测试GuardDuty Slack告警时EventBridge报NotAuthorizedForSourceException如何解决？

已完成AWS GuardDuty通过Slack发送告警的配置，测试时尝试向事件总线发送以下模拟事件：

{
  "version": "0",
  "detail-type": "GuardDuty Finding",
  "source": "aws.guardduty",
  "account": "187760472520",
  "time": "2024-02-28T16:46:43Z",
  "region": "us-west-2",
  "resources": [],
  "detail": {
    "severity": 3.5,
    "description": "Example GuardDuty finding"
  }
}

收到错误：Error. NotAuthorizedForSourceException. Not authorized for the source.
该错误含义为：无权限使用该源向此事件总线发布事件

当前使用的事件总线模板资源基础策略如下：

{
  "Version": "2012-10-17",
  "Statement": [{
    "Sid": "AllowAccountToPutEvents",
    "Effect": "Allow",
    "Principal": {
      "AWS": "arn:aws:iam::<Account ID>:root"
    },
    "Action": "events:PutEvents",
    "Resource": "arn:aws:events:us-west-2:<Account ID>:event-bus/default"
  }, {
    "Sid": "AllowAllAccountsFromOrganizationToPutEvents",
    "Effect": "Allow",
    "Principal": "*",
    "Action": "events:PutEvents",
    "Resource": "arn:aws:events:us-west-2:<Account ID>:event-bus/default",
    "Condition": {
      "StringEquals": {
        "aws:PrincipalOrgID": "<Org ID>"
      }
    }
  }, {
    "Sid": "AllowAccountToManageRulesTheyCreated",
    "Effect": "Allow",
    "Principal": {
      "AWS": "arn:aws:iam::<Account ID>:root"
    },
    "Action": ["events:PutRule", "events:PutTargets", "events:DeleteRule", "events:RemoveTargets", "events:DisableRule", "events:EnableRule", "events:TagResource", "events:UntagResource", "events:DescribeRule", "events:ListTargetsByRule", "events:ListTagsForResource"],
    "Resource": "arn:aws:events:us-west-2:<Account ID>:rule/default",
    "Condition": {
      "StringEqualsIfExists": {
        "events:creatorAccount": "<Account ID>"
      }
    }
  }]
}

已确认控制台用户具备events:PutEvents的IAM权限，需修复该错误。

原因分析 #

错误源于事件总线的资源策略未明确允许当前IAM主体使用aws.guardduty作为事件源发送事件。即便IAM用户拥有PutEvents权限，事件总线仍需额外授权指定的事件源。

具体修复步骤 #

• 修改事件总线资源策略，添加事件源授权
  在允许events:PutEvents的语句中加入events:source条件，明确允许aws.guardduty作为事件源：

  1. 若使用本账户内用户测试，修改第一个Statement：

     {
       "Sid": "AllowAccountToPutEvents",
       "Effect": "Allow",
       "Principal": {
         "AWS": "arn:aws:iam::<Account ID>:root"
       },
       "Action": "events:PutEvents",
       "Resource": "arn:aws:events:us-west-2:<Account ID>:event-bus/default",
       "Condition": {
         "StringEquals": {
           "events:source": "aws.guardduty"
         }
       }
     }
     

  2. 若需允许组织内所有账户发送GuardDuty事件，修改第二个Statement：

     {
       "Sid": "AllowAllAccountsFromOrganizationToPutEvents",
       "Effect": "Allow",
       "Principal": "*",
       "Action": "events:PutEvents",
       "Resource": "arn:aws:events:us-west-2:<Account ID>:event-bus/default",
       "Condition": {
         "And": [
           {
             "StringEquals": {
               "aws:PrincipalOrgID": "<Org ID>"
             }
           },
           {
             "StringEquals": {
               "events:source": "aws.guardduty"
             }
           }
         ]
       }
     }
     

• 针对非root用户的额外配置
  若使用的是IAM用户而非root账户操作，需将该用户ARN添加到事件总线策略的Principal列表中，示例：

  "Principal": {
    "AWS": [
      "arn:aws:iam::<Account ID>:root",
      "arn:aws:iam::<Account ID>:user/your-test-user"
    ]
  }
  

• 验证修复
  策略修改完成后，重新发送模拟事件，确认错误消失。

内容的提问来源于stack exchange，提问作者Luke Muther