IAM roles for sending events to targets in Amazon EventBridge - Amazon EventBridge
Permissions to access targetsCustomer-managed policy example
Services or capabilities described in AWS documentation might vary by Region. To see the differences applicable to the AWS European Sovereign Cloud Region, see the AWS European Sovereign Cloud User Guide.

IAM roles for sending events to targets in Amazon EventBridge

To relay events to targets, EventBridge needs an IAM role.

To create an IAM role for sending events to EventBridge

  1. Open the IAM console at https://eusc-de-east-1.console.amazonaws-eusc.eu/iam/.

  2. To create an IAM role, follow the steps in Creating a Role to Delegate Permissions to an AWS Service in the IAM User Guide. As you follow the steps, do the following:

    • In Role Name, use a name that is unique within your account.

    • In Select Role Type, choose AWS Service Roles, and then choose Amazon EventBridge. This grants EventBridge permissions to assume the role.

    • In Attach Policy, choose AmazonEventBridgeFullAccess.

You can also create your own custom IAM policies for EventBridge actions and resources. Attach these policies to the IAM users or groups that need the permissions. For more information about IAM policies, see Overview of IAM Policies in the IAM User Guide. To learn how to create and manage custom policies, see Managing IAM Policies in the IAM User Guide.

Permissions required for EventBridge to access targets using IAM roles

EventBridge targets typically require IAM roles that grant EventBridge permission to invoke the target. The following sections give examples for several AWS services and targets. For other targets, use the EventBridge console to create a rule. The console creates a new role for you, with a policy that has well-scoped permissions already configured.

Set the correct permissions for each target type. Without the appropriate IAM role or resource-based policy, EventBridge cannot invoke the target, and event delivery fails. Each target type uses a different permission model. Review the requirements for your target before you create a rule. Several target types rely on resource-based policies. To create these policies, see Using resource-based policies for Amazon EventBridge. To create the IAM roles that EventBridge assumes, see Creating a Role to Delegate Permissions to an AWS Service in the IAM User Guide.

Permission requirements vary by target type:

EventBridge target permission requirements
Target type Permission requirement

Amazon SQS, Amazon SNS, and Lambda

Supports both IAM execution roles and resource-based policies.

CloudWatch Logs

Does not use roles; instead, permissions must be granted with a resource-based policy.

EventBridge event bus

EventBridge event bus targets must have an IAM role that grants events:PutEvents on the target event bus. When the target event bus is in another account, the target bus's resource-based policy must allow the sender account.

API Gateway

Can use either resource-based policies or IAM roles.

API destinations

If the target is an API destination, the role you specify must include a policy with the following statement:

  • Effect: Allow

  • Action: events:InvokeApiDestination

  • Resource: arn:aws:events:*:*:api-destination/*

Kinesis streams

If the target is a Kinesis stream, the role used to send event data to that target must include a policy with the following statement:

  • Effect: Allow

  • Action: kinesis:PutRecord

  • Resource: *

Systems Manager run commands

If the target is Systems Manager run command, and you specify one or more InstanceIds values for the command, the role you specify must include a policy with the following statement:

  • Effect: Allow

  • Action: ssm:SendCommand

  • Resources:

    • arn:aws:ec2:region:accountId:instance/instanceId1

    • arn:aws:ec2:region:accountId:instance/instanceId2

    • arn:aws:ssm:region:*:document/documentName

If the target is Systems Manager run command and you specify one or more tags to target instances, the role must include the following statement:

  • Effect: Allow

  • Action: ssm:SendCommand

  • Resources:

    • arn:aws:ec2:region:accountId:instance/*

    • arn:aws:ssm:region:accountId:managed-instance/*

  • Condition:

    "StringEquals": {
  "aws:ResourceTag/tagKey": ["tagValues"]
}

The aws:ResourceTag condition key works for both EC2 instances and hybrid managed instances (on-premises nodes registered with Systems Manager). The ssm:resourceTag/tagKey condition key is also supported for the SendCommand action.

The role must also include the following statement to grant access to the Systems Manager document:

  • Effect: Allow

  • Action: ssm:SendCommand

  • Resource: arn:aws:ssm:region:*:document/documentName

Step Functions state machines

If the target is an AWS Step Functions state machine, the role you specify must include a policy with the following:

  • Effect: Allow

  • Action: states:StartExecution

  • Resource: arn:aws:states:*:*:stateMachine:*

Amazon ECS tasks

If the target is an Amazon ECS task, the role you specify must include the following policy.

JSON
{
    "Version":"2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:RunTask"
            ],
            "Resource": [
                "arn:aws-eusc:ecs:*:111122223333:task-definition/task-definition-name"
            ],
            "Condition": {
                "ArnLike": {
                    "ecs:cluster": "arn:aws-eusc:ecs:*:111122223333:cluster/cluster-name"
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": "iam:PassRole",
            "Resource": [
                "*"
            ],
            "Condition": {
                "StringLike": {
                    "iam:PassedToService": "ecs-tasks.amazonaws.com"
                }
            }
        }
    ]
}

The following policy allows built-in targets in EventBridge to perform Amazon EC2 actions on your behalf. You need to use the AWS Management Console to create rules with built-in targets.

JSON
{
    "Version":"2012-10-17",
    "Statement": [
        {
            "Sid": "TargetInvocationAccess",
            "Effect": "Allow",
            "Action": [
                "ec2:Describe*",
                "ec2:RebootInstances",
                "ec2:StopInstances",
                "ec2:TerminateInstances",
                "ec2:CreateSnapshot"
            ],
            "Resource": "*"
        }
    ]
}

The following policy allows EventBridge to relay events to the Kinesis streams in your account.

JSON
{
    "Version":"2012-10-17",
    "Statement": [
        {
            "Sid": "KinesisAccess",
            "Effect": "Allow",
            "Action": [
                "kinesis:PutRecord"
            ],
            "Resource": "*"
        }
    ]
}

Customer-managed policy example: Using tagging to control access to rules

You can grant users access to specific EventBridge rules while preventing them from accessing other rules. To do so, you tag both sets of rules and then use IAM policies that refer to those tags. For more information about tagging EventBridge resources, see Tagging resources in Amazon EventBridge.

You can attach an IAM policy to a user to allow access to only the rules with a particular tag. You choose which rules to grant access to by tagging them with that particular tag. For example, the following policy grants a user access to rules with the value of Prod for the tag key Stack.

The following example shows a user policy that grants permissions for EventBridge actions. This policy works when you use the EventBridge API, AWS SDKs, or the AWS CLI.

{
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "events:*",
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "aws:ResourceTag/Stack": "Prod"
                }
            }
        }
    ]
}

For more information about using IAM policy statements, see Controlling Access Using Policies in the IAM User Guide.