How to setup permissions for S3 event to SNS topic? - amazon-s3

Question

I am trying to create an event on an S3 bucket (named testBucket) so that every time a new object is created, a message is sent to SNS.
I've done some research and added:
"ArnLike": {"aws:SourceArn": "arn:aws:s3:*:*:testBucket"}
to the target topic's policy.
But, when I try to create the event, it still shows: Permissions on the destination topic do not allow S3 to publish notifications from this bucket.
Any ideas?

Answer 1

Problem solved. Before I was adding the condition line inside the default statement:
"ArnLike": {
"aws:SourceArn": "arn:aws:s3:*:*:testBucket"
}
Turns out I have to create a new statement with publish action in it.
{
"Sid": "publish-from-s3",
"Effect": "Allow",
"Principal": {
"Service": "s3.amazonaws.com"
},
"Action": "SNS:Publish",
"Resource": "arn:aws:sns:ap-southeast-2:XXXXXXXXXXXXXX:testTopicforS3",
"Condition": {
"ArnLike": {
"aws:SourceArn": "arn:aws:s3:*:*:testBucket"
}
}
}

Answer 2

Yeah, after create SNS, modify it to add a statement (after the default one):
{
"Statement": [
{
"Sid": "__default_statement_ID",
"Effect": "Allow",
"Principal": {
"AWS": "*"
},
"Action": [
"SNS:Publish",
"SNS:RemovePermission",
"SNS:SetTopicAttributes",
"SNS:DeleteTopic",
"SNS:ListSubscriptionsByTopic",
"SNS:GetTopicAttributes",
"SNS:Receive",
"SNS:AddPermission",
"SNS:Subscribe"
],
"Resource": "your sns arn"
},
{
"Sid": "s3",
"Effect": "Allow",
"Principal": {
"Service": "s3.amazonaws.com"
},
"Action": "SNS:Publish",
"Resource": "your sns arn"
}
]
}

Answer 3

Instead of adding a new statement, put "Service": "s3.awsamazon.com" inside Principal.
So it would look like:
Statement: [
{
"Sid": "publish-from-s3",
"Effect": "Allow",
"Principal": {
"Service": "s3.amazonaws.com", # ADD THIS!
"AWS": <AWS_Account_Name_for_Access>
},
"Action": "SNS:Publish",
"Resource": "arn:aws:sns:ap-southeast-2:XXXXXXXXXXXXXX:testTopicforS3",
"Condition": {
"ArnLike": {
"aws:SourceArn": "arn:aws:s3:*:*:*"
}
}
}
]

Answer 4

I believe you need to allow the S3 bucket owner to publish to your topic. I usually first test the functionality by allowing everyone to publish to the topic then add more selective policy details later.
If you select your SNS topic in the AWS console, then choose Other topic actions, and select Edit Topic policy, then you'll see the Basic View tab. Under the section "Allow these users to publish messages to this topic", select Everyone and save. Next add the event to S3 and verify the basic event publishing works. Then you can lock down detailed policy changes later using the Advanced View.

Answer 5

"Principal":
{
"Service": "s3.amazonaws.com"
}
&
"ArnLike":
{
"aws:SourceArn": "arn:aws:s3:*:*:Bucket_name"
}
is important.

Answer 6

If you want to have any bucket in an account be able to publish or subscribe to the topic (yes this is a more generalized solution and therefore less secure but if you're running into circular dependency issues with trying to allow a bucket to be able to publish to the topic and add a subscription from the bucket to the topic, this will help):
{
"Id": "your-topic-policy-id",
"Version": "2012-10-17",
"Statement": [
{
"Sid": "statement-id",
"Effect": "Allow",
"Principal": {
"Service": "s3.amazonaws.com"
},
"Action": ["sns:Publish", "sns:Subscribe"],
"Resource": "your-sns-topic-arn",
"Condition": {
"StringEquals": {
"AWS:SourceAccount": "account-id"
}
}
}
]
}