AWS Security Hub · EventBridge
EventBridge.4: Global endpoints should have event replication
Written and reviewed by Emnode · Last reviewed
What does AWS Security Hub EventBridge.4 check?
EventBridge.4 fails when an EventBridge global endpoint does not have event replication enabled. A global endpoint uses a Route 53 health check to fail traffic over to a secondary Region automatically.
Why does EventBridge.4 matter?
When a global endpoint fails over without replication, events published during the switch are stranded in the primary Region until it recovers, and recovery needs a manual health-check reset. With replication on, events are mirrored to the secondary bus, so failover is self-healing and no events are lost in the gap. It is the difference between a system that recovers on its own and one that needs an operator at 3am.
How do I fix EventBridge.4?
- List global endpoints and check the ReplicationConfig state with describe-endpoint.
- Enable replication with update-endpoint (ReplicationConfig State ENABLED) and the IAM role that allows cross-Region PutEvents.
- Ensure the custom event bus shares the same name in both Regions, which the global endpoint requires.
- Enforce replication on new endpoints via IaC, accepting the small per-event cross-Region cost.
Remediation script · bash
# Enable event replication on an existing global endpoint.
# (Re-supply the existing routing config so it isn't cleared on update.)
# State=ENABLED requires a --role-arn: EventBridge assumes this role to
# provision the managed rules that replicate events to both Regions.
aws events update-endpoint \
--name orders-global \
--replication-config State=ENABLED \
--role-arn arn:aws:iam::111122223333:role/eventbridge-global-endpoint-replication \
--routing-config '{"FailoverConfig":{"Primary":{"HealthCheck":"arn:aws:route53:::healthcheck/abc123"},"Secondary":{"Route":"us-west-2"}}}' \
--event-buses '[{"EventBusArn":"arn:aws:events:us-east-1:111122223333:event-bus/orders-bus"},{"EventBusArn":"arn:aws:events:us-west-2:111122223333:event-bus/orders-bus"}]'
# Verify replication is now enabled.
aws events describe-endpoint --name orders-global \
--query 'ReplicationConfig.State'Full walkthrough (console steps, edge cases and verification) in the lesson Enable event replication on EventBridge global endpoints.
Is EventBridge.4 a false positive?
Replication mirrors every custom event to both Regions' buses, so each event is processed in both places (asynchronously), and that's exactly wrong for a pipeline whose consumers aren't idempotent, where double-processing means duplicate side effects, not just duplicate cost. A team may deliberately leave replication off and accept the documented trade-off: failover still routes traffic to the secondary Region, it just needs a manual Route 53 health-check reset to fail back. That's a conscious availability-versus-correctness decision, not a misconfiguration. If you've made it on purpose, record the rationale and suppress the finding rather than enabling replication and breaking your consumers' exactly-once assumptions.
More EventBridge controls
- EventBridge.3 Custom event buses should have a resource policy