Request Parameters Response Elements Errors See Also

PutResourcePolicy

Attaches a named resource policy to an event bus — the only resource type that supports policies; other resource ARNs are rejected. Each bus holds two named policies: "default" (customer-managed, full IAM policy language including Deny) and "AWS_RAM" (written exclusively by AWS Resource Access Manager to reflect resource shares). Both policies are evaluated on cross-account authorization; an explicit Deny in either overrides an Allow in the other. Operations that omit PolicyName target "default". A "default" policy that would grant public access is rejected with PublicPolicyException and is not attached; this check is always on and cannot be disabled.

Request Parameters

ExpectedRevisionId

The write succeeds only if the named policy's current revision ID matches this value; a policy that does not exist yet matches only the sentinel "NO_POLICY" (create-only). On mismatch the operation fails with ConflictException. When omitted, the write is unconditional. Every attempt stores a newly generated revision ID, so retrying an unanswered request can conflict with the caller's own earlier attempt; read the policy back and compare it with the one you intended before treating a conflict as another writer's change.

Type: String

Length Constraints: Minimum length of 1. Maximum length of 256.

Required: No

PolicyDocument

A resource policy document, as a JSON string. The maximum size is 389,120 bytes of UTF-8; the byte limit is enforced by the service.

Type: String

Length Constraints: Minimum length of 1. Maximum length of 389120.

Required: Yes

PolicyName

Which named policy to write. Defaults to "default", the customer-managed policy, when omitted (a write AWS Resource Access Manager makes on the owner's behalf resolves to "AWS_RAM" instead). The two writers are exclusive in both directions — only Resource Access Manager can write "AWS_RAM", and only the bus owner can write "default" — so naming the other party's policy fails with AccessDeniedException. A well-formed name that is neither of the two fails with InvalidInputException.

Type: String

Length Constraints: Minimum length of 1. Maximum length of 128.

Pattern: [A-Za-z0-9_]+

Required: No

ResourceArn

The Amazon Resource Name (ARN) that uniquely identifies an event bus.

Type: String

Length Constraints: Minimum length of 1. Maximum length of 1011.

Pattern: arn:aws(-[a-z0-9]+)*:events:[a-z][a-z0-9]*(-[a-z0-9]+)*:([0-9]{12}):event-busv2\/[A-Za-z0-9][\.\-_A-Za-z0-9]{0,255}\/[a-z0-9]{25}

Required: Yes

Response Elements

The following elements are returned by the service.

PolicyName

Name of a policy attached to a resource. Valid values: "default" (the customer-managed policy) and "AWS_RAM" (managed exclusively by AWS Resource Access Manager). Any other value is rejected.

Type: String

Length Constraints: Minimum length of 1. Maximum length of 128.

Pattern: [A-Za-z0-9_]+

ResourceArn

The Amazon Resource Name (ARN) that uniquely identifies an event bus.

Type: String

Length Constraints: Minimum length of 1. Maximum length of 1011.

Pattern: arn:aws(-[a-z0-9]+)*:events:[a-z][a-z0-9]*(-[a-z0-9]+)*:([0-9]{12}):event-busv2\/[A-Za-z0-9][\.\-_A-Za-z0-9]{0,255}\/[a-z0-9]{25}

RevisionId

Absent when the write removed the policy; a removal produces no new revision.

Type: String

Length Constraints: Minimum length of 1. Maximum length of 256.

Errors

For information about the errors that are common to all actions, see Common Error Types.

AccessDeniedException

The caller does not have the permissions required to perform the operation. This error is also returned when the operation cannot use the AWS KMS key for the event bus.

HTTP Status Code: 403

ConcurrentModificationException

Another change to the resource is already in progress. Retry the request.

HTTP Status Code: 409

ConflictException

A client-supplied precondition (e.g. ExpectedRevisionId on a resource-policy write) did not match the current state of the resource. Retrying the same request will fail again; re-read the resource and re-evaluate before retrying.

A conditional request is not retry-safe on its own. If an earlier attempt committed but its response never reached the caller, retrying fails with this error, which is indistinguishable from another writer having won. Compare the resource's current contents with what the request intended: a successful attempt stores a revision ID the caller never saw, so the revision alone cannot tell the two apart, but matching contents mean the change took effect.

HTTP Status Code: 409

InternalException

The request failed because of an internal service error. Retry the request.

HTTP Status Code: 500

InvalidInputException

A request parameter is missing or not valid.

HTTP Status Code: 400

PolicyLengthExceededException

The policy document exceeds the maximum allowed size.

HTTP Status Code: 400

PublicPolicyException

The policy was rejected because it would grant public access to the event bus. A statement grants public access when its principal is a wildcard and no condition limits the callers to specific AWS accounts or principals. To fix it, replace the wildcard principal with specific principals, or add a condition that limits the callers to specific AWS accounts. Conditions on event content (events:source, events:detail-type, events:Metadata/*) do not identify the caller and do not make a wildcard principal non-public. Returned only for the "default" policy; the "AWS_RAM" policy is composed by AWS Resource Access Manager and never grants public access.

HTTP Status Code: 400

ResourceNotFoundException

The resource does not exist.

HTTP Status Code: 404

ThrottlingException

The request was throttled because it exceeds a request rate limit. Retry the request with backoff.

HTTP Status Code: 429