(aws-events): Support EventBridge cross region event routing

[stephenhibbert]

EventBridge now supports cross region events so this can now be supported in the CDK! Currently, you can route to any event bus in the three supported Regions. Cross-Region event buses can be in the same AWS account or different AWS accounts. The initial list of supported destination Regions is: US East (N. Virginia – us-east-1), US West (Oregon – us-west-2), and Europe (Ireland – eu-west-1).

https://aws.amazon.com/blogs/compute/introducing-cross-region-event-routing-with-amazon-eventbridge/

Currently we get the following error when trying to put event across region:

node_modules/@aws-cdk/aws-events/lib/rule.ts:182
            action: 'events:PutEvents',
              ^
Error: Rule and target must be in the same region

Use Case

To support cross region events in a CDK application.

Proposed Solution

Remove error check for cross region in node_modules/@aws-cdk/aws-events/lib/rule.ts

from line 97

            if (targetRegion !== sourceRegion) {
                throw new Error('Rule and target must be in the same region');
            }

But not only that, we should extend the multi-account logic to support multi-region otherwise we impose the restriction that multi-region must also be multi-account. Note that multi-region events are implemented the same way as multi account events.

Update the docs: https://docs.aws.amazon.com/cdk/api/latest/docs/aws-events-readme.html#cross-account-targets

"Note: while events can span multiple accounts, they cannot span different regions (that is an EventBridge, not CDK, limitation)."

• 👋 I may be able to implement this feature request
• ⚠️ This feature might incur a breaking change

---

This is a 🚀 Feature Request

[stephenhibbert]

@rix0rrr - I've had a go at getting this working by doing the following:
https://github.com/aws/aws-cdk/blob/master/packages/%40aws-cdk/aws-events/lib/rule.ts

1. Removed the same region check in line 181-183

      if (targetRegion !== sourceRegion) {
        throw new Error('Rule and target must be in the same region');
      }

2. Added a check for different region in line 184

if (targetAccount !== sourceAccount || targetRegion !== sourceRegion) {

However, I'm getting the following error when deploying:

 4/7 | 08:58:51 | CREATE_FAILED        | AWS::Events::Rule                      | BatchRuleus-east-1 (BatchRuleuseast1AE7EC07F) RoleArn is required for target arn:aws:events:us-east-1::event-bus/default. (Service: AmazonCloudWatchEvents; Status Code: 400; Error Code: ValidationException; Request ID: e2bd5bbe-7262-423a-a257-d83a7f3394fb; Proxy: null)

From the API docs below it seems we need to supply roleArn in the target but that works fine when targeting the cross-account target in the same region, just not for the cross account target in a different region...

Any thoughts?

AWS::Events::Rule
RoleArn
The Amazon Resource Name (ARN) of the role that is used for target invocation.

If you're setting an event bus in another account as the target and that account granted permission to your account through an organization instead of directly by the account ID, you must specify a RoleArn with proper permissions in the Target structure, instead of here in this parameter.

AWS::Events::Rule Target
RoleArn
The Amazon Resource Name (ARN) of the IAM role to be used for this target when the rule is triggered. If one rule triggers multiple targets, you can use a different IAM role for each target.

If you're setting an event bus in another account as the target and that account granted permission to your account through an organization instead of directly by the account ID, you must specify a RoleArn with proper permissions here in this parameter.

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-events-rule.html
https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-events-rule-target.html

[rossng]

This would be super useful for routing Chime events (which are always emitted in us-east-1) into the region where all my infrastructure sits.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.