无法授予EventBridge Bus的许可

发布于 2025-01-27 11:05:22 字数 742 浏览 5 评论 0原文

我正在通过CDK在AWS EventBridge中创建自定义总线：

    export class EventbridgeStack extends Stack {
      constructor(scope: Construct, id: string, props?: StackProps) {
        super(scope, id, props);
    
        const targetCoreBus = new events.EventBus(this, 'TargetCoreBus', {
          eventBusName: 'TargetCoreBus',
        });
    
        targetCoreBus.grantPutEventsTo(new iam.AccountPrincipal('1234567890'));
    
      }
    }

总线可以很好地创建，但是我认为该行

    targetCoreBus.grantPutEventsTo(new iam.AccountPrincipal('1234567890'));

会将策略添加到总线上，该策略允许指定的帐户将事件放入其中。但这似乎没有做任何事情，堆栈中没有任何新的合成，也没有在公共汽车中添加策略。是否期望，我做错了什么？

原文

I am creating a custom bus in AWS EventBridge via CDK:

    export class EventbridgeStack extends Stack {
      constructor(scope: Construct, id: string, props?: StackProps) {
        super(scope, id, props);
    
        const targetCoreBus = new events.EventBus(this, 'TargetCoreBus', {
          eventBusName: 'TargetCoreBus',
        });
    
        targetCoreBus.grantPutEventsTo(new iam.AccountPrincipal('1234567890'));
    
      }
    }

The bus is created fine, but I assumed the line

    targetCoreBus.grantPutEventsTo(new iam.AccountPrincipal('1234567890'));

Would add policy to the bus that would allow specified account to put events into it. But it doesn't seem to do anything, nothing new is synthesized in the stack, no policy is added to the bus. Is it expected, am I doing something wrong?

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

花落人断肠 2025-02-03 11:05:22

GrantPuteVentsto向受赠人添加了基于身份的策略。例如，targetCorebus.grantputeventsto（mylambda）将在lambda的执行角色中添加aws :: iam :: policy。

您想将帐户本金添加到总线的基于资源的策略中。

new events.CfnEventBusPolicy(this, 'CustomBusResoucePolicy', {
  statementId: 'Cross-Account-Bus-20220509',
  action: 'events:PutEvents',
  principal: '123456789012',
  eventBusName: targetCoreBus.eventBusName,
  condition: {...},
});

grantPutEventsTo adds an inline, identity-based policy to the Grantee. For instance, targetCoreBus.grantPutEventsTo(MyLambda) would add a AWS::IAM::Policy to the Lambda's execution role.

You want to add the account principal to the Bus' resource-based policy. The CfnEventBusPolicy construct will do just that:

new events.CfnEventBusPolicy(this, 'CustomBusResoucePolicy', {
  statementId: 'Cross-Account-Bus-20220509',
  action: 'events:PutEvents',
  principal: '123456789012',
  eventBusName: targetCoreBus.eventBusName,
  condition: {...},
});

回复收藏 0 原文

~没有更多了~