Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Actions, resources, and condition keys for the Custom Event Bus

Use this page when you write an IAM policy. It lists every events: action for the Custom Event Bus, the resource ARN each one is checked against, whether another account can be granted it, and the condition keys you can add. For example, to let a role attach subscribers whose METADATA filter names tenant as acme, grant events:CreateSubscriber on the bus with a ForAnyValue:StringEquals condition on events:Metadata/tenant.

Condition keys

EventBridge supplies the following condition keys from the request, so that you can narrow a grant beyond the action and the resource. For the global condition keys, see Amazon global condition context keys in the IAM User Guide.

A metadata key is supplied as a set of values, so match it with a set operator such as ForAnyValue:StringEquals. METADATA filters are exact-match only, which is why the matcher value is always exact. A DATA filter matches arbitrary JSON, so only its presence is exposed, not its content. UpdateEventSource re-runs the bus check with events:source set from the replacement configuration, so a condition on that key governs a repointed event source as well as a new one.

The following resource policy lets account 444455556666 create subscribers on the orders bus only when the subscriber's METADATA filter matches tenant exactly to acme. A subscriber with no METADATA filter, or one that names another tenant, is denied. EventBridge supplies a metadata condition key only for the fields a filter declares, so the Null condition is what denies a filter that omits tenant.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "SubscribeToAcmeEventsOnly",
            "Effect": "Allow",
            "Principal": { "AWS": "arn:aws:iam::444455556666:root" },
            "Action": "events:CreateSubscriber",
            "Resource": "arn:aws:events:us-east-1:111122223333:event-busv2/orders/EXAMPLE1234567890abcdef",
            "Condition": {
                "Null": { "events:Metadata/tenant": "false" },
                "ForAnyValue:StringEquals": { "events:Metadata/tenant": "acme" },
                "StringEquals": { "events:Metadata/tenant/Matcher": "exact" }
            }
        }
    ]
}

Actions and the resources they are checked against

The following table lists every action, the resource ARN to put in the policy's Resource element, and whether a bus owner can grant the action to another account through a resource policy or an Amazon RAM share. The three List actions are not checked against any resource, so grant them with "Resource": "*".

To create a subscriber or an event source on a bus, the caller needs the action on the bus as well as on the new resource. That is what lets a bus owner decide, in the bus's own policy, which accounts may attach anything to it. CreateSubscriber makes four separate authorization checks, and all four must allow: events:CreateSubscriber on the bus, events:CreateSubscriber on the subscriber, iam:PassRole on the role in InvokeConfiguration.RoleArn, and events:TagResource on the subscriber when the request carries tags. CreateEventSource runs the same checks without iam:PassRole, because an event source has no role.

Example identity-based policies

A producer needs events:PutEvents, events:PutRawEvents, or both, on the bus ARN. Grant the action that matches the API it calls. A producer to a bus encrypted with a customer managed key also needs access to that key; see Encrypting events on a Custom Event Bus. A subscriber owner needs events:CreateSubscriber on the bus and on the subscriber, iam:PassRole on the delivery role, and the describe, update, and delete subscriber actions on the subscribers it manages. A bus administrator needs the create, update, and delete bus actions, the four resource policy actions, and events:RevokeResource.

The following policy lets a producer publish to one bus with either publish API, and read the bus so that it can confirm the bus is ACTIVE first. Publishing is authorized once for every entry in the request, and there is no partial authorization: if one entry fails a condition check, EventBridge denies the whole request, including the entries that would have passed.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "PublishToOrdersBus",
            "Effect": "Allow",
            "Action": [
                "events:PutEvents",
                "events:PutRawEvents",
                "events:DescribeEventBus"
            ],
            "Resource": "arn:aws:events:us-east-1:111122223333:event-busv2/orders/EXAMPLE1234567890abcdef"
        }
    ]
}

Tagging

You can tag a bus, a subscriber, or an event source. Set Tags on the create call, or use TagResource, UntagResource, and ListTagsForResource afterward. Each resource carries its own tag set, so tagging a bus does not tag the subscribers or event sources attached to it.

aws eventsv2 tag-resource \
    --resource-arn arn:aws:events:us-east-1:111122223333:event-busv2/orders/EXAMPLE1234567890abcdef \
    --tags team=payments,environment=production

A create response does not echo the tags you supplied, so read them back with list-tags-for-resource when you need to confirm them. Keys that begin with aws: are reserved for Amazon and are rejected on every write, including UntagResource. To control who can tag, and to write policies that depend on tags, use the three tag actions in the preceding table and the aws:RequestTag, aws:ResourceTag, and aws:TagKeys condition keys.