Konductor for Amazon EventBridge

A serverless control plane for cross-account event-driven architecture at scale. Platform teams get governed domains — registration, approval, provisioning, ownership, and observability. Application teams get three simple verbs — publish, subscribe, unsubscribe — for event stream automation and never touch event buses other than their own, IAM policies, or cross-account delivery infrastructure.

Documentation home | Installation | Architecture | API contracts (OAuth: openapi-oauth.yaml, IAM: openapi-iam.yaml)

Why Konductor

Consuming an event from another AWS account means coordinating event buses, rules, resource policies, IAM roles, and DLQs across two accounts — 12+ resources and days of infrastructure wrangling per integration, reinvented by every team with subtle drift. Konductor abstracts that away so teams focus on their events, not their plumbing.

Minutes, not days. Subscribe to an event and start processing it in minutes. Cross-account delivery is invisible.

Governed domains. Every domain gets event buses, schema registries, DLQs, and CloudWatch monitoring, provisioned automatically across all environments with all-or-nothing saga rollback. Human approval gates registration.

Simple verbs, real durability. Publishing is one POST /publish call. The event is durably queued before anything downstream can lose it, and retries preserve its idempotency key and original publish timestamp.

Schema-first contracts. Consumers subscribe to a schema contract, not a bus. Publishers author schemas through the API in the first environment — append-only, with every new version checked for compatibility — and promote them to later environments. Konductor validates every publish against the latest version, pins subscriptions to it, and materializes the delivery rules.

Built-in ownership and observability. Every domain has a primary owner and required secondary owners. Approval workflows, lifecycle events, CloudWatch dashboards, and per-subscription alarms come standard.

How It Works

┌── CONTROL PLANE ─────────────────────────────────────────────────────────────────────┐
│  OAuth + IAM APIs and web console · grant engine (bindings + entitlements) ·         │
│  audit on every mutation · platform metadata revisions · revocation worker +         │
│  hourly sweep · operator alarms                                                      │
└─────────────────────────────┬─────────────────────────────────────────┬──────────────┘
                              │ authorizes every command                │ disables streams
                              ▼                                         ▼ that lose coverage
┌── DOMAIN MANAGEMENT ────────┴──────────┐   ┌── EVENT STREAMS ─────────┴──────────────┐
│  register → approve → provision every  │   │  schemas: authored in the first env,    │
│  environment atomically, each in its   │   │  appends compatibility-gated, then      │
│  pinned account: buses, registries,    │──▶│  promoted env → env with the same       │
│  DLQs, and monitoring in the platform  │   │  version numbers                        │
│  and domain accounts                   │   │                                         │
│                                        │   │  publish: one call, authorized and      │
│  approval in the console or API; email │   │  validated against the latest schema    │
│  only notifies the approvers           │   │  before the 202, then durably queued    │
│                                        │   │                                         │
│  lifecycle events and owner            │   │  subscribe: catalog shows only what     │
│  notifications on every transition     │   │  entitlements cover; per-env rules      │
│                                        │   │  deliver cross-account; re-pinned on    │
│  teardown reuses the deprovision       │   │  promotion; pause/resume per env        │
│  workflow (make teardown-domain)       │   │                                         │
└────────────────────────────────────────┘   └──────────────────────────┬──────────────┘
                                                                        │ upgrade notices
                                                                        ▼
                                             ┌── SYSTEM EVENTS ─────────┴──────────────┐
                                             │  subscription upgrades publish to the   │
                                             │  system-event bus and route to each     │
                                             │  domain's own SNS topic (SQS, Lambda,   │
                                             │  or email); opt-in per installation     │
                                             └─────────────────────────────────────────┘

Konductor runs in a dedicated platform account. Domain resources are provisioned into domain accounts through the cross-account trust role, and a registration can pin each environment to its own account. All control-plane state lives in the platform account; domain accounts contain only the resources their domains need.

This is the beginning of the README. Read the rest at the original. Read the full README ↗