# Ensure EventBridge Event Buses Do Not Allow Unknown Cross-Account Access

- Source: https://support.icompaas.com/support/solutions/articles/62000233543-ensure-eventbridge-event-buses-do-not-allow-unknown-cross-account-access
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS Checks New Version](https://support.icompaas.com/support/solutions/62000112673) › [AWS New Checks](https://support.icompaas.com/support/solutions/folders/62000169206)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Profile Applicability**

-   **Level 2**

#### **Description**

Amazon EventBridge event buses can be configured to allow cross-account access for event delivery. However, unrestricted or unknown cross-account access can expose your event buses to unauthorized use, leading to potential security risks. Ensuring that only trusted AWS accounts or organizations have access to your event buses helps maintain a secure and controlled environment.

#### **Rationale**

-   Enhanced Security: Prevents unauthorized accounts from sending events to your event buses.
    
-   Risk Mitigation: Reduces the risk of malicious activities or data breaches.
    
-   Compliance: Aligns with security best practices and regulatory requirements.
    

#### **Impact**

**Pros:**

-   Protects event buses from unauthorized access.
    
-   Reduces the risk of data misuse or malicious event injection.
    
-   Enhances overall security posture.
    

**Cons:**

-   Requires careful management of resource policies for event buses.
    
-   May limit collaboration if not properly configured.
    

#### **Default Value**

By default, EventBridge event buses do not allow cross-account access unless explicitly configured.

#### **Pre-Requisite**

IAM Permissions Required:

-   events:DescribeEventBus
    
-   events:PutPermission
    
-   events:RemovePermission
    
-   AWS CLI installed and configured.
    

#### **Remediation**

#### **Test Plan:**

**Using AWS Console:**

1.  Sign in to the AWS Management Console.
    
2.  Navigate to Amazon EventBridge > Event Buses.
    
3.  Select an event bus and review its Resource Policy.
    
4.  Identify any policies that allow access to unknown accounts or \* (wildcard).
    

**Using AWS CLI:**

1.  Describe the event bus:  
    
    aws events describe-event-bus --name <event-bus-name>
    
2.  Check the Policy field in the output for any wildcard (\*) or unknown account permissions.
    

#### **Implementation Steps:**

**Using AWS Console:**

1.  Navigate to Amazon EventBridge > Event Buses.  
    ![](https://support.icompaas.com/assets/kb/9afa7381edfdb226.png)![](https://support.icompaas.com/assets/kb/ddfdb8ae6580cff1.png)
    
2.  Select the event bus to update.  
    ![](https://support.icompaas.com/assets/kb/307f6d7855a57e5d.png)
    
3.  Edit the Resource Policy to remove any wildcard (\*) or unknown account permissions.  
    ![](https://support.icompaas.com/assets/kb/dbaaf4ac4d5869a8.png)
    
4.  Save the changes.
    

**Using AWS CLI:**

1.  Remove unknown cross-account permissions:  
    
    aws events remove-permission --event-bus-name <event-bus-name> --statement-id <statement-id>
    
2.  Add permissions for trusted accounts or organizations:  
    
    aws events put-permission --event-bus-name <event-bus-name> --action "events:PutEvents" --principal <trusted-account-id>
    
3.  Verify the updated policy:  
    
    aws events describe-event-bus --name <event-bus-name>
    

#### **Backout Plan**

#### **Using AWS Console:**

1.  #### If restricting access to unknown cross-account access causes issues, sign in to the AWS Management Console.
    
2.  #### Navigate to Amazon EventBridge, select the event bus, and modify the resource policy to re-enable access for any AWS account (although this is not recommended).  
    ![](https://support.icompaas.com/assets/kb/001c43a5e87549b7.png)![](https://support.icompaas.com/assets/kb/58c9f4586d4d8f9f.png)
    
3.  #### Save the changes and verify that the event bus is once again exposed to all AWS accounts.
    

#### **Using AWS CLI:**

1.  #### To revert the event bus policy to allow unknown cross-account access, use the following command:  
    
    aws events put-permission --event-bus-name <EVENT\_BUS\_NAME> --action "PutEvents" --principal "\*" --region <REGION>
    
2.  #### Verify that the policy has been reverted:  
    
    aws events describe-event-bus --name <EVENT\_BUS\_NAME> --region <REGION>
    

#### **References**

-   [Amazon EventBridge Cross-Account Access Documentation](https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-cross-account.html)
    
-   [Managing EventBridge Resource Policies](https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-resource-based-policies.html)
    
-   [Best Practices for EventBridge Security](https://docs.aws.amazon.com/eventbridge/latest/userguide/security-best-practices.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.