An automation account runs a CI/CD pipeline that creates new AWS accounts within an AWS Organization. A set of internal service teams operate from separate service accounts and want to receive CloudTrail events in their service accounts whenever the automation account calls the CreateAccount API to create a new account. What is the correct way to share those account-creation events with the service accounts?

The correct approach leverages EventBridge's cross-account event delivery. The automation account, where the CreateAccount API calls originate and CloudTrail logs them, needs an EventBridge rule to capture these specific events. This rule then targets the default event bus in each service account. For this cross-account delivery to succeed, each service account's default event bus policy must be explicitly updated to grant permission to the automation account to put events onto it. This ensures secure and targeted event sharing. Incorrect options: Creating custom event buses in service accounts and attempting to listen directly to CloudTrail events from another account is not how cross-account EventBridge works. EventBridge rules are configured in the source account to send events. Creating matching custom event buses in both accounts and connecting them is overly complex and unnecessary. The default event bus in the target account is sufficient. Creating a custom event bus in the automation account is not required; the default event bus can be used as the source for the rule.