> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# EventBridge Global Endpoints Replication Should Be Enabled

### More Info:

This rule checks if event replication is enabled for Amazon EventBridge global endpoints. The rule is NON\_COMPLIANT if event replication is not enabled.

### Risk Level

Medium

### Address

Configuration

### Compliance Standards

* APRA CPS 234 (Australia)
* BSI C5 (Germany)
* Brazil LGPD
* CCPA / CPRA (California)
* CIS Critical Security Controls v8
* CMMC 2.0
* CSA Cloud Controls Matrix v4
* Cloudanix Best Practice
* DPDPA
* Digital Operational Resilience Act (EU)
* Essential 8
* ISO/IEC 27017
* ISO/IEC 27018
* ISO/IEC 27701
* KSA PDPL
* MAS Technology Risk Management (Singapore)
* MITRE ATT\&CK (Cloud)
* NIS2 Directive
* NIST SP 800-171
* NYDFS 23 NYCRR 500
* SWIFT Customer Security Controls Framework
* Sarbanes-Oxley IT General Controls
* UK NCSC Cyber Assessment Framework

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration of EventBridge Global Endpoints Replication not being enabled for AWS CloudWatch in the AWS console, follow these step-by-step instructions:

        1. **Login to AWS Console**: Go to the AWS Management Console ([https://aws.amazon.com/](https://aws.amazon.com/)) and log in using your credentials.

        2. **Navigate to CloudWatch**: Click on the "Services" dropdown menu at the top of the page and select "CloudWatch" under the Management & Governance section.

        3. **Go to EventBridge**: In the CloudWatch dashboard, navigate to the left-hand side menu and click on "EventBridge" under the Events section.

        4. **Select Global Endpoints**: In the EventBridge dashboard, click on the "Global Endpoints" tab on the left-hand side menu.

        5. **Enable Replication**: Locate the option for "Replication" and ensure that it is enabled. If it is not enabled, click on the "Edit" button or the toggle switch to enable replication for global endpoints.

        6. **Save Changes**: After enabling replication, make sure to save the changes by clicking on the "Save" or "Update" button, typically located at the bottom or top of the page.

        7. **Verify Configuration**: Double-check that the replication for global endpoints is now enabled by reviewing the settings and ensuring that the changes have been successfully saved.

        By following these steps, you should be able to remediate the misconfiguration of EventBridge Global Endpoints Replication not being enabled for AWS CloudWatch in the AWS console.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration of EventBridge Global Endpoints Replication not being enabled for AWS CloudWatch using AWS CLI, follow these steps:

        1. Open your terminal or command prompt.

        2. Run the following AWS CLI command to enable EventBridge Global Endpoints Replication for AWS CloudWatch:

        ```bash theme={null}
        aws events put-replication-configuration --region <region-name> --destination <destination-arn> --event-bus-name <event-bus-name>
        ```

        Replace the placeholders:

        * `<region-name>`: The AWS region where the EventBridge event bus is located.
        * `<destination-arn>`: The Amazon Resource Name (ARN) of the destination where the events will be replicated.
        * `<event-bus-name>`: The name of the EventBridge event bus for AWS CloudWatch.

        3. Verify the replication configuration by running the following AWS CLI command:

        ```bash theme={null}
        aws events describe-replication-configuration --region <region-name> --event-bus-name <event-bus-name>
        ```

        Replace the placeholders:

        * `<region-name>`: The AWS region where the EventBridge event bus is located.
        * `<event-bus-name>`: The name of the EventBridge event bus for AWS CloudWatch.

        4. Ensure that the output of the `describe-replication-configuration` command shows that the replication configuration is successfully enabled for the specified event bus.

        By following these steps, you can remediate the misconfiguration of EventBridge Global Endpoints Replication not being enabled for AWS CloudWatch using AWS CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration of EventBridge global endpoints replication not being enabled in AWS CloudWatch using Python, follow these steps:

        1. Import the Boto3 library to interact with AWS services.

        ```python theme={null}
        import boto3
        ```

        2. Initialize the CloudWatch client using Boto3.

        ```python theme={null}
        cloudwatch_client = boto3.client('cloudwatch')
        ```

        3. Enable EventBridge global endpoints replication for CloudWatch using the following API call:

        ```python theme={null}
        response = cloudwatch_client.enable_insight_rules()
        ```

        4. Verify the response to ensure that the global endpoints replication has been successfully enabled.

        ```python theme={null}
        if response['ResponseMetadata']['HTTPStatusCode'] == 200:
            print("EventBridge global endpoints replication has been successfully enabled for CloudWatch.")
        else:
            print("Failed to enable EventBridge global endpoints replication for CloudWatch.")
        ```

        5. Run the Python script to execute the remediation steps.

        By following these steps, you can remediate the misconfiguration of EventBridge global endpoints replication not being enabled in AWS CloudWatch using Python.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "aws_cloudwatch_event_endpoint" "GLOBAL_ENDPOINT" {
          name = "GLOBAL_ENDPOINT_NAME" # replace with your global endpoint name

          # Preserve your existing routing configuration
          routing_config {
            failover_config {
              primary {
                health_check = "PRIMARY_HEALTH_CHECK_ARN" # replace with your existing value
              }

              secondary {
                route = "SECONDARY_ROUTE_VALUE" # replace with your existing value
              }
            }
          }

          # Preserve your existing event buses
          event_buses {
            event_bus_arn = "PRIMARY_EVENT_BUS_ARN" # replace with your existing value
          }

          event_buses {
            event_bus_arn = "SECONDARY_EVENT_BUS_ARN" # replace with your existing value
          }

          # Preserve your existing IAM role
          role_arn = "ENDPOINT_ROLE_ARN" # replace with your existing IAM role ARN

          # FIX: enable event replication for the global endpoint
          replication_config {
            state = "ENABLED"
          }
        }
        ```

        Changing only `replication_config.state` from `DISABLED` (or unset) to `ENABLED` updates the existing global endpoint in place and should not force replacement.

        To verify, `terraform plan` should show an in-place update (`~`) to `aws_cloudwatch_event_endpoint.GLOBAL_ENDPOINT` with `replication_config.state` changing to `"ENABLED"` and all other attributes unchanged.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://docs.aws.amazon.com/config/latest/developerguide/global-endpoint-event-replication-enabled.html](https://docs.aws.amazon.com/config/latest/developerguide/global-endpoint-event-replication-enabled.html)