EventBus Should Not Allow Cross Account Access
More Info:
AWS CloudWatch event buses should not allow unknown cross-account access for delivery of events.Risk Level
HighAddress
SecurityCompliance Standards
AWSWAFTriage and Remediation
Remediation
Using Console
Using Console
To remediate the “EventBus Should Not Allow Cross Account Access” misconfiguration in AWS using the AWS console, follow these steps:
- Login to the AWS Management Console.
- Navigate to the Amazon EventBridge service.
- Select the Event Bus that is allowing cross-account access.
- Click on the “Permissions” tab.
- In the “Event bus policies” section, click on the “Edit” button.
- Remove any statements that grant cross-account access to the Event Bus.
- Add a new statement that only allows access from the AWS account(s) that require access to the Event Bus.
- Click on the “Save” button to apply the changes.
Using CLI
Using CLI
To remediate the “EventBus Should Not Allow Cross Account Access” misconfiguration in AWS using AWS CLI, follow these steps:
- Open your terminal or command prompt and ensure that you have the AWS CLI installed and configured with the appropriate credentials.
-
Run the following command to list all the Amazon EventBridge event buses in your AWS account:
- Identify the event bus that is allowing cross-account access.
-
Run the following command to modify the event bus policy and restrict cross-account access:
Replace
<event-bus-name>with the name of the event bus that is allowing cross-account access,<region>with the AWS region where the event bus is located, and<account-id>with your AWS account ID. -
Verify that the policy has been updated by running the following command:
The output should show the updated policy with the
Denystatement. - Repeat steps 3-5 for any other event buses that are allowing cross-account access.
Using Python
Using Python
To remediate the misconfiguration “EventBus Should Not Allow Cross Account Access” in AWS, you can follow the below steps in Python:This should remediate the “EventBus Should Not Allow Cross Account Access” misconfiguration in AWS.
- Create a new EventBridge event bus policy that allows access only to the specific AWS account that should have access to the event bus.
- Remove any existing event bus policies that allow cross-account access.
- Verify that the event bus policy now only allows access to the specific AWS account that should have access to the event bus.