Skip to content

Commit c806e6b

Browse files
author
AWS
committed
Amazon EventBridge Update: EventBridge now supports Resource-based policy authorization on event buses. This enables cross-account PutEvents API calls, creating cross-account rules, and simplifies permission management.
1 parent 4b2022a commit c806e6b

File tree

2 files changed

+68
-37
lines changed

2 files changed

+68
-37
lines changed

‎.changes/next-release/feature-AmazonEventBridge-ad014aa.json

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
{
2+
"type": "feature",
3+
"category": "Amazon EventBridge",
4+
"contributor": "",
5+
"description": "EventBridge now supports Resource-based policy authorization on event buses. This enables cross-account PutEvents API calls, creating cross-account rules, and simplifies permission management."
6+
}

‎services/eventbridge/src/main/resources/codegen-resources/service-2.json

Lines changed: 62 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@
6060
{"shape":"LimitExceededException"},
6161
{"shape":"InvalidEventPatternException"}
6262
],
63-
"documentation":"<p>Creates an archive of events with the specified settings. When you create an archive, incoming events might not immediately start being sent to the archive. Allow a short period of time for changes to take effect.</p>"
63+
"documentation":"<p>Creates an archive of events with the specified settings. When you create an archive, incoming events might not immediately start being sent to the archive. Allow a short period of time for changes to take effect. If you do not specify a pattern to filter events sent to the archive, all events are sent to the archive except replayed events. Replayed events are not sent to an archive.</p>"
6464
},
6565
"CreateEventBus":{
6666
"name":"CreateEventBus",
@@ -465,7 +465,8 @@
465465
{"shape":"ResourceNotFoundException"},
466466
{"shape":"PolicyLengthExceededException"},
467467
{"shape":"InternalException"},
468-
{"shape":"ConcurrentModificationException"}
468+
{"shape":"ConcurrentModificationException"},
469+
{"shape":"OperationDisabledException"}
469470
],
470471
"documentation":"<p>Running <code>PutPermission</code> permits the specified AWS account or AWS organization to put events to the specified <i>event bus</i>. Amazon EventBridge (CloudWatch Events) rules in your account are triggered by these events arriving to an event bus in your account. </p> <p>For another account to send events to your account, that external account must have an EventBridge rule with your account's event bus as a target.</p> <p>To enable multiple AWS accounts to put events to your event bus, run <code>PutPermission</code> once for each of these accounts. Or, if all the accounts are members of the same AWS organization, you can run <code>PutPermission</code> once specifying <code>Principal</code> as \"*\" and specifying the AWS organization ID in <code>Condition</code>, to grant permissions to all accounts in that organization.</p> <p>If you grant permissions using an organization, then accounts in that organization must specify a <code>RoleArn</code> with proper permissions when they use <code>PutTarget</code> to add your account's event bus as a target. For more information, see <a href=\"https://docs.aws.amazon.com/eventbridge/latest/userguide/eventbridge-cross-account-event-delivery.html\">Sending and Receiving Events Between AWS Accounts</a> in the <i>Amazon EventBridge User Guide</i>.</p> <p>The permission policy on the default event bus cannot exceed 10 KB in size.</p>"
471472
},
@@ -514,7 +515,8 @@
514515
"errors":[
515516
{"shape":"ResourceNotFoundException"},
516517
{"shape":"InternalException"},
517-
{"shape":"ConcurrentModificationException"}
518+
{"shape":"ConcurrentModificationException"},
519+
{"shape":"OperationDisabledException"}
518520
],
519521
"documentation":"<p>Revokes the permission of another AWS account to be able to put events to the specified event bus. Specify the account to revoke by the <code>StatementId</code> value that you associated with the account when you granted it permission with <code>PutPermission</code>. You can find the <code>StatementId</code> by using <a>DescribeEventBus</a>.</p>"
520522
},
@@ -951,6 +953,11 @@
951953
}
952954
}
953955
},
956+
"CreatedBy":{
957+
"type":"string",
958+
"max":128,
959+
"min":1
960+
},
954961
"Database":{
955962
"type":"string",
956963
"max":64,
@@ -1034,8 +1041,8 @@
10341041
"documentation":"<p>The name of the rule.</p>"
10351042
},
10361043
"EventBusName":{
1037-
"shape":"EventBusName",
1038-
"documentation":"<p>The event bus associated with the rule. If you omit this, the default event bus is used.</p>"
1044+
"shape":"EventBusNameOrArn",
1045+
"documentation":"<p>The name or ARN of the event bus associated with the rule. If you omit this, the default event bus is used.</p>"
10391046
},
10401047
"Force":{
10411048
"shape":"Boolean",
@@ -1106,8 +1113,8 @@
11061113
"type":"structure",
11071114
"members":{
11081115
"Name":{
1109-
"shape":"EventBusName",
1110-
"documentation":"<p>The name of the event bus to show details for. If you omit this, the default event bus is displayed.</p>"
1116+
"shape":"EventBusNameOrArn",
1117+
"documentation":"<p>The name or ARN of the event bus to show details for. If you omit this, the default event bus is displayed.</p>"
11111118
}
11121119
}
11131120
},
@@ -1262,8 +1269,8 @@
12621269
"documentation":"<p>The name of the rule.</p>"
12631270
},
12641271
"EventBusName":{
1265-
"shape":"EventBusName",
1266-
"documentation":"<p>The event bus associated with the rule. If you omit this, the default event bus is used.</p>"
1272+
"shape":"EventBusNameOrArn",
1273+
"documentation":"<p>The name or ARN of the event bus associated with the rule. If you omit this, the default event bus is used.</p>"
12671274
}
12681275
}
12691276
},
@@ -1304,7 +1311,11 @@
13041311
},
13051312
"EventBusName":{
13061313
"shape":"EventBusName",
1307-
"documentation":"<p>The event bus associated with the rule.</p>"
1314+
"documentation":"<p>The name of the event bus associated with the rule.</p>"
1315+
},
1316+
"CreatedBy":{
1317+
"shape":"CreatedBy",
1318+
"documentation":"<p>The account ID of the user that created the rule. If you use <code>PutRule</code> to put a rule on an event bus in another account, the other account is the owner of the rule, and the rule ARN includes the account ID for that account. However, the value for <code>CreatedBy</code> is the account ID as the account that created the rule in the other account.</p>"
13081319
}
13091320
}
13101321
},
@@ -1317,8 +1328,8 @@
13171328
"documentation":"<p>The name of the rule.</p>"
13181329
},
13191330
"EventBusName":{
1320-
"shape":"EventBusName",
1321-
"documentation":"<p>The event bus associated with the rule. If you omit this, the default event bus is used.</p>"
1331+
"shape":"EventBusNameOrArn",
1332+
"documentation":"<p>The name or ARN of the event bus associated with the rule. If you omit this, the default event bus is used.</p>"
13221333
}
13231334
}
13241335
},
@@ -1362,8 +1373,8 @@
13621373
"documentation":"<p>The name of the rule.</p>"
13631374
},
13641375
"EventBusName":{
1365-
"shape":"EventBusName",
1366-
"documentation":"<p>The event bus associated with the rule. If you omit this, the default event bus is used.</p>"
1376+
"shape":"EventBusNameOrArn",
1377+
"documentation":"<p>The name or ARN of the event bus associated with the rule. If you omit this, the default event bus is used.</p>"
13671378
}
13681379
}
13691380
},
@@ -1397,6 +1408,12 @@
13971408
"min":1,
13981409
"pattern":"[/\\.\\-_A-Za-z0-9]+"
13991410
},
1411+
"EventBusNameOrArn":{
1412+
"type":"string",
1413+
"max":1600,
1414+
"min":1,
1415+
"pattern":"(arn:aws[\\w-]*:events:[a-z]{2}-[a-z]+-[\\w-]+:[0-9]{12}:event-bus\\/)?[/\\.\\-_A-Za-z0-9]+"
1416+
},
14001417
"EventId":{"type":"string"},
14011418
"EventPattern":{"type":"string"},
14021419
"EventResource":{"type":"string"},
@@ -1742,7 +1759,7 @@
17421759
"members":{
17431760
"NamePrefix":{
17441761
"shape":"ReplayName",
1745-
"documentation":"<p>A name prefix to filter the archives returned. Only archives with name that match the prefix are returned.</p>"
1762+
"documentation":"<p>A name prefix to filter the replays returned. Only replays with name that match the prefix are returned.</p>"
17461763
},
17471764
"State":{
17481765
"shape":"ReplayState",
@@ -1784,8 +1801,8 @@
17841801
"documentation":"<p>The Amazon Resource Name (ARN) of the target resource.</p>"
17851802
},
17861803
"EventBusName":{
1787-
"shape":"EventBusName",
1788-
"documentation":"<p>Limits the results to show only the rules associated with the specified event bus.</p>"
1804+
"shape":"EventBusNameOrArn",
1805+
"documentation":"<p>The name or ARN of the event bus to list rules for. If you omit this, the default event bus is used.</p>"
17891806
},
17901807
"NextToken":{
17911808
"shape":"NextToken",
@@ -1818,8 +1835,8 @@
18181835
"documentation":"<p>The prefix matching the rule name.</p>"
18191836
},
18201837
"EventBusName":{
1821-
"shape":"EventBusName",
1822-
"documentation":"<p>Limits the results to show only the rules associated with the specified event bus.</p>"
1838+
"shape":"EventBusNameOrArn",
1839+
"documentation":"<p>The name or ARN of the event bus to list the rules for. If you omit this, the default event bus is used.</p>"
18231840
},
18241841
"NextToken":{
18251842
"shape":"NextToken",
@@ -1872,8 +1889,8 @@
18721889
"documentation":"<p>The name of the rule.</p>"
18731890
},
18741891
"EventBusName":{
1875-
"shape":"EventBusName",
1876-
"documentation":"<p>The event bus associated with the rule. If you omit this, the default event bus is used.</p>"
1892+
"shape":"EventBusNameOrArn",
1893+
"documentation":"<p>The name or ARN of the event bus associated with the rule. If you omit this, the default event bus is used.</p>"
18771894
},
18781895
"NextToken":{
18791896
"shape":"NextToken",
@@ -1943,6 +1960,12 @@
19431960
"min":1,
19441961
"pattern":"[\\.\\-_A-Za-z0-9]+"
19451962
},
1963+
"NonPartnerEventBusNameOrArn":{
1964+
"type":"string",
1965+
"max":1600,
1966+
"min":1,
1967+
"pattern":"(arn:aws[\\w-]*:events:[a-z]{2}-[a-z]+-[\\w-]+:[0-9]{12}:event-bus\\/)?[\\.\\-_A-Za-z0-9]+"
1968+
},
19461969
"OperationDisabledException":{
19471970
"type":"structure",
19481971
"members":{
@@ -2055,8 +2078,8 @@
20552078
"documentation":"<p>A valid JSON string. There is no other schema imposed. The JSON string may contain fields and nested subobjects.</p>"
20562079
},
20572080
"EventBusName":{
2058-
"shape":"NonPartnerEventBusName",
2059-
"documentation":"<p>The event bus that will receive the event. Only the rules that are associated with this event bus will be able to match the event.</p>"
2081+
"shape":"NonPartnerEventBusNameOrArn",
2082+
"documentation":"<p>The name or ARN of the event bus to receive the event. Only the rules that are associated with this event bus are used to match the event. If you omit this, the default event bus is used.</p>"
20602083
}
20612084
},
20622085
"documentation":"<p>Represents an event to be submitted.</p>"
@@ -2181,15 +2204,10 @@
21812204
},
21822205
"PutPermissionRequest":{
21832206
"type":"structure",
2184-
"required":[
2185-
"Action",
2186-
"Principal",
2187-
"StatementId"
2188-
],
21892207
"members":{
21902208
"EventBusName":{
21912209
"shape":"NonPartnerEventBusName",
2192-
"documentation":"<p>The event bus associated with the rule. If you omit this, the default event bus is used.</p>"
2210+
"documentation":"<p>The name of the event bus associated with the rule. If you omit this, the default event bus is used.</p>"
21932211
},
21942212
"Action":{
21952213
"shape":"Action",
@@ -2206,6 +2224,10 @@
22062224
"Condition":{
22072225
"shape":"Condition",
22082226
"documentation":"<p>This parameter enables you to limit the permission to accounts that fulfill a certain condition, such as being a member of a certain AWS organization. For more information about AWS Organizations, see <a href=\"https://docs.aws.amazon.com/organizations/latest/userguide/orgs_introduction.html\">What Is AWS Organizations</a> in the <i>AWS Organizations User Guide</i>.</p> <p>If you specify <code>Condition</code> with an AWS organization ID, and specify \"*\" as the value for <code>Principal</code>, you grant permission to all the accounts in the named organization.</p> <p>The <code>Condition</code> is a JSON string which must contain <code>Type</code>, <code>Key</code>, and <code>Value</code> fields.</p>"
2227+
},
2228+
"Policy":{
2229+
"shape":"String",
2230+
"documentation":"<p>A JSON string that describes the permission policy statement. You can include a <code>Policy</code> parameter in the request instead of using the <code>StatementId</code>, <code>Action</code>, <code>Principal</code>, or <code>Condition</code> parameters.</p>"
22092231
}
22102232
}
22112233
},
@@ -2242,8 +2264,8 @@
22422264
"documentation":"<p>The list of key-value pairs to associate with the rule.</p>"
22432265
},
22442266
"EventBusName":{
2245-
"shape":"EventBusName",
2246-
"documentation":"<p>The event bus to associate with this rule. If you omit this, the default event bus is used.</p>"
2267+
"shape":"EventBusNameOrArn",
2268+
"documentation":"<p>The name or ARN of the event bus to associate with this rule. If you omit this, the default event bus is used.</p>"
22472269
}
22482270
}
22492271
},
@@ -2268,8 +2290,8 @@
22682290
"documentation":"<p>The name of the rule.</p>"
22692291
},
22702292
"EventBusName":{
2271-
"shape":"EventBusName",
2272-
"documentation":"<p>The name of the event bus associated with the rule. If you omit this, the default event bus is used.</p>"
2293+
"shape":"EventBusNameOrArn",
2294+
"documentation":"<p>The name or ARN of the event bus associated with the rule. If you omit this, the default event bus is used.</p>"
22732295
},
22742296
"Targets":{
22752297
"shape":"TargetList",
@@ -2369,12 +2391,15 @@
23692391
},
23702392
"RemovePermissionRequest":{
23712393
"type":"structure",
2372-
"required":["StatementId"],
23732394
"members":{
23742395
"StatementId":{
23752396
"shape":"StatementId",
23762397
"documentation":"<p>The statement ID corresponding to the account that is no longer allowed to put events to the default event bus.</p>"
23772398
},
2399+
"RemoveAllPermissions":{
2400+
"shape":"Boolean",
2401+
"documentation":"<p>Specifies whether to remove all permissions.</p>"
2402+
},
23782403
"EventBusName":{
23792404
"shape":"NonPartnerEventBusName",
23802405
"documentation":"<p>The name of the event bus to revoke permissions for. If you omit this, the default event bus is used.</p>"
@@ -2393,8 +2418,8 @@
23932418
"documentation":"<p>The name of the rule.</p>"
23942419
},
23952420
"EventBusName":{
2396-
"shape":"EventBusName",
2397-
"documentation":"<p>The name of the event bus associated with the rule.</p>"
2421+
"shape":"EventBusNameOrArn",
2422+
"documentation":"<p>The name or ARN of the event bus associated with the rule. If you omit this, the default event bus is used.</p>"
23982423
},
23992424
"Ids":{
24002425
"shape":"TargetIdList",
@@ -2618,7 +2643,7 @@
26182643
},
26192644
"EventBusName":{
26202645
"shape":"EventBusName",
2621-
"documentation":"<p>The event bus associated with the rule.</p>"
2646+
"documentation":"<p>The name or ARN of the event bus associated with the rule. If you omit this, the default event bus is used.</p>"
26222647
}
26232648
},
26242649
"documentation":"<p>Contains information about a rule in Amazon EventBridge.</p>"

0 commit comments

Comments
 (0)