AWS sns documentation change
Summary
Expanded cross-account CloudWatch alarm integration documentation with detailed setup steps, policy example updates, and testing instructions
Security assessment
The changes improve documentation about secure cross-account access configuration but do not address a specific disclosed vulnerability. The policy updates demonstrate proper security practices for SNS topic access control.
Diff
diff --git a/sns/latest/dg/sns-access-policy-use-cases.md b/sns/latest/dg/sns-access-policy-use-cases.md index ae8201c06..e6bd139ec 100644 --- a//sns/latest/dg/sns-access-policy-use-cases.md +++ b//sns/latest/dg/sns-access-policy-use-cases.md @@ -316 +316,57 @@ In this example, any AWS account in organization `myOrgId` can publish to Amazon -In this case, the following policy allows any CloudWatch alarms in account `111122223333` to publish to an Amazon SNS topic in account `444455556666`, but CloudWatch Alarms will not use this policy due to the cross-account restriction. +Use the following steps to invoke an Amazon SNS topic with a CloudWatch alarm across different AWS accounts. This example uses two accounts: + + * **Account A** is used to create the CloudWatch alarm. + + * **Account B** is used to create an SNS topic. + + + + +**Create an SNS topic in account B** + + 1. Sign in to the [Amazon SNS console](https://console.aws.amazon.com/sns/home). + + 2. In the navigation pane, choose **Topics** , and then choose **Create topic**. + + 3. Choose **Standard** for the topic type, and then create a name for the topic. + + 4. Choose **Create topic** , and then copy the **ARN** of the topic. + + 5. In the navigation pane, choose **Subscriptions** , and then choose **Create subscription**. + + 6. Add the topic's ARN in the **Topic ARN** section, choose **Email** as the protocol, and then **enter an email address**. + + 7. Choose **Create subscription** , and then check your email to **confirm the subscription**. + + + + +**Create a CloudWatch alarm in account A** + + 1. Open the CloudWatch console at [https://console.aws.amazon.com/cloudwatch/](https://console.aws.amazon.com/cloudwatch/). + + 2. In the navigation pane, choose **Alarms** , and then choose **Create alarms**. + + 3. If you haven't already created an alarm, create one now. Otherwise, select your **metric** , and then provide details for the threshold and comparison parameters. + + 4. From **Configure Actions** , under **Notifications** , choose **Use topic ARN to notify other accounts** , and then enter the **topic ARN** from Account B. + + 5. Create a name for the alarm, and then choose **Create alarm**. + + + + +**Update the access policy of the SNS topic in account B** + + 1. Sign in to the [Amazon SNS console](https://console.aws.amazon.com/sns/home). + + 2. In the navigation pane, choose **Topics** , and then select the topic. + + 3. Choose **Edit** , and then add the following to the policy: + + + + +###### Note + +Replace the example values in the policy below with your own. @@ -319,0 +376,2 @@ In this case, the following policy allows any CloudWatch alarms in account `1111 + "Version": "2008-10-17", + "Id": "__default_policy_ID", @@ -321,0 +380 @@ In this case, the following policy allows any CloudWatch alarms in account `1111 + "Sid": "__default_statement_ID", @@ -326,2 +385,11 @@ In this case, the following policy allows any CloudWatch alarms in account `1111 - "Action": "sns:Publish", - "Resource": "arn:aws:sns:us-east-2:444455556666:MyTopic", + "Action": [ + "SNS:GetTopicAttributes", + "SNS:SetTopicAttributes", + "SNS:AddPermission", + "SNS:RemovePermission", + "SNS:DeleteTopic", + "SNS:Subscribe", + "SNS:ListSubscriptionsByTopic", + "SNS:Publish" + ], + "Resource": "example-topic-arn-account-b", @@ -330 +398 @@ In this case, the following policy allows any CloudWatch alarms in account `1111 - "aws:SourceArn": "arn:aws:cloudwatch:us-east-2:111122223333:alarm:*" + "aws:SourceArn": "arn:aws:cloudwatch:example-region:111122223333:alarm:" @@ -336,0 +405,4 @@ In this case, the following policy allows any CloudWatch alarms in account `1111 +**Test the alarm** + +To test the alarm, either change the alarm threshold based on the metric data points, or manually change the alarm state. When you change the alarm threshold or alarm state, you receive an email notification. + @@ -341 +413 @@ Use the following steps to enable cross-account Amazon SNS notifications for Clo - 1. Create an Amazon SNS topic in the same account as the CloudWatch Alarm (111122223333). + 1. Create an [Amazon SNS topic](./sns-create-topic.html) in the same account as the **CloudWatch alarm** (111122223333). @@ -343 +415 @@ Use the following steps to enable cross-account Amazon SNS notifications for Clo - 2. Subscribe a Lambda function or an Amazon EventBridge rule to that Amazon SNS topic. + 2. Subscribe a [Lambda function](./lambda-console.html) or an [Amazon EventBridge rule](https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-s3-object-created-tutorial.html) to that Amazon SNS topic.