AWS eventbridge: EventBridge ACCESS_DENIED troubleshooting: clarify delivery role access
Summary
Updated the ACCESS_DENIED error remediation text to state that the subscriber's delivery role must be allowed to access the target resource, instead of referring to the EventBridge service principal.
Security assessment
The change clarifies IAM troubleshooting guidance for ACCESS_DENIED errors, pointing to the delivery role's permissions on the target. It is security-adjacent hardening/guidance about least-privilege role configuration but does not fix a specific vulnerability.
Evidence
+`ACCESS_DENIED`| EventBridge could not assume the delivery role, the role is not allowed to call the target, or the target's AWS KMS key denied access| _EventBridge could not assume`role`. Check that the role exists and that its trust policy allows the EventBridge service principal to assume it._ or _EventBridge could not access`resource`. Check that it exists and that the subscriber's delivery role is allowed to access it._
Diff
diff --git a/eventbridge/latest/userguide/eb-custom-bus-retry.md b/eventbridge/latest/userguide/eb-custom-bus-retry.md index b234e73..9670195 100644 --- a//eventbridge/latest/userguide/eb-custom-bus-retry.md +++ b//eventbridge/latest/userguide/eb-custom-bus-retry.md @@ -49 +49 @@ Every failure that reaches the queue was retried first: there is no delivery fai -`ACCESS_DENIED`| EventBridge could not assume the delivery role, the role is not allowed to call the target, or the target's AWS KMS key denied access| _EventBridge could not assume`role`. Check that the role exists and that its trust policy allows the EventBridge service principal to assume it._ or _EventBridge could not access`resource`. Check that it exists and that its policy allows the EventBridge service principal access._ +`ACCESS_DENIED`| EventBridge could not assume the delivery role, the role is not allowed to call the target, or the target's AWS KMS key denied access| _EventBridge could not assume`role`. Check that the role exists and that its trust policy allows the EventBridge service principal to assume it._ or _EventBridge could not access`resource`. Check that it exists and that the subscriber's delivery role is allowed to access it._