AWS eventbridge: Rename encryption doc link text in custom bus access actions
Summary
Updated the hyperlink label pointing to the custom event bus encryption page from 'Encrypting events on a Custom Event Bus' to 'Encryption at Rest for Amazon EventBridge Custom Event Bus'. No IAM actions, policy guidance, or permission requirements were changed.
Security assessment
The only change is the display text of an existing cross-reference to the KMS encryption page; the surrounding IAM permission statements (PutEvents, PassRole, resource policy actions) are unchanged, so there is no new or altered security guidance.
Evidence
+A **producer** needs `events:PutEvents`, `events:PutRawEvents`, or both, on the bus ARN. Grant the action that matches the API it calls. A producer to a bus encrypted with a customer managed key also needs access to that key; see [Encryption at Rest for Amazon EventBridge Custom Event Bus](./eb-custom-bus-encryption.html).
Diff
diff --git a/eventbridge/latest/userguide/eb-custom-bus-access-actions.md b/eventbridge/latest/userguide/eb-custom-bus-access-actions.md index e632ecc31..4e74d0aea 100644 --- a//eventbridge/latest/userguide/eb-custom-bus-access-actions.md +++ b//eventbridge/latest/userguide/eb-custom-bus-access-actions.md @@ -90 +90 @@ A resource that does not exist yet has no complete ARN, so a create check uses a -A **producer** needs `events:PutEvents`, `events:PutRawEvents`, or both, on the bus ARN. Grant the action that matches the API it calls. A producer to a bus encrypted with a customer managed key also needs access to that key; see [Encrypting events on a Custom Event Bus](./eb-custom-bus-encryption.html). A **subscriber owner** needs `events:CreateSubscriber` on the bus and on the subscriber, `iam:PassRole` on the delivery role, and the describe, update, and delete subscriber actions on the subscribers it manages. A **bus administrator** needs the create, update, and delete bus actions, the four resource policy actions, and `events:RevokeResource`. +A **producer** needs `events:PutEvents`, `events:PutRawEvents`, or both, on the bus ARN. Grant the action that matches the API it calls. A producer to a bus encrypted with a customer managed key also needs access to that key; see [Encryption at Rest for Amazon EventBridge Custom Event Bus](./eb-custom-bus-encryption.html). A **subscriber owner** needs `events:CreateSubscriber` on the bus and on the subscriber, `iam:PassRole` on the delivery role, and the describe, update, and delete subscriber actions on the subscribers it manages. A **bus administrator** needs the create, update, and delete bus actions, the four resource policy actions, and `events:RevokeResource`.