aws / aws/aws-cdk

@aws-cdk/aws-events: Can't create EventBridge Rule for bus in different region

Open
#26,032 18 comments 7 reactions 0 assignees View on GitHub
@aws-cdk/aws-events bug effort/medium needs-cfn p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

I want to add a rule on an Event Bus in a different account and region. If I create a new Rule, the CDK seems to ignore the region in the event bus' ARN and uses the region of the current app instead.

### Expected Behavior

I expect the CDK to try to create the rule on the event bus specified. (in this case the event bus ARN is `arn:aws:events:eu-west-2:XXXXXXXXXXXX:event-bus/my-event-bus`)

### Current Behavior

I receive the following error (N.b. The CDK app is deployed in the us-east-1 region).

> Error: The stack named XAcctDestinationBusStack failed to deploy: UPDATE_ROLLBACK_COMPLETE: User: arn:aws:sts::YYYYYYYYYYYY:assumed-role/cdk-hnb659fds-cfn-exec-role-YYYYYYYYYYYY-us-east-1/AWSCloudFormation is not authorized to perform: events:PutRule on resource: arn:aws:events:us-east-1:XXXXXXXXXXXX:rule/my-event-bus/XAcctDestinationBusStack-forwardEventsFromSourceBu-SI90TXUR6U6F because no resource-based policy allows the events:PutRule action (Service: AmazonCloudWatchEvents; Status Code: 400; Error Code: AccessDeniedException;

Note that the region in the ARN has been changed to the app region `us-east-1`, which is why it fails.

### Reproduction Steps

```
const sourceBusArn =
"arn:aws:events:eu-west-2:XXXXXXXXXXXX:event-bus/my-event-bus";

export class XAcctDestinationBusStack extends cdk.Stack {
constructor(scope: Construct, id: string, props?: cdk.StackProps) {
super(scope, id, props);

const bus = new events.EventBus(this, "bus");

const sourceBus = events.EventBus.fromEventBusAttributes(
this,
"sourceBus",
{
eventBusArn: sourceBusArn,
eventBusName: sourceBusArn,
eventBusPolicy: "",
}
);

new events.Rule(this, "forwardEventsFromSourceBus", {
eventBus: sourceBus,
eventPattern: { source: ["*"] },
targets: [new targets.EventBus(bus)],
});
}
}
```

### Possible Solution

I've looked into the source code and the `Rule` class seems to construct a new `CfnRule`, passing in the ARN as `eventBusName`, I'm not sure how to find the source of CfnRule to see what it's doing with the region.

### Additional Information/Context

_No response_

### CDK CLI Version

2.84.0 (build f7c792f)

### Framework Version

_No response_

### Node.js Version

16.20.0

### OS

MacOS Ventura 13.4

### Language

Typescript

### Language Version

_No response_

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by tracing the Rule class and its CfnRule construction, using the provided cross-account, cross-region reproduction with the eu-west-2 event-bus ARN. Compare the generated rule resource and deployment error with the expected ARN; done means the rule targets the specified event bus region rather than the app's us-east-1 region.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.