External Id Authentication for Eventbridge cross account events

Question

Hi,

i have 2 aws accounts and i use eventbridge to emit events from x account to y account.

i have configured the respective roles on both emitting side and receiving side and they work perfectly well.

As a security measure i want to use an external id when giving access to resources for other accounts, which is recommended in aws iam docs.

i have surfed the internet for a while but couldn't find any examples or guides that helps me in achieving this.

i know that i can add a condition on receiving role policy with that external id from docs but unable to figure out how to send the external id when calling the put events.

i use python with boto3 sdk. the answer need not by language specific. i would be glad if an approach is suggested.

Answer

You pass the ExternalId when you assume the role. See:

* [assume_role](https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/sts/client/assume_role.html)
* [Assume a role with AWS STS using an AWS SDK](https://docs.aws.amazon.com/IAM/latest/UserGuide/example_sts_AssumeRole_section.html)
* [When should I use an external ID?](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user_externalid.html#external-id-use)

```
You should always specify the external ID in your AssumeRole API calls. 
```

Check this link, [assume_role](https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/sts/client/assume_role.html), for an example code on passing the ExternalId when assuming the role.

So, the code running in account-x wants to put an event in account-y. The code in account-x just needs to add the ExternalId as a part of the assume role call to get credentials for account-y.

External Id Authentication for Eventbridge cross account events

Relevant content