Back to Checks
aws

AWS EventBridge schema registry does not allow cross-account access

eventbridge_schema_registry_cross_account_access
Service: eventbridgeSeverity: high
OfficialBuilt-inVerified
Categories:trust-boundariesidentity-access
Resource Type:AwsEventSchemasRegistry

EventBridge schema registry resource policies are assessed for cross-account access. It identifies statements that grant external or public principals (e.g., Principal: * or other accounts) permissions to interact with the registry and its schemas.

Prowler logoProwlerprowler-provider-aws

Risk

Unknown cross-account access exposes schema definitions, enabling reconnaissance and leaking data models (confidentiality). Excessive permissions may let outsiders alter or delete schemas, corrupt code bindings, and disrupt integrations (integrity and availability).

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks eventbridge_schema_registry_cross_account_access

Recommendation

Apply least privilege to registry resource policies:

  • Avoid public principals like Principal: *
  • Allow only trusted account ARNs or org IDs
  • Grant minimal actions, prefer read-only
  • Use separation of duties and log changes

If cross-account is needed, scope tightly and review often.

Remediation

CLI

aws schemas put-resource-policy --registry-name <example_resource_name> --policy '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::<example_account_id>:root"},"Action":"schemas:*","Resource":"*"}]}'

Terraform

# Restrict EventBridge Schema Registry policy to same account only
resource "aws_schemas_registry_policy" "<example_resource_name>" {
  registry_name = "<example_resource_name>"

  # Critical: Principal limited to same account to remove cross-account access
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect    = "Allow"
      Principal = { AWS = "arn:aws:iam::<example_account_id>:root" }
      Action    = "schemas:*"
      Resource  = "*"
    }]
  })
}

NativeIaC

# CloudFormation: Restrict EventBridge Schema Registry policy to same account only
Resources:
  <example_resource_name>RegistryPolicy:
    Type: AWS::EventSchemas::RegistryPolicy
    Properties:
      RegistryName: <example_resource_name>
      # Critical: Principal limited to this AWS account to prevent cross-account access
      Policy: !Sub |
        {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Principal": { "AWS": "arn:${AWS::Partition}:iam::${AWS::AccountId}:root" },
              "Action": "schemas:*",
              "Resource": "*"
            }
          ]
        }

Other

1Open the Amazon EventBridge console
2Go to Schemas > Registries and select <example_resource_name>
3Open the Permissions tab and click Edit
4Remove any statement with Principal set to "*" or an AWS account different from yours
5Add a single Allow statement with Principal = arn:aws:iam::<your_account_id>:root
6Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.eventbridge.schema_client import schema_client
from prowler.providers.aws.services.iam.lib.policy import is_policy_public


class eventbridge_schema_registry_cross_account_access(Check):
    def execute(self):
        findings = []
        trusted_account_ids = schema_client.audit_config.get("trusted_account_ids", [])
        for registry in schema_client.registries.values():
            if registry.policy is None:
                continue
            report = Check_Report_AWS(metadata=self.metadata(), resource=registry)
            report.status = "PASS"
            report.status_extended = f"EventBridge schema registry {registry.name} does not allow cross-account access."
            if is_policy_public(
                registry.policy,
                schema_client.audited_account,
                is_cross_account_allowed=False,
                trusted_account_ids=trusted_account_ids,
            ):
                report.status = "FAIL"
                report.status_extended = f"EventBridge schema registry {registry.name} allows cross-account access."

            findings.append(report)

        return findings

References