Event Bus Should Not Be Exposed
More Info:
Your AWS CloudWatch event bus should not be exposed to everyone.Risk Level
HighAddress
SecurityCompliance Standards
HITRUST, AWSWAF, SOC2, NISTCSF, PCIDSSTriage and Remediation
Remediation
Using Console
Using Console
The following are the steps to remediate the “Event Bus Should Not Be Exposed” misconfiguration on AWS using the AWS console:
- Log in to the AWS Management Console.
- Navigate to the Amazon EventBridge service.
- Click on the “Event buses” option on the left-hand menu.
- Select the event bus that is exposed.
- Click on the “Permissions” tab.
- Click on the “Edit” button to edit the permissions.
- Remove any unauthorized principals or accounts from the “Event bus policy” section.
- Click on the “Save” button to save the changes.
Using CLI
Using CLI
To remediate the misconfiguration “Event Bus Should Not Be Exposed” for AWS using AWS CLI, you can follow the below steps:Replace This means that the event bus policy has been successfully updated to remove public access.Replace
- Open your command prompt or terminal and install the AWS CLI if you haven’t already done so.
- Run the following command to list all the Amazon EventBridge event buses in your AWS account:
- Identify the event bus that is exposed and note down its ARN.
- Run the following command to remove the event bus policy that is allowing public access:
<event-bus-name> with the name of the event bus that you want to remediate and <statement-id> with the ID of the statement in the event bus policy that is allowing public access.- After running the above command, you should receive an output similar to the following:
- Finally, run the following command to verify that the event bus policy has been updated:
<event-bus-name> with the name of the event bus that you remediated. The output should show that the event bus policy no longer allows public access.By following these steps, you can remediate the misconfiguration “Event Bus Should Not Be Exposed” for AWS using AWS CLI.Using Python
Using Python
Remediating the “Event Bus Should Not Be Exposed” misconfiguration in AWS using Python involves the following steps:Note: Replace the
- Identify the AWS account that has the exposed event bus.
- Create an IAM policy that denies access to the event bus.
- Attach the IAM policy to the AWS account.
- Verify that the event bus is no longer exposed.
region, event_bus_name, and policy variables with the appropriate values for your use case. Also, ensure that you have the necessary permissions to create IAM policies and attach them to the AWS account.