Revoking a subscriber or an event source
RevokeResource withdraws one subscriber or one event source from a bus. It is the only
control a bus owner has over a resource that another account owns, and it needs no cooperation from
that account. It is authorized against the bus, and only the account that owns the bus can call it. The
account that owns the subscriber cannot revoke its own subscriber.
Note
You revoke with the Amazon CLI (aws eventsv2 revoke-resource), the API, or an SDK. The
console does not offer revocation.
Revocation is terminal and cannot be undone. A revoked subscriber stops delivering and refuses
mutating operations with InvalidStateException. A revoked event source stops ingesting:
each event it would have forwarded is refused as it arrives. DeleteSubscriber and
DeleteEventSource stay available so that the resource's owner can clean it up.
DescribeSubscriber, DescribeEventSource, and both list operations return a
Revoked field that is present only when it is true.
Important
There is no undo, so confirm the target with DescribeSubscriber or
DescribeEventSource before you revoke. Check the ARN, the bus, and the target.
Revocation covers one resource, not the account that created it. That account can create another
subscriber or event source and carry on. To stop the account, also deny it
events:CreateSubscriber and events:CreateEventSource in the bus resource
policy, or delete the Amazon RAM share. Deleting the resource is not an alternative:
DeleteSubscriber and DeleteEventSource are authorized against the resource
named in the request, so only its owner can delete it.