I’m trying to send from lambda -> event bus. I want to restrict the bus so that only this lambda can publish events to the bus.

I’m trying to set up resource-based permissions on the bus.

I’ve solved this sending from event bus -> event bus, where I can restrict permissions to only allow events from one other event bus.

I can’t do the same sending from lambda -> event bus. I keep getting this error:

PutEvents operation: User: arn:aws:sts::xxx:assumed-role/my-lambda-role/my-lambda-role is not authorized to perform: events:PutEvents on resource: arn:aws:events:us-east-1:xxx:event-bus/my-bus with an explicit deny in a resource-based policy.

I’ve tried setting permissions for the user arn:aws:sts::xxx:assumed-role/my-lambda-role/my-lambda-role a million ways including

{
  "Version": "2012-10-17",
  "Statement": [{
    "Sid": "deny_events",
    "Effect": "Deny",
    "Principal": {
      "AWS": "*"
    },
    "Action": "events:PutEvents",
    "Resource": "arn:aws:events:us-east-1:xxx:event-bus/my-bus",
    "Condition": {
      "StringNotLike": {
        "aws:SourceIdentity": "arn:aws:sts::xxx:assumed-role/my-lambda-role/my-lambda-role"
      }
    }
  }]
}

I’ve also set conditions to (among other things):

{
    "Condition": {
      "ArnNotEquals": {
        "aws:SourceArn": "arn:aws:sts::xxx:assumed-role/my-lambda-role/my-lambda-role""
      }
    }
}

So the issue appears that I can create a condition for rules that works like:

{
"Condition": {
      "ArnNotEquals": {
        "aws:SourceArn": "arn:aws:events:us-east-1:xxx:rule/my-bus/my-rule"
      }
    }
}

but I can’t create a condition for users with arn:aws:sts::xxx:assumed-role/...