AWS服务与EventBridge是否无需角色或资源型策略即可自动集成？

Great question—let’s break this down into two clear parts to avoid confusion:

1. AWS服务与EventBridge默认总线的自动集成 #

Most core AWS services do integrate automatically with the EventBridge default event bus without requiring you to manually configure IAM roles or resource-based policies.

Here’s why:

• AWS pre-configures permissions for its native services (like EC2, S3, Lambda, RDS) to publish events to the default bus. This is part of the managed integration between AWS services and EventBridge.
• That said, some services or specific event types may require you to manually enable event delivery in the service’s console or settings (e.g., certain advanced S3 event notifications or third-party integrations). But for standard, out-of-the-box events (like EC2 state changes), no extra setup is needed.

2. Why EC2 instance state change events don’t require an attached IAM role #

You’re absolutely right that EC2 instances don’t need an attached IAM role with events:PutEvents permissions to send state change events to EventBridge. The key here is:

• These events aren’t sent by the EC2 instance itself. Instead, they’re generated by the EC2 control plane (AWS’s backend system that manages EC2 resources) and pushed directly to the default event bus.
• The EC2 control plane already has pre-defined, managed AWS permissions to publish these events on your behalf. There’s no need for instance-level IAM involvement because the event originates from AWS’s internal systems, not the running EC2 instance.

Important distinction #

If you wanted to custom-send events from an EC2 instance to EventBridge (e.g., using the AWS SDK to call PutEvents for your own custom events), you would need to attach an IAM role to the instance with a policy allowing events:PutEvents actions. But native service events like state changes are handled entirely by AWS’s backend.

内容的提问来源于stack exchange，提问作者Abhishek Palakkal Kaliyath