AWS EventBridge event bus policy does not allow public access
eventbridge_bus_exposed
EventBridge event bus resource policy is evaluated for public access, such as a Principal: "*" or overly broad conditions that allow any AWS account to publish events or manage rules on the bus.
Risk
Publicly accessible event buses enable event injection and unauthorized rule changes, undermining integrity and enabling lateral movement. Attackers can trigger downstream targets, causing data exposure, service disruption, and unexpected costs through high-volume events.
prowler aws --checks eventbridge_bus_exposed
Recommendation
Apply least privilege resource policies: limit principals to specific accounts or your organization, and constrain actions and event attributes (e.g., source, detail-type). Avoid Principal: "*".
Use defense in depth with rule patterns that include the expected account. Monitor policy changes and bus activity.
Remediation
aws events remove-permission --event-bus-name <event_bus_name> --statement-id <statement_id>
- Open the AWS Console and go to EventBridge > Event buses
- Select the target event bus and open the Permissions tab
- Click Edit policy
- Remove any statement where Principal is "" or AWS is ""
- If needed, add a statement allowing only your trusted account ID as Principal (arn:aws:iam::<ACCOUNT_ID>:root)
- Save changes
Source Code
Resource Type
AwsEventsEventbus
References
- https://docs.aws.amazon.com/AmazonCloudWatch/latest/events/CloudWatchEvents-CrossAccountEventDelivery.html
- https://docs.aws.amazon.com/AmazonCloudWatch/latest/events/CWE_GettingStarted.html
- https://www.trendmicro.com/trendaivisiononecloudriskmanagement/knowledge-base/aws/CloudWatchEvents/event-bus-exposed.html
- https://aws.amazon.com/blogs/compute/simplifying-cross-account-access-with-amazon-eventbridge-resource-policies/