grant cross-account access to an eventbridge custom event bus using a resource-based policy

Steps

1. Call PutPermission on the target event bus, specifying either an individual AWS account ID or an AWS Organization ID as the principal.
2. To allow every account in an AWS Organization at once, specify the principal as a wildcard with a condition referencing the Organization ID rather than calling PutPermission per account.
3. On the sending account's side, create a rule whose target is the remote account's event bus ARN, granting the rule's execution role permission to put events.
4. Keep the resulting resource policy under the event bus policy size limit; for many accounts, prefer the Organization-based condition over enumerating each account ID.
5. Verify delivery by sending a test event and confirming it lands on the target bus, then add a rule and target on the receiving account to route it further.