feat(events): add grantInvokeApiDestination to ApiDestination - #38590
Open
lemon0333 wants to merge 2 commits into
Open
feat(events): add grantInvokeApiDestination to ApiDestination#38590lemon0333 wants to merge 2 commits into
lemon0333 wants to merge 2 commits into
Conversation
Add a `grantInvokeApiDestination(grantee)` method to `IApiDestination` and `ApiDestination` that grants the `events:InvokeApiDestination` action on the API destination's ARN. The grant is scoped to `apiDestinationArnForPolicy` (the ARN in resource format) when available, since that is the ARN format expected in the Resource element of an IAM policy statement for an API destination, and falls back to `apiDestinationArn` for imported destinations that do not provide it. A shared `ApiDestinationBase` abstract class now hosts the grant method and the `apiDestinationRef` getter so it is available on both created and imported destinations, mirroring the existing `EventBusBase` pattern. Closes aws#30386.
github-actions
Bot
added
beginning-contributor
aws-cdk-automation
previously requested changes
Aug 18, 2026
The PR linter requires feature PRs to touch a README. Add an API Destinations section showing grantInvokeApiDestination usage.
aws-cdk-automation
dismissed
their stale review
August 18, 2026 07:24
✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.
aws-cdk-automation
added
the
pr/needs-further-review
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issue # (if applicable)
Closes #30386.
Reason for this change
IApiDestination/ApiDestinationinaws-eventshad no way to grant aprincipal permission to invoke the destination. Users who want to let a
role invoke an EventBridge API destination (for example a
scheduler.amazonaws.comrole used by an EventBridge Scheduler target)had to construct the
events:InvokeApiDestinationpolicy statement and thecorrect resource ARN by hand.
The L1 resource already exposes an
ArnForPolicyattribute (surfaced onthe L2 as
apiDestinationArnForPolicy) which is the ARN format expected inthe
Resourceelement of an IAM policy statement for an API destination,so a first-class grant helper is a natural addition.
Description of changes
grantInvokeApiDestination(grantee: iam.IGrantable): iam.Grantto theIApiDestinationinterface and implement it, granting theevents:InvokeApiDestinationaction.apiDestinationArnForPolicy(the resource-formatARN) when it is available, and falls back to
apiDestinationArnforimported destinations that do not provide it.
ApiDestinationBaseabstract class (mirroring theexisting
EventBusBasepattern in the same module) so the grant method andthe
apiDestinationRefgetter are shared by both created (ApiDestination)and imported (
fromApiDestinationAttributes) destinations. The twopreviously-duplicated
apiDestinationRefgetters are consolidated into thebase class.
The maintainer greenlit this addition on the issue.
Describe any new or updated permissions being added
events:InvokeApiDestination— added to the grantee's identity policy bygrantInvokeApiDestination, scoped to the API destination's resource-formatARN (
ArnForPolicy), falling back to the destination ARN for importeddestinations.
Description of how you validated changes
aws-events/test/api-destination.test.tsasserting thesynthesized
AWS::IAM::Policyfor: a created destination (uses theArnForPolicyFn::GetAtt), an imported destination withArnForPolicy,and an imported destination without
ArnForPolicy(falls back to the plainARN). All
aws-events/test/api-destinationtests pass (6/6).integ.api-destinationintegration test to grant a role invokepermission and regenerated its snapshot. The snapshot now includes the
events:InvokeApiDestinationstatement scoped to the destination'sArnForPolicy.Checklist
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license