Back to Checks
aws

EventBridge global endpoint has event replication enabled

eventbridge_global_endpoint_event_replication_enabled
Service: eventbridgeSeverity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:AwsEventsEndpoint

EventBridge global endpoints are configured with event replication ENABLED (not DISABLED) so custom events are replicated to both the primary and secondary Regions.

Prowler logoProwlerprowler-provider-aws

Risk

No event replication degrades availability and increases RPO during Regional outages.

  • Events can be lost or delayed if the primary Region fails
  • Automatic recovery to the primary may not occur, prolonging failover
  • Cross-Region inconsistency can affect data integrity

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks eventbridge_global_endpoint_event_replication_enabled

Recommendation

Turn on event replication for global endpoints to ensure Regional resilience. Keep event buses, rules, and targets aligned across Regions. Use a dedicated IAM role with least privilege for replication. Design consumers for idempotency with unique IDs. Regularly test failover and monitor health as part of defense in depth.

Remediation

CLI

aws events update-endpoint --name <endpoint-name> --replication-config State=ENABLED --role-arn <role-arn>

Terraform

# Terraform (awscc): Enable event replication on an EventBridge global endpoint
resource "awscc_events_endpoint" "example" {
  name = "<example_resource_name>"

  event_buses = [
    { event_bus_arn = "arn:aws:events:us-east-1:<example_resource_id>:event-bus/<example_resource_name>" },
    { event_bus_arn = "arn:aws:events:us-west-2:<example_resource_id>:event-bus/<example_resource_name>" }
  ]

  routing_config = {
    failover_config = {
      primary   = { health_check = "arn:aws:route53:::healthcheck/<example_resource_id>" }
      secondary = { route        = "us-west-2" }
    }
  }

  replication_config = { state = "ENABLED" }  # Critical: enables event replication
  role_arn           = "arn:aws:iam::<example_resource_id>:role/<example_resource_name>"  # Critical: role used by replication
}

NativeIaC

# CloudFormation: Enable event replication on an EventBridge global endpoint
Resources:
  Endpoint:
    Type: AWS::Events::Endpoint
    Properties:
      Name: <example_resource_name>
      EventBuses:
        - EventBusArn: arn:aws:events:us-east-1:<example_resource_id>:event-bus/<example_resource_name>
        - EventBusArn: arn:aws:events:us-west-2:<example_resource_id>:event-bus/<example_resource_name>
      RoutingConfig:
        FailoverConfig:
          Primary:
            HealthCheck: arn:aws:route53:::healthcheck/<example_resource_id>
          Secondary:
            Route: us-west-2
      ReplicationConfig:
        State: ENABLED  # Critical: enables event replication
      RoleArn: arn:aws:iam::<example_resource_id>:role/<example_resource_name>  # Critical: role used by replication

Other

1In the AWS Console, open Amazon EventBridge and go to Global endpoints
2Select the endpoint and choose Edit
3Under Event replication, check Event replication enabled
4For Execution role, select an existing role or create a new one
5Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.eventbridge.eventbridge_client import (
    eventbridge_client,
)


class eventbridge_global_endpoint_event_replication_enabled(Check):
    def execute(self):
        findings = []
        for endpoint in eventbridge_client.endpoints.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=endpoint)
            report.status = "PASS"
            report.status_extended = f"EventBridge global endpoint {endpoint.name} has event replication enabled."
            if endpoint.replication_state == "DISABLED":
                report.status = "FAIL"
                report.status_extended = f"EventBridge global endpoint {endpoint.name} does not have event replication enabled."
            findings.append(report)
        return findings

References