:detail-type events:eventBusInvocation events:ResourceArn events:source events:SystemMetadata/EventGroupId	Write
PutEvents		event-busv2	events:detail-type events:eventBusInvocation events:ResourceArn events:source events:SystemMetadata/EventGroupId	Write
PutPartnerEvents	Grants permission to sends custom events to Amazon EventBridge			Write
PutPermission	Grants permission to use the PutPermission action to grants permission to another Amazon Web Services account to put events to your default event bus			Permissions management, Write
PutRule	Grants permission to create or updates rules	rule-on-custom-event-bus	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys events:creatorAccount events:detail-type events:detail.eventTypeCode events:detail.service events:detail.userIdentity.principalId events:ManagedBy events:source	Write
PutRule	Grants permission to create or updates rules	rule-on-default-event-bus	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys events:creatorAccount events:detail-type events:detail.eventTypeCode events:detail.service events:detail.userIdentity.principalId events:ManagedBy events:source	Write
PutTargets	Grants permission to add targets to a rule	rule-on-custom-event-bus	aws:ResourceTag/${TagKey} events:creatorAccount events:ManagedBy events:TargetArn	Write
PutTargets	Grants permission to add targets to a rule	rule-on-default-event-bus	aws:ResourceTag/${TagKey} events:creatorAccount events:ManagedBy events:TargetArn	Write
RemovePermission	Grants permission to revoke the permission of another Amazon Web Services account to put events to your default event bus			Permissions management, Write
RemoveTargets	Grants permission to removes targets from a rule	rule-on-custom-event-bus	aws:ResourceTag/${TagKey} events:creatorAccount events:ManagedBy	Write
RemoveTargets	Grants permission to removes targets from a rule	rule-on-default-event-bus	aws:ResourceTag/${TagKey} events:creatorAccount events:ManagedBy	Write
StartReplay	Grants permission to start a replay of an archive	archive*		Write
		event-bus*	aws:ResourceTag/${TagKey}
		replay*
TagResource	Grants permission to add a tag to an Amazon EventBridge resource	event-bus	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys events:creatorAccount	Tagging, Write
		event-busv2	aws:RequestTag/${TagKey} aws:TagKeys events:creatorAccount
		publisher	aws:RequestTag/${TagKey} aws:TagKeys events:creatorAccount
		rule-on-custom-event-bus	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys events:creatorAccount
		rule-on-default-event-bus	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys events:creatorAccount
		subscriber	aws:RequestTag/${TagKey} aws:TagKeys events:creatorAccount
TestEventPattern	Grants permission to test whether an event pattern matches the provided event			Read
UntagResource	Grants permission to remove a tag from an Amazon EventBridge resource	event-bus	aws:ResourceTag/${TagKey} aws:TagKeys events:creatorAccount	Tagging, Write
		event-busv2	aws:TagKeys events:creatorAccount
		publisher	aws:TagKeys events:creatorAccount
		rule-on-custom-event-bus	aws:ResourceTag/${TagKey} aws:TagKeys events:creatorAccount
		rule-on-default-event-bus	aws:ResourceTag/${TagKey} aws:TagKeys events:creatorAccount
		subscriber	aws:TagKeys events:creatorAccount
UpdateApiDestination	Grants permission to update an api destination	api-destination*		Write
UpdateArchive	Grants permission to update an archive	alias		Write
		archive*
		key
UpdateConnection	Grants permission to update a connection	connection*		Write
UpdateEndpoint	Grants permission to update an endpoint	endpoint*	events:EventBusArn	Write
UpdateEventBus	Grants permission to update event buses	event-bus	aws:ResourceTag/${TagKey}	Write
UpdateEventBus	Grants permission to update event buses	event-busv2		Write

Permission-only actions for Amazon EventBridge

The following actions are defined by Amazon EventBridge but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AllowVendedLogDeliveryForResource	Grants permission to configure vended log delivery for EventBridge	event-bus*	aws:ResourceTag/${TagKey}	Write
InvokeApiDestination	Grants permission to invoke an api destination	api-destination*		Write
RetrieveConnectionCredentials	Grants permission to retrieve credentials from a connection	connection*		Write

Resource types defined by Amazon EventBridge

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
alias	arn:${Partition}:kms:${Region}:${Account}:alias/${Alias}
api-destination	arn:${Partition}:events:${Region}:${Account}:api-destination/${ApiDestinationName}
archive	arn:${Partition}:events:${Region}:${Account}:archive/${ArchiveName}
connection	arn:${Partition}:events:${Region}:${Account}:connection/${ConnectionName}
create-snapshot	arn:${Partition}:events:${Region}:${Account}:target/create-snapshot
endpoint	arn:${Partition}:events:${Region}:${Account}:endpoint/${EndpointName}
event-bus	arn:${Partition}:events:${Region}:${Account}:event-bus/${EventBusName}	aws:ResourceTag/${TagKey}
event-source	arn:${Partition}:events:${Region}::event-source/${EventSourceName}
key	arn:${Partition}:kms:${Region}:${Account}:key/${KeyId}
reboot-instance	arn:${Partition}:events:${Region}:${Account}:target/reboot-instance
replay	arn:${Partition}:events:${Region}:${Account}:replay/${ReplayName}
rule-on-custom-event-bus	arn:${Partition}:events:${Region}:${Account}:rule/${EventBusName}/${RuleName}	aws:ResourceTag/${TagKey}
rule-on-default-event-bus	arn:${Partition}:events:${Region}:${Account}:rule/${RuleName}	aws:ResourceTag/${TagKey}
stop-instance	arn:${Partition}:events:${Region}:${Account}:target/stop-instance
terminate-instance	arn:${Partition}:events:${Region}:${Account}:target/terminate-instance

Condition keys for Amazon EventBridge

Amazon EventBridge defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the allowed set of values for each of the tags to event bus and rule actions	String
aws:ResourceTag/${TagKey}	Filters access by tag-value associated with the resource to event bus and rule actions	String
aws:TagKeys	Filters access by the tags in the request to event bus and rule actions	ArrayOfString
events:EventBusArn	Filters access by the ARN of the event buses that can be associated with an endpoint to CreateEndpoint and UpdateEndpoint actions	ArrayOfARN
events:ManagedBy	Filters access by Amazon services. If a rule is created by an Amazon service on your behalf, the value is the principal name of the service that created the rule	String
events:TargetArn	Filters access by the ARN of a target that can be put to a rule to PutTargets actions. TargetARN doesn't include DeadLetterConfigArn	ArrayOfARN
events:creatorAccount	Filters access by the account the rule was created in to rule actions	String
events:detail-type	Filters access by the literal string of the detail-type of the event to PutEvents and PutRule actions	ArrayOfString
events:detail.eventTypeCode	Filters access by the literal string for the detail.eventTypeCode field of the event to PutRule actions	String
events:detail.service	Filters access by the literal string for the detail.service field of the event to PutRule actions	String
events:detail.userIdentity.principalId	Filters access by the literal string for the detail.useridentity.principalid field of the event to PutRule actions	String
events:eventBusInvocation	Filters access by whether the event was generated via API or cross-account bus invocation to PutEvents actions	String
events:source	Filters access by the Amazon service or Amazon partner event source that generated the event to PutEvents and PutRule actions. Matches the literal string of the source field of the event	ArrayOfString

Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Amazon EMR Serverless (emr-serverless)

Amazon EventBridge Pipes (pipes)