EventBridge Lambda targets should have invocation authorization

What it checks

EventBridge rule: a linked Lambda target lacks modeled invocation authorization.

Where it applies

Terraform: aws_cloudwatch_event_rule

CloudFormation: AWS::Events::Rule, AWS::Events::Rule

How to fix it

1. Grant invocation for each target function or alias, matching its qualifier and source. A sufficient execution role can authorize same-account targets; cross-account targets require both role and resource-policy authorization.

Frameworks

• SOC 2 CC6.1
• NIST 800-53 rev5 AC-3

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules