SOA-C03 · Question #44
A company uses an organization in AWS Organizations to manage multiple AWS accounts. The company needs to send specific events from all the accounts in the organization to a new receiver account…
The correct answer is C. The resource-based policy on the target event bus must be modified to allow PutEvents API calls. When events are sent across AWS accounts -- particularly from multiple accounts in an AWS Organization -- the target event bus in the receiver account must include a resource-based policy that explicitly allows events:PutEvents API calls from the sender accounts or the…
Question
A company uses an organization in AWS Organizations to manage multiple AWS accounts. The company needs to send specific events from all the accounts in the organization to a new receiver account, where an AWS Lambda function will process the events. A CloudOps engineer configures Amazon EventBridge to route events to a target event bus in the us- west-2 Region in the receiver account. The CloudOps engineer creates rules in both the sender and receiver accounts that match the specified events. The rules do not specify an account parameter in the event pattern. IAM roles are created in the sender accounts to allow PutEvents actions on the target event bus. However, the first test events from the us-east-1 Region are not processed by the Lambda function in the receiving account. What is the likely reason the events are not processed?
Options
- AInterface VPC endpoints for EventBridge are required in the sender accounts and receiver
- BThe target Lambda function is in a different AWS Region, which is not supported by EventBridge.
- CThe resource-based policy on the target event bus must be modified to allow PutEvents API calls
- DThe rule in the receiving account must specify {"account": ["sender-account-id"]} in its event
How the community answered
(36 responses)- A3% (1)
- B17% (6)
- C75% (27)
- D6% (2)
Explanation
When events are sent across AWS accounts -- particularly from multiple accounts in an AWS Organization -- the target event bus in the receiver account must include a resource-based policy that explicitly allows events:PutEvents API calls from the sender accounts or the organization ID. Even if the sender accounts have IAM permissions to call PutEvents, the receiving event bus must trust those accounts via a resource policy. Without this configuration, EventBridge automatically rejects incoming cross-account events, and those events never reach the target Lambda function for processing. AWS guidance states that "Cross-account event delivery requires a resource-based policy on the event bus that grants permissions to the source accounts or organization." The policy can include either individual AWS account IDs or the organization's root ID. In this scenario, because the events originate from multiple accounts and there is no resource policy on the target event bus to authorize those sender accounts, the events are not delivered. Therefore, the correct cause is C ?the resource-based policy on the target event bus must be modified to allow PutEvents API calls from the sender accounts.
Topics
Community Discussion
No community discussion yet for this question.