EventBridgeV2 / Client / put_resource_policy

put_resource_policy

EventBridgeV2.Client.put_resource_policy(**kwargs)

Attaches a named resource policy to an event bus — the only resource type that supports policies; other resource ARNs are rejected. Each bus holds two named policies: “default” (customer-managed, full IAM policy language including Deny) and “AWS_RAM” (written exclusively by AWS Resource Access Manager to reflect resource shares). Both policies are evaluated on cross-account authorization; an explicit Deny in either overrides an Allow in the other. Operations that omit PolicyName target “default”. A “default” policy that would grant public access is rejected with PublicPolicyException and is not attached; this check is always on and cannot be disabled.

See also: AWS API Documentation

Request Syntax

response = client.put_resource_policy(
    ResourceArn='string',
    PolicyDocument='string',
    PolicyName='string',
    ExpectedRevisionId='string'
)
Parameters:

  • ResourceArn (string) –

    [REQUIRED]

    The Amazon Resource Name (ARN) that uniquely identifies an event bus.

  • PolicyDocument (string) –

    [REQUIRED]

    A resource policy document, as a JSON string. The “default” policy can be up to 20 KB (20,480 bytes of UTF-8) by default. This quota is adjustable in Service Quotas. A “default” policy that exceeds the quota is rejected with PolicyLengthExceededException. No policy document can exceed 389,120 bytes of UTF-8, regardless of the quota.

  • PolicyName (string) – Which named policy to write. Defaults to “default”, the customer-managed policy, when omitted (a write AWS Resource Access Manager makes on the owner’s behalf resolves to “AWS_RAM” instead). The two writers are exclusive in both directions — only Resource Access Manager can write “AWS_RAM”, and only the bus owner can write “default” — so naming the other party’s policy fails with AccessDeniedException. A well-formed name that is neither of the two fails with InvalidInputException.

  • ExpectedRevisionId (string) – The write succeeds only if the named policy’s current revision ID matches this value; a policy that does not exist yet matches only the sentinel “NO_POLICY” (create-only). On mismatch the operation fails with ConflictException. When omitted, the write is unconditional. Every attempt stores a newly generated revision ID, so retrying an unanswered request can conflict with the caller’s own earlier attempt; read the policy back and compare it with the one you intended before treating a conflict as another writer’s change.

Return type:

dict

Returns:

Response Syntax

{
    'ResourceArn': 'string',
    'PolicyName': 'string',
    'RevisionId': 'string'
}

Response Structure

  • (dict) –

    • ResourceArn (string) –

      The Amazon Resource Name (ARN) that uniquely identifies an event bus.

    • PolicyName (string) –

      Name of a policy attached to a resource. Valid values: “default” (the customer-managed policy) and “AWS_RAM” (managed exclusively by AWS Resource Access Manager). Any other value is rejected.

    • RevisionId (string) –

      Absent when the write removed the policy; a removal produces no new revision.

Exceptions