aws-eb-bus-public-putevents

An EventBridge custom bus policy granting events:PutEvents to Principal '*' is publicly writable; any internet actor can inject events and potentially trigger compute consumers.

derived aws emits ExposedToInternet

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Messaging`
target type	`AnonymousIdentity`
source	`?bus`
target	`<AnonymousIdentity>`
conditions	`resource_policy`
state logic	ACTIVE when the bus policy explicitly grants events:PutEvents to Principal: '' (or aws:PrincipalArn: '') with no condition limiting the principal to specific accounts. CONDITIONAL(condition_expression) when a condition key scopes the grant (e.g., aws:SourceAccount or aws:PrincipalOrgID limits it to specific accounts — not truly public). BLOCKED by an SCP denying events:PutEvents to external principals or a VPC endpoint policy limiting access.

source type

Messaging

target type

AnonymousIdentity

source

?bus

target

<AnonymousIdentity>

conditions

resource_policy

state logic

ACTIVE when the bus policy explicitly grants events:PutEvents to Principal: '*' (or aws:PrincipalArn: '*') with no condition limiting the principal to specific accounts. CONDITIONAL(condition_expression) when a condition key scopes the grant (e.g., aws:SourceAccount or aws:PrincipalOrgID limits it to specific accounts — not truly public). BLOCKED by an SCP denying events:PutEvents to external principals or a VPC endpoint policy limiting access.

Narrative

{bus.name} has a resource policy granting events:PutEvents to any principal (Principal: '*'); any internet actor can inject events, potentially matching rules that trigger compute consumers inside this account.

Raw rule rules/derived/aws/eventbridge.yaml

id: aws-eb-bus-public-putevents
emits: ExposedToInternet
description: An EventBridge custom bus policy granting events:PutEvents to Principal '*' is publicly writable;
  any internet actor can inject events and potentially trigger compute consumers.
match:
- - bus_policy: null
  - HasPolicy
  - bus: null
where:
- node_type(?bus) == EventBus
- node_type(?bus_policy) == ResourcePolicy
- '?bus_policy grants ''events:PutEvents'' with Principal: ''*'''
emit:
  source_type: Messaging
  target_type: AnonymousIdentity
  source: ?bus
  target: <AnonymousIdentity>
  permissions: []
  conditions:
  - resource_policy
  state_logic: "ACTIVE when the bus policy explicitly grants events:PutEvents to Principal: '*' (or aws:PrincipalArn:\
    \ '*') with no condition limiting the principal to specific accounts. CONDITIONAL(condition_expression)\
    \ when a condition key scopes the grant (e.g., aws:SourceAccount or aws:PrincipalOrgID limits it to\
    \ specific accounts \u2014 not truly public). BLOCKED by an SCP denying events:PutEvents to external\
    \ principals or a VPC endpoint policy limiting access."
  confidence: 0.9
  derived_from:
  - "events:DescribeEventBus \u2192 Policy (Principal: *)"
  false_positive_note: "A wildcard Principal scoped by aws:SourceAccount or aws:PrincipalOrgID is NOT\
    \ public \u2014 downgrade to CrossAccountTrust CONDITIONAL rather than ExposedToInternet. The default\
    \ bus does not accept cross-account events:PutEvents by default; this edge only applies to custom\
    \ buses with an explicit public policy. Even when public, the injected event must match an enabled\
    \ rule's pattern to trigger compute; if no enabled rules match public-source events, the ExposedToInternet\
    \ bus has limited downstream impact (still model it \u2014 the rule may be created later)."
  narrative: '{bus.name} has a resource policy granting events:PutEvents to any principal (Principal:
    ''*''); any internet actor can inject events, potentially matching rules that trigger compute consumers
    inside this account.'