fix(events): now EventBus.grantPutEventsTo correctly handles service principals

packages/aws-cdk-lib/aws-events/lib/event-bus.ts

@@ -177,6 +177,21 @@ abstract class EventBusBase extends Resource implements IEventBus {
   }
 
   public grantPutEventsTo(grantee: iam.IGrantable): iam.Grant {
+    // Special handling for service principals
+    if (grantee.grantPrincipal instanceof iam.ServicePrincipal) {
+      const policyStatementId = `AllowPutEvents-${this.node.id}`;
+
+      new CfnEventBusPolicy(this, policyStatementId, {
+        action: 'events:PutEvents',
+        principal: grantee.grantPrincipal.service,
+        statementId: policyStatementId,
+        eventBusName: this.eventBusName,
+      });
+
+      return iam.Grant.drop(grantee, 'Service principal permissions handled via EventBusPolicy');
+    }
+
+    // Existing implementation for IAM roles/users
     return iam.Grant.addToPrincipal({
       grantee,
       actions: ['events:PutEvents'],

packages/aws-cdk-lib/aws-events/test/event-bus.grant.test.ts

@@ -0,0 +1,50 @@
+import { Template } from '../../assertions';
+import * as iam from '../../aws-iam';
+import { Stack } from '../../core';
+import { EventBus } from '../lib';
+
+describe('EventBus grants', () => {
+  test('grantPutEventsTo creates EventBusPolicy for service principal', () => {
+    // GIVEN
+    const stack = new Stack();
+    const eventBus = new EventBus(stack, 'EventBus');
+    const servicePrincipal = new iam.ServicePrincipal('states.amazonaws.com');
+
+    // WHEN
+    eventBus.grantPutEventsTo(servicePrincipal);
+
+    // THEN
+    Template.fromStack(stack).hasResourceProperties('AWS::Events::EventBusPolicy', {
+      Action: 'events:PutEvents',
+      Principal: 'states.amazonaws.com',
+      StatementId: 'AllowPutEvents-EventBus',
+      EventBusName: { Ref: 'EventBus7B8748AA' },
+    });
+  });
+
+  test('grantPutEventsTo creates IAM policy for IAM principal', () => {
+    // GIVEN
+    const stack = new Stack();
+    const eventBus = new EventBus(stack, 'EventBus');
+    const role = new iam.Role(stack, 'Role', {
+      assumedBy: new iam.ServicePrincipal('lambda.amazonaws.com'),
+    });
+
+    // WHEN
+    eventBus.grantPutEventsTo(role);
+
+    // THEN
+    Template.fromStack(stack).hasResourceProperties('AWS::IAM::Policy', {
+      PolicyDocument: {
+        Statement: [{
+          Action: 'events:PutEvents',
+          Effect: 'Allow',
+          Resource: {
+            'Fn::GetAtt': ['EventBus7B8748AA', 'Arn'],
+          },
+        }],
+        Version: '2012-10-17',
+      },
+    });
+  });
+});