AWS EventBridge event bus does not allow cross-account access
eventbridge_bus_cross_account_access
EventBridge event bus has a resource policy that grants cross-account event delivery to principals outside the account, including broad or public access.
Focus is on buses whose policies permit external accounts to send events.
Risk
Cross-account event injection can erode integrity and availability. Spoofed events may trigger rules and invoke downstream targets, causing unintended actions, data exposure via targets, lateral movement through over-privileged roles, and cost or service disruption from event floods.
prowler aws --checks eventbridge_bus_cross_account_access
Recommendation
Apply least privilege on the event bus resource policy: allow only specific account IDs or org scope (e.g., aws:PrincipalOrgID) and avoid wildcard Principal or *.
Constrain rules to trusted senders using the account field and vetted sources, and add monitoring/throttling for defense in depth.
Remediation
aws events remove-permission --event-bus-name <event_bus_name> --statement-id <statement_id>
- In the AWS Console, go to Amazon EventBridge > Event buses
- Select the event bus (<event_bus_name>)
- Open the Permissions tab and click Edit
- Remove any statements that grant access to other accounts, an organization, or "*"
- Save changes
Source Code
Resource Type
AwsEventsEventbus
References
- https://www.trendmicro.com/trendaivisiononecloudriskmanagement/knowledge-base/aws/CloudWatchEvents/event-bus-cross-account-access.html
- https://docs.aws.amazon.com/AmazonCloudWatch/latest/events/CWE_GettingStarted.html
- https://docs.aws.amazon.com/AmazonCloudWatch/latest/events/CloudWatchEvents-CrossAccountEventDelivery.html