IAM Role for Event Bridge

Question

Hi, I am trying to trigger a run command document on a bunch of ec2 instances when a parameter in parameter store is updated.  The rule gets triggered as expected but I can see from the Events in CloudWatch that all invocations fail.  I'm a bit lost as how to troubleshoot it as there don't seem to be any logs available in Event Bridge.  I'm thinking it might be to do with the IAM role used for the targets.  If you set up the targets manually through the Event Bridge console this role can be created automatically, however I am required to create all infra via Terraform so I need to create and assign the role separately.  Documentation on the role requirements is a bit thin on the ground, but this is what I have so far

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "",
            "Effect": "Allow",
            "Action": "ssm:SendCommand",
            "Resource": "arn:aws:ec2:eu-west-2:xxxxxxxxxxxx:instance/*",
            "Condition": {
                "StringEquals": {
                    "ec2:ResourceTag/os_type": "*"
                }
            }
        },
        {
            "Sid": "",
            "Effect": "Allow",
            "Action": "ssm:SendCommand",
            "Resource": "arn:aws:ssm:eu-west-2::document/AmazonCloudWatch-ManageAgent"
        },
        {
            "Sid": "",
            "Effect": "Allow",
            "Action": "ssm:GetParameter",
            "Resource": "arn:aws:ssm:eu-west-2:xxxxxxxxxxxx:parameter/cloud-watch-config-linux"
        }
    ]
}
```
with `events.amazonaws.com` being able to assume the role.

Any suggestions on how to troubleshoot this further, or advice on how the IAM role permissions required would be much appreciated.

Many thanks.

Answer

Can you elaborate it a little more extensive?

As I understand, when the Parameter is changed, the event is sent through EventBridge and the Rule is applied to consume this event.
The question is who is a subscriber? Lambda? If yes, you need to add [LambdaPermission](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_permission) to allow EventBridge to invoke your Lambda function.

The Policies which you are needed by Lambda function to execute your logic to apply new parameters, but are not connected to the subscription with EventBridge.

Answer

The permissions you are listing in your post are for SystemsManager service, not for EventBridge. In order to be able to put an event in a bus event, your role should allow the action: **events:PutEvents** to the resource representing the bus event you want to use.

Answer

Good question!

To utilize EventBridge and specifically in your case when you're trying to see logs in EventBridge:
* Typically, you will need **PutEvent** permission.
You can read through the rest of the permissions here: https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-permissions-reference.html

As for your Parameter Store Permissions and Issues, check the following:
* Access to Systems Manager Parameter Store to write to Parameter Store.  This will look like a **ssm:PutParameter**.
* Access to the KMS Key used to encrypt Parameter Store.

IAM Role for Event Bridge

관련 콘텐츠