EventBridge:Route events to EventBridge

Description

• Both the same-account event routing feature and the cross-account event routing feature allow you to route events across regions.

• Events of the system event bus and custom event buses can be routed to only custom event buses.

Route events to the same account

1. Log on to the EventBridge console. In the left-side navigation pane, click Event Buses.

2. In the top navigation bar, select a region. On the Event Buses page, click default (System Event Bus).

3. In the left-side navigation pane, click Event Rules. On the page that appears, click Create Rule.

4. In the Create Rule wizard, perform the following steps:

   1. In the Configure Basic Info step, configure Name and Description and click Next Step.

   2. In the Configure Event Pattern step, configure the following parameters and click Next Step.

      • Event Source Type: Select Alibaba Cloud Service Event Source.

      • Event Source: Select an Alibaba Cloud service event source.

      • Event Type: Select an event type.

      • Pattern Content: Enter an event pattern.

   3. In the Configure Targets step, configure the following parameters and click Create.

      • Service Type: Select Event Bus.

      • Destination Type: Select Same-account Event Bus.

      • Region: Select the region where the event bus is deployed.

      • Event Bus: Select an event bus to which you want to route the event.

      • Event: By default, this parameter is set to Complete Event. The complete data structure is routed without transformation. The data structure is defined in the CloudEvents 1.0 specification.

      Note

      You can configure up to five event targets for an event rule.

   You can query an event on the event bus to which you route the event. For more information, see Query events by event ID.

Route events across accounts

Step 1: Create a RAM role

1. Use Alibaba Cloud Account B that receives events to log on to the RAM console.

2. In the left-side navigation pane, choose Identities > Roles.

3. On the Roles page, click Create Role.

4. On the Create Role page, select Alibaba Cloud Account in the Select Role Type section and click Next.

5. Configure the RAM role.

   1. Set the RAM Role Name parameter.

   2. Optional: Set the Note parameter.

   3. Select Other Alibaba Cloud Account as Select Trusted Alibaba Cloud Account, enter the ID of Alibaba Cloud Account A that sends events, and then click OK.

Step 2: Grant permissions to the RAM role

1. Use Alibaba Cloud Account B to log on to the RAM console.

2. In the left-side navigation pane, choose Identities > Roles.

3. On the Roles page, find the RAM role that you want to manage and click Grant Permission in the Actions column.

   

   You can also select multiple RAM roles and click Grant Permission in the lower part of the RAM role list to grant permissions to multiple RAM roles at a time.

4. In the Add Permissions panel, grant permissions to the RAM role.

   1. Select a type of authorization.

      • Alibaba Cloud Account: The permissions granted to the RAM role take effect within the current Alibaba Cloud account.

      • Specific Resource Group: The permissions granted to the RAM role take effect in a specific resource group.

        Note

        If you select Specific Resource Group for Authorized Scope, make sure that the cloud service supports resource groups. For more information, see Services that work with Resource Group.

   2. Specify a principal.

      The principal is the RAM role to which permissions are granted. By default, the current RAM role is specified. You can also specify a different RAM role.

   3. Attach policies to the RAM role.

      Find and click AliyunEventBridgePutEventsPolicy in the Authorization Policy Name column. Click OK.

      Note

      • You can attach a maximum of five policies to a RAM user at a time. If you want to attach more than five policies to a RAM user, perform the operation multiple times.

      • If the system policies cannot meet your requirements, you can create a custom policy to implement fine-grained access control. This way, you can grant permissions on specific event buses to the accounts that send events. For more information, see Create custom policies

Step 3: Modify the trust policy

1. Use Alibaba Cloud Account B to log on to the RAM console.

2. In the left-side navigation pane, choose Identities > Roles.

3. On the Roles page, click the name of the RAM role that you created.

4. On the Trust Policy tab, click Edit Trust Policy.

5. Modify the trust policy and click OK.

   The following sample code shows a trust policy:

   {
       "Statement":[
           {
               "Action":"sts:AssumeRole",
               "Effect":"Allow",
               "Principal":{
                   "Service":[
                       "${Account A}@eventbridge.aliyuncs.com"
                   ]
               }
           }
       ],
       "Version":"1"
   }

   After the trust policy is modified, EventBridge of Alibaba Cloud Account A can assume the RAM role.

Step 4: Create an event rule

1. Log on to the EventBridge console by using Alibaba Cloud Account A. In the left-side navigation pane, click Event Buses.

2. In the top navigation bar, select a region. On the Event Buses page, click default (System Event Bus).

3. In the left-side navigation pane, click Event Rules. On the page that appears, click Create Rule.

4. In the Create Rule wizard, perform the following steps:

   1. In the Configure Basic Info step, configure Name and Description and click Next Step.

   2. In the Configure Event Pattern step, configure the following parameters and click Next Step.

      • Event Source Type: Select Alibaba Cloud Service Event Source.

      • Event Source: Select an Alibaba Cloud service event source.

      • Event Type: Select an event type.

      • Pattern Content: Enter an event pattern.

   3. In the Configure Targets step, configure the following parameters and click Create.

      • Service Type: Select Event Bus.

      • Destination Type: Select Cross-account Event Bus.

      • Region: Select the region where Alibaba Cloud Account B resides.

      • Account ID: Enter the ID of Alibaba Cloud Account B.

      • Event Bus Name: Enter default.

      • Role: Enter the name of the RAM role that you created in the Prerequisites section.

      • Event: By default, this parameter is set to Complete Event. The complete data structure is routed without transformation. The data structure is defined in the CloudEvents 1.0 specification.

      Note

      You can configure up to five event targets for an event rule.

   You can use Account B to query events. For more information, see Query events by event ID.