EventBridge
Amazon EventBridge is the AWS event bus. Services publish events to it (a GuardDuty finding, a Config rule evaluation), rules match those events by pattern, and targets act on them. The AWS Baseline uses five rules in the security account to turn findings into alerts and, in one case, into an automatic fix.
What it does
A rule has an event pattern and one or more targets. When an event matching the pattern reaches the bus, EventBridge invokes each target: an SNS topic, a Lambda function, a Systems Manager Automation document, and many others. Patterns can filter on any field, including numeric comparisons and account ids.
How BuiltForProd uses it
The security-remediation unit deploys the security-remediation module once, in the security account, which is the delegated administrator for GuardDuty and Security Hub and therefore sees every account's findings.
| Rule | Matches | Target |
|---|---|---|
acme-guardduty-high-severity | GuardDuty findings with severity 7 or above | SNS topic acme-security-alerts |
acme-s3-public-access-block | New, failed Security Hub findings whose title starts with S3, from any account except the public account | SSM Automation AWS-DisableS3BucketPublicReadWrite on the bucket named in the finding |
acme-sg-open-access-notify | New, failed Security Hub findings whose title starts with EC2 or VPC | SNS topic |
acme-ebs-unencrypted-notify | AWS Config compliance change to NON_COMPLIANT for rules named encrypted-volumes* | SNS topic |
acme-iam-key-unused-notify | AWS Config compliance change to NON_COMPLIANT for rules named access-keys-rotated* | SNS topic |
Only the S3 rule changes anything. It runs the Automation document through the role acme-security-remediation-role, which may start automation executions and set a bucket's public access block. The public account is exempted by account id in the event pattern because it is the one place a public bucket is intended. The Config rule names are matched by prefix because rules deployed from a conformance pack carry a generated suffix.
Which services produce events is decided in environments/core/security/security.hcl, the file that switches GuardDuty, Security Hub, Inspector and Macie on or off. The rules exist regardless; a switched-off service simply publishes nothing. The topic's email subscriber comes from the same file.
Scheduled drift detection is not an EventBridge job. It is a GitHub Actions cron workflow in the landing-zone repository.
Terms you will see
| Term | Meaning |
|---|---|
| Event bus | The channel events are published to; each account has a default bus. |
| Event pattern | The JSON filter a rule applies to incoming events. |
| Target | What a rule invokes on a match. |
| Input transformer | The mapping that turns an event field, such as a bucket name, into the target's input. |
| Automation document | A Systems Manager runbook, here the AWS-managed one that blocks public S3 access. |
Where to read more
- AWS Baseline overview
- SNS for where the notifications go
- Security Hub and AWS Config for the findings that trigger the rules