We are using SST to deploy our AWS stack. I need to be able to import an event bus from a different account and attach a rule to it.
The SST construct I am using to import the bus:
const importedBus = new EventBus(stack, 'event-bus', {
cdk: {
eventBus: events.EventBus.fromEventBusArn(
stack,
'imported-bus',
'arn:aws:events:us-east-2:11111111111:event-bus/imported-bus'
),
},
});
And I am trying to attach a rule with my SQS queue as a target:
importedBus.addRules(stack, {
subscription: {
pattern: {
detailType: ['message'],
},
targets: {
subscriberQueue: eventsSubscriberQueue,
},
},
});
This pattern works with event buses defined in the same account without issue:
const otherBus = new EventBus(stack, 'other-event-bus', {
cdk: {
eventBus: events.EventBus.fromEventBusName(
stack,
'importedBus-other-bus',
'other-event-bus',
),
},
});
When I deploy the stack (we are using Github actions) - I am getting an error
➜ App: app
Stage: dev
Region: us-east-2
Account: 111111111111
✔ Building...
| AppStack PUBLISH_ASSETS_COMPLETE
| AppStack imported-event-bus/Parameter_eventBusName AWS::SSM::Parameter CREATE_COMPLETE
| AppStack AppMessageCenterSubscription AWS::Events::Rule CREATE_FAILED Resource handler returned message: "Event bus imported-bus does not exist. (Service: EventBridge, Status Code: 400, Request ID: 56e766bf-3387-4b84-a0eb-5dda966cd86e)" (RequestToken: bc9f18c9-d467-3537-eb71-e368f8900692, HandlerErrorCode: NotFound)
| AppStack imported-event-bus/Parameter_eventBusName AWS::SSM::Parameter DELETE_COMPLETE
| AppStack AppMessageCenterSubscription AWS::Events::Rule DELETE_COMPLETE
| AppStack AWS::CloudFormation::Stack UPDATE_ROLLBACK_COMPLETE
⠋ Deploying...
✖ Errors
AppStack UPDATE_ROLLBACK_COMPLETE
AppMessageCenterSubscription: Resource handler returned message: "Event bus imported-bus does not exist. (Service: EventBridge, Status Code: 400, Request ID: 56e766bf-3387-4b84-a0eb-5dda966cd86e)" (RequestToken: bc9f18c9-d467-3537-eb71-e368f8900692, HandlerErrorCode: NotFound)
ELIFECYCLE Command failed with exit code 1.
Error: Process completed with exit code 1.
I have followed this instructions from aws on Permissions for Amazon EventBridge event buses
And added a resource based policy to the event bus in the account I am trying to write a rule to:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowAccountToManageRulesTheyCreated",
"Effect": "Allow",
"Principal": {
"AWS": "1111111111"
},
"Action": [
"events:PutRule",
"events:PutTargets",
"events:DeleteRule",
"events:RemoveTargets",
"events:DisableRule",
"events:EnableRule",
"events:TagResource",
"events:UntagResource",
"events:DescribeRule",
"events:ListTargetsByRule",
"events:ListTagsForResource"
],
"Resource": "arn:aws:events:us-east-2:2222222222:rule/imported-event-bus",
"Condition": {
"StringEqualsIfExists": {
"events:creatorAccount": "1111111111"
}
}
}
]
}
I know SST uses CDK under the hood - so this should work. The second paragraph from the docs state:
...that using an ARN as a parameter to reference cross-account buses...you can call PutRule to create a rule on a a event bus in a different account without needing to assume a role.
