[{"data":1,"prerenderedAt":61},["ShallowReactive",2],{"snippet-eventbridge-custom-bus-share-organization":3},{"id":4,"title":5,"contributors":6,"description":8,"extension":9,"gitHub":10,"introBox":13,"languages":18,"meta":22,"resources":23,"services":24,"snippets":29,"stem":54,"tags":55,"type":59,"__hash__":60},"snippets\u002Fsnippets\u002Feventbridge-custom-bus-share-organization.json","Share a Custom Event Bus with an Organization or OU Using AWS RAM",[7],"content\u002Fcontributors\u002Fmaximiliano-paz.json","Share an Amazon EventBridge custom event bus with an AWS Organization or organizational unit using AWS RAM.","json",{"template":11},{"repoURL":12},"https:\u002F\u002Fgithub.com\u002Faws-samples\u002Fserverless-snippets\u002Ftree\u002Fmain\u002Feventbridge-custom-bus-share-organization",{"headline":14,"text":15},"How it works",[16,17],"This snippet shares an Amazon EventBridge enhanced custom event bus with an AWS Organization or organizational unit using AWS Resource Access Manager. Enable RAM sharing with AWS Organizations once from the management account. An Organization principal covers all member accounts, while an OU principal limits access to accounts in that OU; in-Organization principals associate automatically without an invitation. The examples grant the explicit `SubscribeOnly` managed permission.","Choose the AWS CLI, AWS CDK, or AWS SAM tab, replace its placeholders, and run it with the credentials indicated. Each member account must create and own its Subscriber, target, delivery role, and dead-letter queue against the shared bus ARN; a target in another account is rejected during `CreateSubscriber`. The CDK and SAM options deploy the owner-side RAM share, while member-account delivery resources remain separate.",[19,20,21],"AWS CLI","TypeScript","YAML",{},null,[25,26,27,28],"eventbridge","ram","organizations","sqs",[30],{"title":31,"codeTabs":32},"Choose an implementation",[33,39,47],{"id":19,"title":19,"description":34,"snippets":35},"Run each block with the credentials of the account named in its comment. Set `PRINCIPAL_ARN` to either the Organization ARN or the OU ARN.",[36],{"language":37,"code":38},"bash","BUS_ARN=\"<EVENT_BUS_ARN>\"\nMGMT_ACCOUNT=\"<MANAGEMENT_ACCOUNT_ID>\"\nORG_ID=\"<ORGANIZATION_ID>\"\nOU_ID=\"<OU_ID>\"\nPERMISSION=\"arn:aws:ram::aws:permission\u002FAWSRAMEventBridgeEventBusV2SubscribeOnly\"\n\n# CHOOSE ONE PRINCIPAL\nPRINCIPAL_ARN=\"arn:aws:organizations::$MGMT_ACCOUNT:ou\u002F$ORG_ID\u002F$OU_ID\"\n# PRINCIPAL_ARN=\"arn:aws:organizations::$MGMT_ACCOUNT:organization\u002F$ORG_ID\"\n\n# MANAGEMENT ACCOUNT, ONE TIME\naws ram enable-sharing-with-aws-organization\n\n# OWNER ACCOUNT\nSHARE_ARN=$(aws ram create-resource-share \\\n  --name \"custom-bus-organization-share\" \\\n  --resource-arns \"$BUS_ARN\" \\\n  --principals \"$PRINCIPAL_ARN\" \\\n  --permission-arns \"$PERMISSION\" \\\n  --no-allow-external-principals \\\n  --query 'resourceShare.resourceShareArn' --output text)\n\n# OWNER ACCOUNT\naws ram get-resource-share-associations \\\n  --association-type PRINCIPAL \\\n  --resource-share-arns \"$SHARE_ARN\" \\\n  --query 'resourceShareAssociations[].[associatedEntity,status]' --output text\n\n# MEMBER ACCOUNT\naws ram list-resources --resource-owner OTHER-ACCOUNTS\n\n# OWNER ACCOUNT\naws eventsv2 get-resource-policy \\\n  --resource-arn \"$BUS_ARN\" \\\n  --policy-name AWS_RAM\n\n# MEMBER ACCOUNT: TARGET, DELIVERY ROLE, AND DLQ MUST BE IN THIS ACCOUNT\naws eventsv2 create-subscriber \\\n  --name \"fulfillment-order-placed\" \\\n  --event-bus-arn \"$BUS_ARN\" \\\n  --filter-configuration \"$(cat <<EOF\n{\"Filters\":[{\"Scope\":\"METADATA\",\"Pattern\":\"{\\\"domain\\\":[\\\"orders\\\"]}\"}]}\nEOF\n)\" \\\n  --invoke-configuration \"$(cat <<EOF\n{\"TargetArn\":\"<MEMBER_QUEUE_ARN>\",\"RoleArn\":\"<MEMBER_DELIVERY_ROLE_ARN>\"}\nEOF\n)\" \\\n  --on-failure-configuration \"$(cat <<EOF\n{\"Arn\":\"<MEMBER_DLQ_ARN>\"}\nEOF\n)\"\n\n# OWNER ACCOUNT, NARROW OR WIDEN THE GRANT\naws ram associate-resource-share-permission \\\n  --resource-share-arn \"$SHARE_ARN\" \\\n  --permission-arn \"arn:aws:ram::aws:permission\u002FAWSRAMEventBridgeEventBusV2PublishOnly\" \\\n  --replace\n\n# OWNER ACCOUNT\naws ram delete-resource-share --resource-share-arn \"$SHARE_ARN\"\n",{"id":40,"title":41,"description":42,"snippets":43},"AWS CDK","AWS CDK with TypeScript","Install `aws-cdk-lib`, `constructs`, `aws-cdk`, `typescript`, and `ts-node`. Deploy from the bus owner account with `npx cdk deploy EventBridgeV2OrganizationShare --app 'npx ts-node share-with-organization-cdk.ts' -c eventBusArn=\u003CEVENT_BUS_ARN> -c organizationPrincipalArn=\u003CORGANIZATION_OR_OU_ARN>`.",[44],{"language":45,"code":46},"ts","import * as cdk from 'aws-cdk-lib';\nimport * as ram from 'aws-cdk-lib\u002Faws-ram';\nimport { Construct } from 'constructs';\n\ninterface OrganizationShareStackProps extends cdk.StackProps {\n  readonly eventBusArn: string;\n  readonly organizationPrincipalArn: string;\n}\n\nclass OrganizationShareStack extends cdk.Stack {\n  constructor(scope: Construct, id: string, props: OrganizationShareStackProps) {\n    super(scope, id, props);\n\n    const share = new ram.CfnResourceShare(this, 'EventBusShare', {\n      name: `${this.stackName}-share`,\n      resourceArns: [props.eventBusArn],\n      principals: [props.organizationPrincipalArn],\n      permissionArns: [\n        `arn:${cdk.Aws.PARTITION}:ram::aws:permission\u002FAWSRAMEventBridgeEventBusV2SubscribeOnly`,\n      ],\n      allowExternalPrincipals: false,\n    });\n\n    new cdk.CfnOutput(this, 'ResourceShareArn', {\n      value: share.attrArn,\n    });\n  }\n}\n\nconst app = new cdk.App();\nconst eventBusArn = app.node.tryGetContext('eventBusArn');\nconst organizationPrincipalArn = app.node.tryGetContext('organizationPrincipalArn');\n\nif (!eventBusArn || !organizationPrincipalArn) {\n  throw new Error('Provide -c eventBusArn=<ARN> -c organizationPrincipalArn=<ORG_OR_OU_ARN>');\n}\n\nconst eventBusRegion = eventBusArn.split(':')[3];\nconst eventBusAccount = eventBusArn.split(':')[4];\n\nnew OrganizationShareStack(app, 'EventBridgeV2OrganizationShare', {\n  env: {\n    account: eventBusAccount,\n    region: eventBusRegion,\n  },\n  eventBusArn,\n  organizationPrincipalArn,\n});\n",{"id":48,"title":48,"description":49,"snippets":50},"AWS SAM","Deploy from the bus owner account with `sam deploy --template-file share-with-organization-sam.yaml --stack-name event-bus-organization-share --region \u003CEVENT_BUS_REGION> --parameter-overrides EventBusArn=\u003CEVENT_BUS_ARN> OrganizationPrincipalArn=\u003CORGANIZATION_OR_OU_ARN> --no-confirm-changeset --no-fail-on-empty-changeset`.",[51],{"language":52,"code":53},"css","AWSTemplateFormatVersion: '2010-09-09'\nTransform: AWS::Serverless-2016-10-31\nDescription: Share an existing EventBridge enhanced custom event bus with an AWS Organization or OU.\n\nParameters:\n  EventBusArn:\n    Type: String\n    Description: ARN of the enhanced custom event bus to share.\n  OrganizationPrincipalArn:\n    Type: String\n    Description: ARN of the AWS Organization or organizational unit that will receive access.\n\nResources:\n  EventBusShare:\n    Type: AWS::RAM::ResourceShare\n    Properties:\n      Name: !Sub '${AWS::StackName}-share'\n      ResourceArns:\n        - !Ref EventBusArn\n      Principals:\n        - !Ref OrganizationPrincipalArn\n      PermissionArns:\n        - !Sub 'arn:${AWS::Partition}:ram::aws:permission\u002FAWSRAMEventBridgeEventBusV2SubscribeOnly'\n      AllowExternalPrincipals: false\n\nOutputs:\n  ResourceShareArn:\n    Description: ARN of the AWS RAM resource share.\n    Value: !GetAtt EventBusShare.Arn\n","snippets\u002Feventbridge-custom-bus-share-organization",[56,40,48,57,58],"AWS RAM","AWS Organizations","Cross-account","Integration","bFguBvueadFGp-GRR84_ILaaQH_dHpWtTVZfegKTxoQ",1790678109863]