Skip to content

Commit 541a34b

Browse files
julianwoodjulianwood
authored
Merge pull request #2806 from rajeshwerkushwaha/eventbridge-api-destination-with-cmk
Eventbridge api destination with cmk
2 parents b73f81a + 657b135 commit 541a34b

File tree

8 files changed

+720
-1
lines changed

8 files changed

+720
-1
lines changed

‎eventbridge-api-destinations/12-oauth-api-cmk-encryption/README.md‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
# Amazon EventBridge API Destinations with OAuth and CMK Encryption
2+
3+
Amazon EventBridge announces support for Amazon Key Management Service (KMS) Customer Managed Keys (CMK) in API destinations connections. This enhancement enables you to encrypt your HTTPS endpoint authentication credentials managed by API destinations with your own keys instead of an AWS owned key (which is used by default). With CMK support, you now have more granular security control over your authentication credentials used in API destinations, helping you meet your organization's security requirements and governance policies.
4+
5+
This sample demonstrates how to use Amazon EventBridge API Destinations with OAuth authentication and AWS CMK encryption.
6+
7+
## Overview
8+
9+
- **EventBridge API Destinations**: Send events to external HTTP endpoints.
10+
- **OAuth Authentication**: Secure API calls using OAuth 2.0.
11+
- **CMK Encryption**: Protect sensitive data using a customer managed KMS key.
12+
13+
## Architecture
14+
15+
1. **EventBridge Rule** triggers on specific events.
16+
2. **API Destination** sends the event to an external API using OAuth.
17+
3. **KMS CMK** encrypts secrets and sensitive data.
18+
19+
![alt EventBridge Rule with CMK integration](diagram.png "Architecture")
20+
21+
## Prerequisites
22+
23+
* [Create an AWS account](https://portal.aws.amazon.com/gp/aws/developer/registration/index.html) if you do not already have one and log in. The IAM user that you use must have sufficient permissions to make necessary AWS service calls and manage AWS resources.
24+
* [AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/install-cliv2.html) installed and configured
25+
* [Git Installed](https://git-scm.com/book/en/v2/Getting-Started-Installing-Git)
26+
* [AWS Serverless Application Model](https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/serverless-sam-cli-install.html) (AWS SAM) installed
27+
28+
* Also, run the below CloudFormation (CFN) command to create pre-requisit resources:
29+
```bash
30+
aws cloudformation create-stack --stack-name serverlessland-prerequisite --template-body file://prerequisite.yaml
31+
```
32+
* Above command will create stack with the below resources, please goto the CFN console and select your pre-requisite stack. Copy the output in the notepad, we'll need this later.
33+
- External API URL for HTTP API Endpoint. If you already have one you can also use that.
34+
- Cognito Authorization Endpoint. If you have any external authorizer endpoint you can use that.
35+
- Cognito OAuth Client ID.
36+
- OAuth Client Secret. To get that you need to goto aws cognito console, goto your MyServerlessLandUserPool and click on your App Client -> MyWebClient and copy the Client secret, we'll need this later.
37+
- CMK key in KMS. Please not the arn, we'll use this later.
38+
39+
## Deployment
40+
41+
* Run the below command and provide all the parameter details which we can saved previously.
42+
```bash
43+
sam deploy --guided
44+
```
45+
46+
## Testing
47+
48+
1. From a command line in this directory, send a test event to EventBridge simulating a \"EventBridge CMK Demo success\" event.
49+
```bash
50+
aws events put-events --entries file://testEvent.json
51+
```
52+
2. To verify if everything works correctly, you can check the execution logs of your api.
53+
54+
## Cleanup
55+
56+
1. Delete the stack
57+
```bash
58+
sam delete --stack-name STACK_NAME
59+
```
60+
2. Confirm the stack has been deleted
61+
```bash
62+
aws cloudformation list-stacks --query "StackSummaries[?contains(StackName,'STACK_NAME')].StackStatus"
63+
```
64+
65+
## Resources
66+
67+
- [Amazon EventBridge now supports Customer Managed Keys (CMK) in API destinations connections](https://aws.amazon.com/about-aws/whats-new/2025/04/amazon-eventbridge-customer-managed-keys-api/)
68+
69+
- [Encrypting Amazon EventBridge connection authorization with AWS KMS keys](https://docs.aws.amazon.com/eventbridge/latest/userguide/encryption-connections.html)
70+
71+
- [Using API destinations with Amazon EventBridge](https://aws.amazon.com/blogs/compute/using-api-destinations-with-amazon-eventbridge/)
72+
73+
- [Use Amazon EventBridge to Build Decoupled, Event-Driven Architectures](https://serverlessland.com/learn/eventbridge)
74+
75+
76+
----
77+
78+
Copyright 2025 Amazon.com, Inc. or its affiliates. All Rights Reserved.
79+
80+
SPDX-License-Identifier: MIT-0

‎eventbridge-api-destinations/12-oauth-api-cmk-encryption/diagram.png‎

295 KB
Loading

‎eventbridge-api-destinations/12-oauth-api-cmk-encryption/eventbridge-api-destination-oauth-api-cmk-encryption.json‎

Lines changed: 130 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,130 @@
1+
{
2+
"title": "EventBridge API Destinations with OAuth credentials using CMK encryption",
3+
"description": "Create an EventBridge rule and API Destination with OAuth credentials using Customer Managed Key (CMK) encryption",
4+
"language": "Node.js",
5+
"level": "100",
6+
"framework": "AWS SAM",
7+
"services": {
8+
"from": "eventbridge",
9+
"to": "eventbridge"
10+
},
11+
"introBox": {
12+
"headline": "How it works",
13+
"text": [
14+
"This pattern configures an EventBridge rule that routes to an API Destinations target using Oauth credentials with Customer Managed Key (CMK) encryption. It configures a Connection, which contains the authorization for the API endpoint with CMK encryption, and the API, which contains the URL, http method, and other configuration information."
15+
],
16+
"test": ""
17+
},
18+
"deploy": {
19+
"text": [
20+
"cd ./12-oauth-api-with-cmk-encryption",
21+
"sam deploy --guided"
22+
]
23+
},
24+
"testing": {
25+
"headline": "Testing",
26+
"text": [
27+
"1. From a command line in this directory, send a test event to EventBridge simulating a \"EventBridge CMK Demo success\" event: <code>aws events put-events --entries file://testEvent.json</code>"
28+
]
29+
},
30+
"cleanup": {
31+
"headline": "Cleanup",
32+
"text": [
33+
"1. Delete the stack: <code>sam delete --stack-name STACK_NAME</code>.",
34+
"2. Confirm the stack has been deleted: <code>aws cloudformation list-stacks --query \"StackSummaries[?contains(StackName,'STACK_NAME')].StackStatus\"</code>"
35+
]
36+
},
37+
"gitHub": {
38+
"template": {
39+
"projectFolder": "eventbridge-api-destinations",
40+
"repoURL": "https://github.com/aws-samples/serverless-patterns/tree/main/eventbridge-api-destinations/12-oauth-api-with-cmk-encryption",
41+
"templateURL": "serverless-patterns/eventbridge-api-destinations",
42+
"templateFile": "12-oauth-api-with-cmk-encryption/template.yaml"
43+
},
44+
"payloads": [
45+
{
46+
"headline": "",
47+
"payloadURL": ""
48+
}
49+
]
50+
},
51+
"resources": {
52+
"headline": "Additional resources",
53+
"bullets": [
54+
{
55+
"text": "Amazon EventBridge now supports Customer Managed Keys (CMK) in API destinations connections",
56+
"link": "https://aws.amazon.com/about-aws/whats-new/2025/04/amazon-eventbridge-customer-managed-keys-api/"
57+
},
58+
{
59+
"text": "Encrypting EventBridge connection authorization with AWS KMS keys",
60+
"link": "https://docs.aws.amazon.com/eventbridge/latest/userguide/encryption-connections.html"
61+
},
62+
{
63+
"text": "Using API destinations with Amazon EventBridge",
64+
"link": "https://aws.amazon.com/blogs/compute/using-api-destinations-with-amazon-eventbridge/"
65+
},
66+
{
67+
"text": "Use Amazon EventBridge to Build Decoupled, Event-Driven Architectures",
68+
"link": "https://serverlessland.com/learn/eventbridge"
69+
}
70+
]
71+
},
72+
"authors": [
73+
{
74+
"name": "Rajesh Kumar",
75+
"image": "https://avatars.githubusercontent.com/u/4745639",
76+
"bio": "Rajesh Kumar is a Technical Account Manager (TAM) at Amazon Web Services (AWS) and contributor to ServerlessLand. He is passionate about serverless and wants to help everyone get started with serverless and what can be done with it.",
77+
"linkedin": "rajeshk1988"
78+
},
79+
{
80+
"name": "Biswanath Mukherjee",
81+
"image": "https://d1rwvjey2iif32.cloudfront.net",
82+
"bio": "I am a Sr. Solutions Architect working at AWS India.",
83+
"linkedin": "biswanathmukherjee"
84+
}
85+
],
86+
"tags": [
87+
"EventBridge",
88+
"API Destinations",
89+
"OAuth",
90+
"CMK Encryption",
91+
"Serverless"
92+
],
93+
"patternArch": {
94+
"icon1": {
95+
"x": 15,
96+
"y": 50,
97+
"service": "eventbridge",
98+
"label": "EventBridge rule"
99+
},
100+
"group": {
101+
"x": 30,
102+
"y": 20,
103+
"w": 65,
104+
"h": 60,
105+
"label": "API Destinations"
106+
},
107+
"icon2": {
108+
"x": 40,
109+
"y": 50,
110+
"service": "eventbridge-connection.png",
111+
"label": "Connection"
112+
},
113+
"icon3": {
114+
"x": 85,
115+
"y": 50,
116+
"service": "eventbridge-api.png",
117+
"label": "API"
118+
},
119+
"line1": {
120+
"from": "icon1",
121+
"to": "icon2",
122+
"label": ""
123+
},
124+
"line2": {
125+
"from": "icon2",
126+
"to": "icon3",
127+
"label": "with OAuth using CMK encryption"
128+
}
129+
}
130+
}

‎eventbridge-api-destinations/12-oauth-api-cmk-encryption/example-pattern.json‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
{
2+
"title": "EventBridge API Destinations with OAuth credentials using CMK encryption",
3+
"description": "Create an EventBridge rule and API Destination with OAuth credentials using Customer Managed Key (CMK) encryption",
4+
"language": "Node.js",
5+
"level": "100",
6+
"framework": "AWS SAM",
7+
"services": {
8+
"from": "eventbridge",
9+
"to": "eventbridge"
10+
},
11+
"introBox": {
12+
"headline": "How it works",
13+
"text": [
14+
"This pattern configures an EventBridge rule that routes to an API Destinations target using Oauth credentials with Customer Managed Key (CMK) encryption. It configures a Connection, which contains the authorization for the API endpoint with CMK encryption, and the API, which contains the URL, http method, and other configuration information."
15+
],
16+
"test": ""
17+
},
18+
"deploy": {
19+
"text": [
20+
"cd ./12-oauth-api-cmk-encryption",
21+
"sam deploy --guided"
22+
]
23+
},
24+
"testing": {
25+
"headline": "Testing",
26+
"text": [
27+
"1. From a command line in this directory, send a test event to EventBridge simulating a \"EventBridge CMK Demo success\" event: <code>aws events put-events --entries file://testEvent.json</code>"
28+
]
29+
},
30+
"cleanup": {
31+
"headline": "Cleanup",
32+
"text": [
33+
"1. Delete the stack: <code>sam delete --stack-name STACK_NAME</code>.",
34+
"2. Confirm the stack has been deleted: <code>aws cloudformation list-stacks --query \"StackSummaries[?contains(StackName,'STACK_NAME')].StackStatus\"</code>"
35+
]
36+
},
37+
"gitHub": {
38+
"template": {
39+
"projectFolder": "eventbridge-api-destinations",
40+
"repoURL": "https://github.com/aws-samples/serverless-patterns/tree/main/eventbridge-api-destinations/12-oauth-api-cmk-encryption",
41+
"templateURL": "serverless-patterns/eventbridge-api-destinations",
42+
"templateFile": "12-oauth-api-cmk-encryption/template.yaml"
43+
},
44+
"payloads": [
45+
{
46+
"headline": "",
47+
"payloadURL": ""
48+
}
49+
]
50+
},
51+
"resources": {
52+
"headline": "Additional resources",
53+
"bullets": [
54+
{
55+
"text": "Amazon EventBridge now supports Customer Managed Keys (CMK) in API destinations connections",
56+
"link": "https://aws.amazon.com/about-aws/whats-new/2025/04/amazon-eventbridge-customer-managed-keys-api/"
57+
},
58+
{
59+
"text": "Encrypting EventBridge connection authorization with AWS KMS keys",
60+
"link": "https://docs.aws.amazon.com/eventbridge/latest/userguide/encryption-connections.html"
61+
},
62+
{
63+
"text": "Using API destinations with Amazon EventBridge",
64+
"link": "https://aws.amazon.com/blogs/compute/using-api-destinations-with-amazon-eventbridge/"
65+
},
66+
{
67+
"text": "Use Amazon EventBridge to Build Decoupled, Event-Driven Architectures",
68+
"link": "https://serverlessland.com/learn/eventbridge"
69+
}
70+
]
71+
},
72+
"authors": [
73+
{
74+
"name": "Rajesh Kumar",
75+
"image": "https://avatars.githubusercontent.com/u/4745639",
76+
"bio": "Rajesh Kumar is a Technical Account Manager (TAM) at Amazon Web Services (AWS) and contributor to ServerlessLand. He is passionate about serverless and wants to help everyone get started with serverless and what can be done with it.",
77+
"linkedin": "rajeshk1988"
78+
},
79+
{
80+
"name": "Biswanath Mukherjee",
81+
"image": "https://d1rwvjey2iif32.cloudfront.net",
82+
"bio": "I am a Sr. Solutions Architect working at AWS India.",
83+
"linkedin": "biswanathmukherjee"
84+
}
85+
],
86+
"tags": [
87+
"EventBridge",
88+
"API Destinations",
89+
"OAuth",
90+
"CMK Encryption",
91+
"Serverless"
92+
]
93+
}

0 commit comments

Comments
 (0)