diff --git a/modules/services/event-bridge/main.tf b/modules/services/event-bridge/main.tf
index 400f4a9..f41345a 100644
--- a/modules/services/event-bridge/main.tf
+++ b/modules/services/event-bridge/main.tf
@@ -34,27 +34,8 @@ resource "aws_cloudwatch_event_rule" "sysdig" {
   tags        = var.tags
   state       = var.rule_state
 
-  event_pattern = <<EOF
-{
-  "detail-type": [
-    "AWS API Call via CloudTrail",
-    "AWS Console Sign In via CloudTrail",
-    "AWS Service Event via CloudTrail",
-    "Object Access Tier Changed",
-    "Object ACL Updated",
-    "Object Created",
-    "Object Deleted",
-    "Object Restore Completed",
-    "Object Restore Expired",
-    "Object Restore Initiated",
-    "Object Storage Class Changed",
-    "Object Tags Added",
-    "Object Tags Deleted"
-  ]
+  event_pattern = var.event_pattern
 }
-EOF
-}
-
 # Target to forward all CloudTrail events to Sysdig's EventBridge Bus.
 # See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_target#cross-account-event-bus-target
 resource "aws_cloudwatch_event_target" "sysdig" {
diff --git a/modules/services/event-bridge/organizational.tf b/modules/services/event-bridge/organizational.tf
index 9e5ec7b..3c9f324 100644
--- a/modules/services/event-bridge/organizational.tf
+++ b/modules/services/event-bridge/organizational.tf
@@ -8,9 +8,14 @@ data "aws_organizations_organization" "org" {
   count = var.is_organizational ? 1 : 0
 }
 
+data "aws_caller_identity" "current" {
+  count = var.is_organizational ? 1 : 0
+}
+
 locals {
-  organizational_unit_ids = var.is_organizational && length(var.org_units) == 0 ? [for root in data.aws_organizations_organization.org[0].roots : root.id] : toset(var.org_units)
-  region_set              = toset(var.regions)
+  organizational_unit_ids   = var.is_organizational && length(var.org_units) == 0 ? [for root in data.aws_organizations_organization.org[0].roots : root.id] : toset(var.org_units)
+  region_set                = toset(var.regions)
+  eb_rule_stackset_role_arn = var.is_organizational ? "arn:aws:iam::${data.aws_caller_identity.current[0].account_id}:role/${var.name}" : ""
 }
 
 # stackset to deploy eventbridge rule in organization unit
@@ -31,34 +36,13 @@ resource "aws_cloudformation_stack_set" "eb-rule-stackset" {
     ignore_changes = [administration_role_arn]
   }
 
-  template_body = <<TEMPLATE
-Resources:
-  EventBridgeRule:
-    Type: AWS::Events::Rule
-    Properties:
-      Name: ${var.name}
-      Description: Capture all CloudTrail events
-      EventPattern:
-        detail-type:
-          - 'AWS API Call via CloudTrail'
-          - 'AWS Console Sign In via CloudTrail'
-          - 'AWS Service Event via CloudTrail'
-          - 'Object Access Tier Changed'
-          - 'Object ACL Updated'
-          - 'Object Created'
-          - 'Object Deleted'
-          - 'Object Restore Completed'
-          - 'Object Restore Expired'
-          - 'Object Restore Initiated'
-          - 'Object Storage Class Changed'
-          - 'Object Tags Added'
-          - 'Object Tags Deleted'
-      State: ${var.rule_state}
-      Targets:
-        - Id: ${var.name}
-          Arn: ${var.target_event_bus_arn}
-          RoleArn: !Sub "arn:aws:iam::$${AWS::AccountId}:role/${var.name}"
-TEMPLATE
+  template_body = templatefile("${path.module}/stackset_template_body.tpl", {
+    name                 = var.name
+    event_pattern        = var.event_pattern
+    rule_state           = var.rule_state
+    target_event_bus_arn = var.target_event_bus_arn
+    role_arn             = local.eb_rule_stackset_role_arn
+  })
 }
 
 # stackset to deploy eventbridge rule in management account
@@ -71,34 +55,13 @@ resource "aws_cloudformation_stack_set" "mgmt-stackset" {
   capabilities            = ["CAPABILITY_NAMED_IAM"]
   administration_role_arn = var.stackset_admin_role_arn
 
-  template_body = <<TEMPLATE
-Resources:
-  EventBridgeRule:
-    Type: AWS::Events::Rule
-    Properties:
-      Name: ${var.name}
-      Description: Capture all CloudTrail events
-      EventPattern:
-        detail-type:
-          - 'AWS API Call via CloudTrail'
-          - 'AWS Console Sign In via CloudTrail'
-          - 'AWS Service Event via CloudTrail'
-          - 'Object Access Tier Changed'
-          - 'Object ACL Updated'
-          - 'Object Created'
-          - 'Object Deleted'
-          - 'Object Restore Completed'
-          - 'Object Restore Expired'
-          - 'Object Restore Initiated'
-          - 'Object Storage Class Changed'
-          - 'Object Tags Added'
-          - 'Object Tags Deleted'
-      State: ${var.rule_state}
-      Targets:
-        - Id: ${var.name}
-          Arn: ${var.target_event_bus_arn}
-          RoleArn: ${aws_iam_role.event_bus_invoke_remote_event_bus[0].arn}
-TEMPLATE
+  template_body = templatefile("${path.module}/stackset_template_body.tpl", {
+    name                 = var.name
+    event_pattern        = var.event_pattern
+    rule_state           = var.rule_state
+    target_event_bus_arn = var.target_event_bus_arn
+    role_arn             = aws_iam_role.event_bus_invoke_remote_event_bus[0].arn
+  })
 }
 
 # stackset to deploy eventbridge role in organization unit
diff --git a/modules/services/event-bridge/stackset_template_body.tpl b/modules/services/event-bridge/stackset_template_body.tpl
new file mode 100644
index 0000000..21cd710
--- /dev/null
+++ b/modules/services/event-bridge/stackset_template_body.tpl
@@ -0,0 +1,12 @@
+Resources:
+  EventBridgeRule:
+    Type: AWS::Events::Rule
+    Properties:
+      Name: ${name}
+      Description: Capture all CloudTrail events
+      EventPattern: ${event_pattern}
+      State: ${rule_state}
+      Targets:
+        - Id: ${name}
+          Arn: ${target_event_bus_arn}
+          RoleArn: ${role_arn}
diff --git a/modules/services/event-bridge/variables.tf b/modules/services/event-bridge/variables.tf
index 8d0a889..f219f98 100644
--- a/modules/services/event-bridge/variables.tf
+++ b/modules/services/event-bridge/variables.tf
@@ -68,3 +68,27 @@ variable "rule_state" {
   description = "State of the rule. When state is ENABLED, the rule is enabled for all events except those delivered by CloudTrail. To also enable the rule for events delivered by CloudTrail, set state to ENABLED_WITH_ALL_CLOUDTRAIL_MANAGEMENT_EVENTS."
   default     = "ENABLED_WITH_ALL_CLOUDTRAIL_MANAGEMENT_EVENTS"
 }
+
+variable "event_pattern" {
+  description = "Event pattern for CloudWatch Event Rule"
+  type        = string
+  default     = <<EOF
+{
+  "detail-type": [
+    "AWS API Call via CloudTrail",
+    "AWS Console Sign In via CloudTrail",
+    "AWS Service Event via CloudTrail",
+    "Object Access Tier Changed",
+    "Object ACL Updated",
+    "Object Created",
+    "Object Deleted",
+    "Object Restore Completed",
+    "Object Restore Expired",
+    "Object Restore Initiated",
+    "Object Storage Class Changed",
+    "Object Tags Added",
+    "Object Tags Deleted"
+  ]
+}
+EOF
+}