[aws-events-targets] add a target for a cross-account eventbus

I would like a “CrossAccountEventBus” target in aws_events_targets that allows me to forward events to the default eventbus of a different account.

I did see https://docs.aws.amazon.com/cdk/api/latest/docs/aws-events-readme.html#cross-account-targets - but this seems to make changes in the target account which doesn’t work in my case.

Use Case

I have a target account where the default eventbus has already been configured with a policy accept forwarded events, I would like to create a rule that targets this cross-account eventbus.

Proposed Solution

A target in aws_events_targets (like https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-events-targets.SnsTopic.html) but that only has an ARN property.

Other

I’m opening this feature request as was recommended to another commenter here: #2850

I’m currently working around this by using the CfnRule, but this is a bit of a bummer as I can use the very handy .on_xxx methods.

• 👋 I may be able to implement this feature request
• ⚠️ This feature might incur a breaking change

---

This is a 🚀 Feature Request

[hlascelles]

I have implemented this as follows. It works well for me…

import { RuleTargetConfig } from "@aws-cdk/aws-events";
import { IRule } from "@aws-cdk/aws-events/lib/rule-ref";
import { Effect, PolicyStatement, Role, ServicePrincipal } from "@aws-cdk/aws-iam";
import { ServicePrincipals } from "cdk-constants";

const targetAccountId = "123456789009";
const targetAccountDefaultBus = `arn:aws:events:eu-west-1:${targetAccountId}:event-bus/default`;
const publishingRole = new Role(this, "PublishingRole", {
  assumedBy: new ServicePrincipal(ServicePrincipals.EVENTS)
});
publishingRole.addToPolicy(
  new PolicyStatement({
    effect: Effect.ALLOW,
    resources: [targetAccountDefaultBus],
    actions: [
      "events:PutEvents"
    ]
  })
);

// This rule captures authentication events and sends it to the 
// default EventBridge bus in the other account
const rule = new Rule(this, "EventRule", {
  description: "Captures events",
  ruleName: "EventRule",
  enabled: true,
  eventPattern: {
    source: ["aws.someservice"]
  }
});

rule.addTarget({
  bind(_rule: IRule, generatedTargetId: string): RuleTargetConfig {
    return {
      arn: targetAccountDefaultBus,
      id: generatedTargetId,
      role: publishingRole
    };
  }
});

Don’t forget to also log into the target account and set the default bus to permit submissions from the origin account (or Organisation as a whole).

Have a go, see if it works out for you. Be good to get a formal version though too…

[shaleenmundra]

I used the below to send event to a different account’s default bus. I was setting up the event on step function status change to SUCCEEDED

import {CfnRule} from "@aws-cdk/aws-events";
import TargetProperty = CfnRule.TargetProperty;

const targetProperty: TargetProperty = {
            id: `CrossAccountTarget`,
            arn: `arn:aws:events:<region>:<targetAccountId>:event-bus/default`,
        }
const cfnRuleCrossAccount = new CfnRule(this, `CrossAccountRule`, {
            description: "Cross Account rule to send event to different AWS Account",
            state: "ENABLED",
            targets: [targetProperty],
            eventPattern: {
                "source": [
                    "aws.states"
                ],
                "detail-type": [
                    "Step Functions Execution Status Change"
                ],
                "detail": {
                    "status": [
                        "SUCCEEDED"
                    ]
                }
            }
        });

You just have to create a targetProperty and give the arn of target event bus. Then create a CfnRule and supply it the targetProperty as targets prop