The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
To let another AWS account send events to an EventBridge event bus, add a resource-based policy to the receiving bus that grants the sender events:PutEvents, then create a rule in the sending account with the receiving bus as its target. For new cross-account bus targets created after March 2, 2023, the sender must also attach an IAM role to the target. Finally, create receiving-side rules that match the incoming events you actually want to process.
These are separate controls: the bus policy authorizes access, the sender’s rule routes events, and the receiver’s event pattern determines what triggers downstream processing. Keep the permission scope narrow, especially if the bus accepts events from multiple accounts.
How cross-account EventBridge access works
An EventBridge event bus has a resource-based policy. By default, the default bus allows events from its own account; access from another account must be granted deliberately. The receiving account controls this policy, while the sending account configures a rule that targets the receiving bus.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →There are three distinct decisions to make:
- Who may call the bus? The bus policy identifies authorized accounts or an AWS Organization.
- Which events are sent? A rule in the sender account matches events and routes them to the destination bus.
- Which received events are acted on? Rules in the receiver account match the arriving events and invoke their configured targets.
Granting permission to put events does not, by itself, create a sender rule or a receiver rule. Nor does a receiver-side event pattern grant the sender permission to call the bus.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application:Upgraded attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Warranty & Support: Our Electric air duster comes with 5 years warranty and 24/7 customer service. During this period, if you have any questions,pls kindly feel free to contact us.
That separation helps when diagnosing problems. An authorization failure points first to the receiving bus policy, the principal, the requested action, or the target ARN. Events that are accepted by the bus but do not trigger the expected processing point instead to rule patterns and routing. A permissive policy cannot compensate for a sender rule that does not match the event, and a matching receiver rule cannot compensate for missing permission to publish.
Choose the right permission scope
For a known partner account, authorize that account directly. If accounts in an AWS Organization need to send events, AWS’s policy example uses a wildcard principal constrained by the aws:PrincipalOrgID condition. Use the real organization ID and retain only the statements required for your use case.
| Choice | Principal scope | When it fits | Important control |
|---|---|---|---|
| Specific account | One named AWS account ID | A known sender or a small set of separately managed senders | Grant only the needed actions on the intended bus. |
| Organization-scoped | Accounts belonging to the organization ID in the condition | Multiple accounts in the same AWS Organization need access | Keep the organization condition and constrain receiving rules by account where appropriate. |
A named account is usually the more direct choice when the publisher is known and stable: the policy identifies exactly which AWS account is allowed. An organization-scoped statement can be useful when many accounts need the same publishing access, but its principal is intentionally broader. The organization condition is what limits that wildcard principal; do not remove it or leave a wildcard principal unconstrained.
For sending only, grant events:PutEvents. Do not grant rule-management permissions just because an account needs to publish events. If the other account must create or manage rules on the bus, authorize those operations separately and restrict them to the appropriate bus, rules, and—where suitable—the creator account.
Know what each action permits
EventBridge IAM actions use the events: prefix. AWS’s permissions reference identifies events:PutEvents for adding custom events, events:PutRule for creating or updating rules, and events:PutTargets for adding rule targets. These permissions serve different purposes: a sender that only publishes events generally needs the first, not the latter two.
Think of these as separate capabilities rather than a bundle. PutEvents is the publishing permission. PutRule and PutTargets concern rule configuration. A partner that only sends data should not receive the ability to change which rules run or what those rules target. Conversely, if rule administration is truly part of the integration, document that operational need and avoid granting more rule-management scope than it requires.
AWS’s management examples separate the event-sending statement from rule-management permissions and include a creator-account condition in a rule-management example. This is a useful pattern to consider when administrators outside the receiving account must create rules: keep the authorization focused on the relevant operations and rule context instead of broadening the publishing statement.
Add or update the receiving bus policy
Use the console
- In the receiving AWS account, open Amazon EventBridge and choose Event buses.
- Select the destination bus and choose Manage permissions.
- Enter or customize the policy for the chosen access scope.
- Review the principal, actions, conditions, and bus resource, then choose Update.
AWS warns that its console policy template is not a valid policy as loaded. Customize it for the intended use and remove example sections that do not apply rather than saving the template unchanged.
Before updating, check the policy as a whole, not only the statement you just changed. Confirm that each principal is deliberate, each action is needed, any organization condition uses the intended organization ID, and the resource identifies the receiving bus. Remove unrelated sample statements so that an example for a different access pattern does not accidentally become part of the live authorization.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Illustrative statement for a specific sender
This is a conceptual policy statement for granting one account permission to put events. Replace both account IDs and the bus ARN with the actual sender, receiving account, Region, and bus. It is not a complete policy document: place the statement in the appropriate policy structure and validate the full policy and its scope against current AWS documentation before applying it.
{
"Sid": "AllowSenderToPutEvents",
"Effect": "Allow",
"Principal": {"AWS": "111122223333"},
"Action": "events:PutEvents",
"Resource": "arn:aws:events:us-east-1:444455556666:event-bus/example-bus"
}The sender account ID belongs in the principal. The resource identifies the receiving bus. A policy that grants PutEvents to a different bus, or names the wrong Region or account in its ARN, will not express the intended access.
For this example, 111122223333 is only an illustrative sender ID, and 444455556666 is only an illustrative receiving account ID. The bus name, Region, and account in the resource must all correspond to the actual destination. Keep the distinction clear when reviewing an integration across accounts: the principal is who is authorized, while the resource is where that permission applies.
Organization-scoped access
For organization-wide authorization, AWS’s example uses "Principal": "*" together with a StringEquals condition on aws:PrincipalOrgID. The condition is essential to limiting the wildcard principal to the intended organization. Use the actual organization ID; do not copy an illustrative value or leave the policy broader than intended.
Organization membership answers which accounts can be authorized by that statement, but it does not decide which event types your receiver should process. Use receiving-side patterns as a second control, and include account IDs in those patterns when the desired set of publishers is known. The scope of the policy and the scope of the processing rule should be reviewed independently.
Create the sender-side rule and target
In the sending account, create a rule that matches the events to forward, then set the destination bus ARN as its target. In the EventBridge console’s target selection, choose EventBridge event bus, then Event bus in a different account or Region, and enter the receiving bus ARN.
- Open EventBridge in the sending account and create or select the rule that should route events.
- Define the event pattern for events that should be sent.
- Add an EventBridge event bus target for a bus in a different account or Region.
- Enter the receiving bus ARN and configure the target’s IAM role as required.
- Review the rule and target configuration, then save it.
The sender rule is the routing decision: it determines which events from the sender account are offered to the destination. Keep its pattern aligned with the integration’s purpose rather than routing every event without a reason. The receiver can still filter what it processes, but sending a narrower intended set makes the flow easier to reason about.
Use the destination bus ARN as the target, including its account and Region. AWS notes that EventBridge APIs that accept a bus Name can also accept the bus ARN, which enables cross-account or cross-Region bus references in those API calls. When working through an API or CLI workflow, check the operation’s current documentation rather than assuming a bus name alone identifies the cross-account destination.
Why the target needs an IAM role
AWS requires an IAM role for new cross-account event-bus targets created after March 2, 2023. The EventBridge console creates a role during target setup. If configuring the target with the AWS CLI, create the role manually and attach it to the target. AWS recommends using IAM roles for event-bus targets so that service control policies governing organization boundaries can apply.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
This role requirement is distinct from the receiving bus policy: the policy grants access on the destination bus, while the sender-side target configuration uses the role for delivery. Do not treat one as a substitute for the other. AWS also documents that APIs accepting a bus Name can accept the bus ARN, which allows cross-account or cross-Region bus references in those API calls.
Recommended Free Tools
The date matters specifically for newly created cross-account event-bus targets. If you are building a new target, plan for the role as part of setup rather than assuming that the destination resource policy alone is enough. The console flow handles role creation; CLI users must include the manual role-creation and attachment step in their deployment procedure. Verify both sides of the arrangement: an appropriate destination policy and a sender-side target configured with the required role.
Match incoming events safely on the receiver
Create a rule in the receiving account for the event types that should trigger processing. Event patterns can constrain events by fields such as account, source, or rule. Choose the account condition deliberately:
- If the rule should process events generated by the receiving account, include the receiving account ID in its event pattern.
- If the rule should match events from any authorized sender, omit the
accountfield. A literal*in the account field does not mean “any account” and will not match. - If the bus accepts events from all AWS accounts, AWS strongly recommends including account IDs in receiving rule patterns so events from unknown accounts do not trigger processing.
Authorization and filtering solve different problems. The bus policy limits which principals may send; the receiving rule pattern limits which events cause the rule to run. If many accounts are allowed to publish, a narrow event pattern is particularly important.
For a rule that should accept multiple authorized senders, do not try to express “all accounts” by putting a wildcard in the account field. Omit that field if the rule is meant to match events from any authorized sender, then use the other relevant event fields to identify what should trigger the rule. If the rule is intended for a known subset of publishers, account IDs make that intent explicit. The correct pattern depends on whether the rule is for the receiver’s own events, a defined set of senders, or any authorized sender.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesBroad publishing access and broad event matching together deserve particular care. A policy that admits a large set of principals does not mean every event should trigger downstream processing. Likewise, a narrow receiving pattern is not a replacement for restricting who can publish. Review both controls together, especially when organization-wide access is used or when the bus is configured to accept events from all AWS accounts.
Region, billing, and forwarding limits
Cross-account event delivery works between accounts in the same Region and between accounts in different Regions when the destination Region supports cross-Region delivery. Confirm that the intended destination Region supports the configuration before relying on it.
AWS documents that cross-account delivery is charged to the sending account as custom events; the receiving account is not charged for those events. The documented flow also does not forward events received from a sender onward to a third account. If a design depends on onward delivery, do not assume that a receiving bus can relay those received events through this pattern.
Include the payer and the forwarding behavior in the architecture discussion before enabling the route. The sending account should account for the custom-event charges associated with cross-account delivery. The receiving account is not charged for those events under the documented arrangement. AWS does not provide a price figure in the cited guidance here, so check current EventBridge pricing for the applicable Region and usage rather than relying on an outdated amount.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchRank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Similarly, distinguish delivering an event to the receiving bus from relaying that received event to a third account. The documented pattern does not provide that onward forwarding behavior. If a third account needs events, design and validate an appropriate architecture rather than assuming that the receiver can act as a transparent relay.
Compare the main configuration choices
The meaningful choices are not simply console versus CLI. Decide what access you are granting, what the sender should route, and how broadly the receiving rule should match.
| Decision | Narrower option | Broader option | Review point |
|---|---|---|---|
| Who may publish? | Name a specific AWS account. | Use an organization ID condition for accounts in an AWS Organization. | With a wildcard principal, retain the condition that limits it to the intended organization. |
| What may the sender do? | Grant events:PutEvents for publishing. |
Grant rule-management actions only when needed. | Separate sending permission from PutRule and PutTargets. |
| Which inbound events run a receiver rule? | Filter by account and relevant event fields. | Omit account when any authorized sender should match. |
A literal * in account does not match all accounts. |
For a single known sender, a named account principal is straightforward to audit. For many accounts in the same organization, an organization condition can reduce repeated account-specific authorization, but it shifts more importance to the condition and receiver-side filtering. In both cases, use the least action scope that supports the integration and be explicit about which accounts’ events a receiver rule is supposed to process.
Troubleshoot common setup failures
The sender is denied when putting events
- Check that the receiving bus policy names the correct sender account or the intended organization ID condition.
- Confirm that the policy grants
events:PutEventson the actual receiving bus ARN. - Check that the target uses the right bus ARN, including account and Region.
- For a new cross-account target created after March 2, 2023, verify that an IAM role is attached to the sender-side target.
Also verify which side of the integration owns each setting. The receiving account updates the bus policy; the sending account configures its rule and target. A correct policy on the sender’s own bus does not authorize publishing to the receiver’s bus. When reviewing the ARN, compare its account, Region, and bus name against the destination selected for the integration.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The target is configured but the receiver’s rule does not run
- Check that the sender’s rule pattern matches the events that are meant to be forwarded.
- Check the receiver’s event pattern, especially any
accountrestriction. A literal*in that field will not match any account. - For a receiving rule intended to accept multiple authorized accounts, omit
accountrather than using*, and constrain the pattern with the other relevant event fields.
Separate the two pattern checks: first, does the sender-side rule match the source event and route it to the destination? Second, does the receiving-side rule match the event after it arrives? If the receiving rule is specifically for the receiver account’s own events, its account constraint will not express a rule for arbitrary external senders. If it should match any authorized sender, omit the field and refine the pattern using the other event attributes that matter.
The permissions appear broader than intended
Separate sending permission from rule-management permission. Remove PutRule or PutTargets if the external account only needs to publish, and review wildcard principals and conditions carefully. For organization access, verify the aws:PrincipalOrgID condition; for broad inbound access, use account IDs in receiver-side patterns as appropriate.
Review the policy statement-by-statement. Ask whether every principal needs to publish, whether every action is required, and whether each statement applies only to the destination bus and intended rule scope. For an organization-wide principal, verify the organization ID condition rather than treating the wildcard as the whole authorization. Where rule administration is needed, consider the account that created the rule as part of the restriction described in AWS’s management example.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Configuration checklist
- The receiving bus policy grants only the intended principal and actions.
- The bus ARN identifies the correct receiver account, Region, and bus.
- The sender rule matches only the events intended for delivery.
- The sender-side target has an IAM role when required for a new cross-account target.
- The receiving rule pattern accounts for the expected sending accounts and event fields.
- Cross-Region support, billing responsibility, and any forwarding assumptions have been checked against the intended architecture.
Before finishing, make sure the policy, sender rule, target role, and receiver rule have all been reviewed in their respective accounts. Confirm that the desired behavior is explicit: who is allowed to send, which events the sender forwards, and which inbound events the receiver processes. If a CLI workflow is used, remember that the role is not created automatically as it is in the console target setup.
Free tools Windows power users keep installed
One-click scans. No signup required.
AWS’s relevant guidance is documented in Permissions for event buses in Amazon EventBridge, Managing event bus permissions in Amazon EventBridge, Sending and receiving events between AWS accounts in Amazon EventBridge, and the Amazon EventBridge permissions reference. The instructions referenced here were accessed October 13, 2026; AWS console labels and service behavior can change, so confirm the current documentation when implementing the policy.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Frequently Asked Questions
How do I allow another AWS account to put events on my EventBridge bus?
In the receiving account, add a resource-based policy to the destination bus that grants the sender account events:PutEvents on that bus. In the sending account, create a rule that targets the receiving bus ARN. For a new cross-account target created after March 2, 2023, configure an IAM role on the sender-side target as well.
Do I need an IAM role to send events to another account?
For new cross-account event-bus targets created after March 2, 2023, AWS requires an IAM role attached to the target. The console creates the role during setup; with the AWS CLI, create it manually and attach it. This role does not replace the receiving bus policy.
Should I grant PutRule and PutTargets to the sending account?
Not if the account only needs to publish events. Grant events:PutEvents for sending. Authorize events:PutRule and events:PutTargets separately only when the external account must create or manage rules or targets, and restrict those permissions to the appropriate scope.
Can I allow every account in my AWS Organization to publish?
AWS’s example uses a wildcard principal with a StringEquals condition on aws:PrincipalOrgID. Use the actual organization ID and retain the condition so the wildcard is constrained. Also decide which accounts’ events receiving rules should process.
How do I match events from any authorized sender?
For a receiving rule that should match events from any authorized sender, omit the account field in the event pattern. A literal * in that field does not mean any account and will not match. If only known sender accounts should trigger processing, include their account IDs instead.
Who pays for cross-account EventBridge delivery?
AWS documents that the sending account pays for cross-account delivery as custom events; the receiving account is not charged for those events. Check current EventBridge pricing for the Region and usage because rates can change.
Can a receiving bus forward an event onward to a third account?
The documented cross-account flow does not forward events received from a sender onward to a third account. Do not assume the receiving bus can act as a relay through this pattern; validate a different architecture if onward delivery is required.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Can EventBridge send events between different AWS Regions?
Cross-account delivery can work across Regions when the destination Region supports cross-Region delivery. Confirm support for the intended destination Region before configuring the route.
The Bottom Line
Cross-account EventBridge access needs coordinated configuration on both sides: grant the sender narrowly scoped events:PutEvents access on the receiving bus, target that bus ARN from a sender-side rule, and attach the required IAM role to new cross-account targets created after March 2, 2023. Then use receiver-side event patterns to control what is processed. Keep publishing separate from rule administration, verify the organization condition and account filters where applicable, and confirm Region, billing, and forwarding assumptions against current AWS guidance.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
