How to route events to an event bus - EventBridge - Alibaba Cloud Documentation Center

EventBridge supports same-account and cross-account event routing. You can use an event rule to filter and route events to an event bus that belongs to the same or a different Alibaba Cloud account. This topic describes the prerequisites, background information, usage notes, and procedure for routing events to EventBridge.

Prerequisites

Activate EventBridge and grant permissions to a RAM user

Background information

Same-account routing

As shown in the following figure, the system event bus default and custom event buses A, B, and C all belong to Alibaba Cloud account A. You can route events from any of these event buses to another custom event bus within the same account for centralized processing. 同账号路由

Cross-account routing

As shown in the following figure, Alibaba Cloud accounts A and B belong to the same or related organizations. You can route events from the sending account (Account A) to an event bus in the receiving account (Account B) for centralized processing. The general workflow is as follows:

The receiving account (Account B) creates a RAM role. The trusted entity for this role is the sending account (Account A).
The receiving account (Account B) grants the RAM role permission to publish events. This allows Account A to assume the role and publish events to Account B.
The receiving account (Account B) modifies the trust policy of the RAM role to allow the EventBridge service in the sending account to assume the role.
The sending account (Account A) creates an event rule to route events to an event bus in the receiving account (Account B).

Note

A single event bus of a receiving account can support events from multiple sending accounts. The aliyunoriginalaccountid extension field of these events identifies their origin, and the receiving account can filter events by using the aliyunoriginalaccountid field.

Usage

Both same-account and cross-account event routing support routing events between different regions.
You can route events from a system event bus only to a custom event bus. Likewise, you can route events from a custom event bus only to another custom event bus.

Same-account routing

Log in to the EventBridge console. In the left-side navigation pane, click Event Buses.
In the top navigation bar, select a region. On the Event Buses page, click the system event bus default.
In the left-side navigation pane, click Event Rules, and then click Create Rule.
In the Create Rule wizard, complete the following steps.
1. On the Configure Basic Info tab, enter a Name and Description for the rule, and then click Next.
2. On the Configure Event Pattern tab, configure the following parameters, and then click Next.
  - Event Sources: Select an Alibaba Cloud service.
  - Event Type: Select an event type.
  - Pattern Content: Enter an event pattern.
3. On the Configure Targets tab, configure the following parameters, and then click Create.
  - Service Type: Select EventBridge.
  - Destination Type: Select Same-account Event Bus.
  - Region: Select the region where the target event bus is located.
  - Event Buses: Select an event bus.
  - Event: The default is Complete Event, which delivers the complete, untransformed event in the CloudEvents 1.0 format.
  Note
  An event rule can have a maximum of five targets.
You can then query the event in the target event bus. For more information, see Query events.

Cross-account routing

Step 1: Create a RAM role

Log in to the RAM console with the receiving account (Account B).
In the left-side navigation pane, choose Identities > Roles.
On the Roles page, click Create Role.
On the Create Role page, for Trusted entity type, select Alibaba Cloud Account, and then click Next.
- Current Alibaba Cloud Account: Allows all RAM users and RAM roles in the current Alibaba Cloud account to assume this role.
- Other Alibaba Cloud Account: Allows all RAM users and RAM roles from another Alibaba Cloud account to assume this role. You must then enter the ID of the other account. This option is used for cross-account resource access. For more information, see Use a RAM role to access resources across Alibaba Cloud accounts. You can view your account ID on the Security Settings page.
Configure the role information.
1. Enter a Role Name.
2. Optional: Enter a Remarks.
3. For Select Trusted Alibaba Cloud Account, select Other Alibaba Cloud Account, enter the ID of the sending account (Account A), and then click Done.

Step 2: Grant role permissions

Log in to the RAM console with the receiving account (Account B).
In the left-side navigation pane, choose Identities > Roles.
On the Roles page, find the target RAM role and click Add Permissions in the Actions column.

You can also select multiple RAM roles and click Add Permissions at the bottom of the list to grant permissions in bulk.
In the Attach Policy panel, configure the following settings.
1. Select the authorization scope.
  - Account: The permission applies to the entire Alibaba Cloud account.
  - Resource Group: The permission applies only to the specified resource group.
    
    Note
    To grant permissions on a resource group, the cloud service must support resource groups. For more information, see Services that work with resource groups.
2. Specify the principal.
  
  The principal is the RAM role that you are authorizing. The system automatically selects the current RAM role, but you can also add others.
3. Select a permission policy.
  
  From the Policy list, search for and select AliyunEventBridgePutEventsPolicy, and then click OK.
  Note
  
  You can attach a maximum of five policies at a time. To attach more, repeat the operation.
  
  If system policies do not meet your requirements, create a custom policy for fine-grained access control and grant the sending account permissions on specific event buses. For more information, see Create custom policies.

Step 3: Modify the trust policy

Log in to the RAM console with the receiving account (Account B).
In the left-side navigation pane, choose Identities > Roles.
On the Roles page, click the name of the target RAM role.
Click the Trust Policy tab, and then click Edit Trust Policy.

Modify the trust policy, and then click Save Trust Policy.

The following code provides a sample trust policy:

{
    "Statement":[
        {
            "Action":"sts:AssumeRole",
            "Effect":"Allow",
            "Principal":{
                "Service":[
                    "Account_A_ID@eventbridge.aliyuncs.com"
                ]
            }
        }
    ],
    "Version":"1"
}

After you save the policy, the EventBridge service in the sending account (Account A) can assume the RAM role.

Step 4: Create an event rule

Log in to the EventBridge console with the sending account (Account A). In the left-side navigation pane, click Event Buses.
In the top navigation bar, select a region. On the Event Buses page, click the system event bus default.
In the left-side navigation pane, click Event Rules, and then click Create Rule.
In the Create Rule wizard, complete the following steps.
1. On the Configure Basic Info tab, enter a Name and Description for the rule, and then click Next.
2. On the Configure Event Pattern tab, configure the following parameters, and then click Next.
  - Event Sources: Select an Alibaba Cloud service.
  - Event Type: Select an event type.
  - Pattern Content: Enter an event pattern.
3. On the Configure Targets tab, configure the following parameters, and then click Create.
  - Service Type: Select EventBridge.
  - Destination Type: Select Cross-account Event Bus.
  - Region: Select the region of the target account.
  - Account ID: Enter the ID of the receiving account (Account B).
  - Event Bus Name: Enter default.
  - Role: Enter the name of the RAM role that you created in Step 1.
  - Event: The default is Complete Event, which delivers the complete, untransformed event in the CloudEvents 1.0 format.
  Note
  An event rule can have a maximum of five targets.
The receiving account (Account B) can then query the routed events. For more information, see Query events.