Filters

By default, subscribed applications poll for all event messages on a topic despite the relevance of each individual message to that particular subscriber. Filters provide efficiency when polling for events by making available only a subset of those events to each consumer based on filter parameters.

Understanding publisher-controlled authorization

Producers can also authorize events by IAM group so that only applications associated with that group receive the message. In addition to increased consumer efficiency (not bogging them down with irrelevant messages), this type of filtering can also alleviate the authorization concerns of publishers who may not want any application to see all of their event messages.

Publisher-controlled authorization

The Event Service supports Publisher Controlled Authorization (PCA) so that event delivery is authorized using an IAM group ID.

PCA is not enabled by default. Request PCA when you create an event topic. Any event topic that opts in to PCA must send the IAM group ID in data.groupId on every published event.

Note: When using Publisher Controlled Authorization, consumers must subscribe with the correct environment-specific application ID (preprd apps for preprd events, prod apps for prod events).

IAM group ID in the event payload

Include groupId in the event data schema when you onboard a PCA-enabled topic. Publishers must set data.groupId to the IAM group ID that is authorized to receive the event:

{
    "id": "21492d57-dc30-4dbd-9fe3-b8f281ac8c11",
    "source": "82db0121-54ec-4396-8821-317e6edba000",
    "specversion": "1.0",
    "type": "test",
    "time": "2023-03-29T11:15:00.00",
    "subject": "test",
    "datacontenttype": "application/json",
    "data": {
        "groupId": "4fc37620-4cc3-4deb-9f5b-6b5dac46aff0"
    }
}

The Event Service uses data.groupId to determine which subscribed applications are authorized to receive the event. Events published to a PCA-enabled topic without data.groupId cannot be authorized for delivery.