Skip to content

Instantly share code, notes, and snippets.

@aidansteele
Last active October 7, 2021 02:51
Show Gist options
  • Save aidansteele/711002fc98813e613b4ab8c44f30b364 to your computer and use it in GitHub Desktop.
Save aidansteele/711002fc98813e613b4ab8c44f30b364 to your computer and use it in GitHub Desktop.
cross-account eventbus design
Resources:
Bus:
Type: AWS::Events::EventBus
BusPolicy:
Type: AWS::Events::EventBusPolicy
Properties:
EventBusName: !Ref Bus
StatementId: AllowOrg
Statement:
Effect: Allow
Principal: "*"
Action:
- events:PutRule
- events:DeleteRule
- events:DescribeRule
- events:DisableRule
- events:EnableRule
- events:PutTargets
- events:RemoveTargets
Resource: !Sub arn:aws:events:${AWS::Region}:${AWS::AccountId}:rule/${Bus}/*
Condition:
StringEquals:
aws:PrincipalOrgID: o-yourorgid
StringEqualsIfExists:
events:creatorAccount: "${aws:PrincipalAccount}"
Outputs:
Bus:
Value: !GetAtt Bus.Arn
Parameters:
RemoteBusArn:
Type: String
LocalBusName:
Type: String
Default: default
Resources:
RemoteRule:
Type: AWS::Events::Rule
Properties:
EventBusName: !Ref RemoteBusArn
EventPattern:
detail-type: [some-detail-type]
Targets:
- Id: localbus
Arn: !Sub arn:aws:events:${AWS::Region}:${AWS::AccountId}:event-bus/${LocalBusName}
RoleArn: !GetAtt CrossAccountEventBridgeRole.Arn
CrossAccountEventBridgeRole:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Version: 2012-10-17
Statement:
- Effect: Allow
Principal:
Service: events.amazonaws.com
Action: sts:AssumeRole
Policies:
- PolicyName: PutEventsOnLocalBus
PolicyDocument:
Version: 2012-10-17
Statement:
- Effect: Allow
Action: events:PutEvents
Resource: !Sub arn:aws:events:${AWS::Region}:${AWS::AccountId}:event-bus/${LocalBusName}
LocalRule:
Type: AWS::Events::Rule
Properties:
EventBusName: !Ref LocalBusName
EventPattern:
detail-type: [some-detail-type]
Targets:
- Id: queue
Arn: some:sqs:queue:arn....
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment