[{"data":1,"prerenderedAt":59},["ShallowReactive",2],{"snippet-eventbridge-custom-bus-share-account":3},{"id":4,"title":5,"contributors":6,"description":8,"extension":9,"gitHub":10,"introBox":13,"languages":18,"meta":22,"resources":23,"services":24,"snippets":28,"stem":53,"tags":54,"type":57,"__hash__":58},"snippets\u002Fsnippets\u002Feventbridge-custom-bus-share-account.json","Share a Custom Event Bus with a Consumer Account Using AWS RAM",[7],"content\u002Fcontributors\u002Fmaximiliano-paz.json","Share an Amazon EventBridge custom event bus with another AWS account using AWS RAM, then attach a subscriber from the consumer account.","json",{"template":11},{"repoURL":12},"https:\u002F\u002Fgithub.com\u002Faws-samples\u002Fserverless-snippets\u002Ftree\u002Fmain\u002Feventbridge-custom-bus-share-account",{"headline":14,"text":15},"How it works",[16,17],"This snippet shares an Amazon EventBridge enhanced custom event bus with a consumer account using AWS Resource Access Manager. The examples grant the explicit `SubscribeOnly` managed permission. When the consumer is outside the owner's AWS Organization, external principals must be allowed and the consumer must accept the RAM invitation within 12 hours before using the shared bus.","Choose the AWS CLI, AWS CDK, or AWS SAM tab, replace its placeholders, and run it with the credentials indicated. The consumer account must create and own its Subscriber, target, delivery role, and dead-letter queue against the shared bus ARN; a target in another account is rejected during `CreateSubscriber`. The CDK and SAM options deploy the owner-side RAM share, while consumer delivery resources remain separate.",[19,20,21],"AWS CLI","TypeScript","YAML",{},null,[25,26,27],"eventbridge","ram","sqs",[29],{"title":30,"codeTabs":31},"Choose an implementation",[32,38,46],{"id":19,"title":19,"description":33,"snippets":34},"Run each block with the credentials of the account named in its comment. Replace the event bus, account, queue, role, and dead-letter queue placeholders.",[35],{"language":36,"code":37},"bash","BUS_ARN=\"<EVENT_BUS_ARN>\"\nCONSUMER_ACCOUNT=\"<CONSUMER_ACCOUNT_ID>\"\nPERMISSION=\"arn:aws:ram::aws:permission\u002FAWSRAMEventBridgeEventBusV2SubscribeOnly\"\n\n# OWNER ACCOUNT\nSHARE_ARN=$(aws ram create-resource-share \\\n  --name \"custom-bus-consumer-share\" \\\n  --resource-arns \"$BUS_ARN\" \\\n  --principals \"$CONSUMER_ACCOUNT\" \\\n  --permission-arns \"$PERMISSION\" \\\n  --allow-external-principals \\\n  --query 'resourceShare.resourceShareArn' --output text)\n\n# CONSUMER ACCOUNT\nINVITATION_ARN=$(aws ram get-resource-share-invitations \\\n  --query 'resourceShareInvitations[?status==`PENDING`]|[0].resourceShareInvitationArn' \\\n  --output text) \\\n&& \\\naws ram accept-resource-share-invitation \\\n  --resource-share-invitation-arn \"$INVITATION_ARN\"\n\n# CONSUMER ACCOUNT\naws ram list-resources --resource-owner OTHER-ACCOUNTS\n\n# OWNER ACCOUNT\naws ram get-resource-share-associations \\\n  --association-type PRINCIPAL \\\n  --resource-share-arns \"$SHARE_ARN\" \\\n  --query 'resourceShareAssociations[].[associatedEntity,status]' --output text\n\n# OWNER ACCOUNT\naws eventsv2 get-resource-policy \\\n  --resource-arn \"$BUS_ARN\" \\\n  --policy-name AWS_RAM\n\n# CONSUMER ACCOUNT: TARGET, DELIVERY ROLE, AND DLQ MUST BE IN THIS ACCOUNT\naws eventsv2 create-subscriber \\\n  --name \"fulfillment-order-placed\" \\\n  --event-bus-arn \"$BUS_ARN\" \\\n  --filter-configuration \"$(cat <<EOF\n{\"Filters\":[{\"Scope\":\"METADATA\",\"Pattern\":\"{\\\"domain\\\":[\\\"orders\\\"]}\"}]}\nEOF\n)\" \\\n  --invoke-configuration \"$(cat <<EOF\n{\"TargetArn\":\"<CONSUMER_QUEUE_ARN>\",\"RoleArn\":\"<CONSUMER_DELIVERY_ROLE_ARN>\"}\nEOF\n)\" \\\n  --on-failure-configuration \"$(cat <<EOF\n{\"Arn\":\"<CONSUMER_DLQ_ARN>\"}\nEOF\n)\"\n\n# OWNER ACCOUNT\naws ram delete-resource-share --resource-share-arn \"$SHARE_ARN\"\n",{"id":39,"title":40,"description":41,"snippets":42},"AWS CDK","AWS CDK with TypeScript","Install `aws-cdk-lib`, `constructs`, `aws-cdk`, `typescript`, and `ts-node`. Deploy from the bus owner account with `npx cdk deploy EventBridgeV2AccountShare --app 'npx ts-node share-with-account-cdk.ts' -c eventBusArn=\u003CEVENT_BUS_ARN> -c consumerAccountId=\u003CCONSUMER_ACCOUNT_ID>`.",[43],{"language":44,"code":45},"ts","import * as cdk from 'aws-cdk-lib';\nimport * as ram from 'aws-cdk-lib\u002Faws-ram';\nimport { Construct } from 'constructs';\n\ninterface AccountShareStackProps extends cdk.StackProps {\n  readonly eventBusArn: string;\n  readonly consumerAccountId: string;\n}\n\nclass AccountShareStack extends cdk.Stack {\n  constructor(scope: Construct, id: string, props: AccountShareStackProps) {\n    super(scope, id, props);\n\n    const share = new ram.CfnResourceShare(this, 'EventBusShare', {\n      name: `${this.stackName}-share`,\n      resourceArns: [props.eventBusArn],\n      principals: [props.consumerAccountId],\n      permissionArns: [\n        `arn:${cdk.Aws.PARTITION}:ram::aws:permission\u002FAWSRAMEventBridgeEventBusV2SubscribeOnly`,\n      ],\n      allowExternalPrincipals: true,\n    });\n\n    new cdk.CfnOutput(this, 'ResourceShareArn', {\n      value: share.attrArn,\n    });\n  }\n}\n\nconst app = new cdk.App();\nconst eventBusArn = app.node.tryGetContext('eventBusArn');\nconst consumerAccountId = app.node.tryGetContext('consumerAccountId');\n\nif (!eventBusArn || !consumerAccountId) {\n  throw new Error('Provide -c eventBusArn=<ARN> -c consumerAccountId=<ACCOUNT_ID>');\n}\n\nconst eventBusRegion = eventBusArn.split(':')[3];\nconst eventBusAccount = eventBusArn.split(':')[4];\n\nnew AccountShareStack(app, 'EventBridgeV2AccountShare', {\n  env: {\n    account: eventBusAccount,\n    region: eventBusRegion,\n  },\n  eventBusArn,\n  consumerAccountId,\n});\n",{"id":47,"title":47,"description":48,"snippets":49},"AWS SAM","Deploy from the bus owner account with `sam deploy --template-file share-with-account-sam.yaml --stack-name event-bus-account-share --region \u003CEVENT_BUS_REGION> --parameter-overrides EventBusArn=\u003CEVENT_BUS_ARN> ConsumerAccountId=\u003CCONSUMER_ACCOUNT_ID> --no-confirm-changeset --no-fail-on-empty-changeset`.",[50],{"language":51,"code":52},"css","AWSTemplateFormatVersion: '2010-09-09'\nTransform: AWS::Serverless-2016-10-31\nDescription: Share an existing EventBridge enhanced custom event bus with an AWS account.\n\nParameters:\n  EventBusArn:\n    Type: String\n    Description: ARN of the enhanced custom event bus to share.\n  ConsumerAccountId:\n    Type: String\n    AllowedPattern: '^[0-9]{12}$'\n    Description: AWS account ID that will receive access to the event bus.\n\nResources:\n  EventBusShare:\n    Type: AWS::RAM::ResourceShare\n    Properties:\n      Name: !Sub '${AWS::StackName}-share'\n      ResourceArns:\n        - !Ref EventBusArn\n      Principals:\n        - !Ref ConsumerAccountId\n      PermissionArns:\n        - !Sub 'arn:${AWS::Partition}:ram::aws:permission\u002FAWSRAMEventBridgeEventBusV2SubscribeOnly'\n      AllowExternalPrincipals: true\n\nOutputs:\n  ResourceShareArn:\n    Description: ARN of the AWS RAM resource share.\n    Value: !GetAtt EventBusShare.Arn\n","snippets\u002Feventbridge-custom-bus-share-account",[55,39,47,56],"AWS RAM","Cross-account","Integration","0927Y_AA-P1tU97tIp_qY1S7Yr7tNG3i8ytC5i3AvZY",1790678109858]