S3 Event Notification: SNS destination access policy not setting "aws:SourceAccount"
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### Describe the bug
Ref: https://github.com/aws/aws-cdk/blob/v2.105.0/packages/aws-cdk-lib/aws-s3-notifications/lib/sns.ts
As per the documentation - https://docs.aws.amazon.com/AmazonS3/latest/userguide/ways-to-add-notification-config-to-bucket.html#step1-create-sns-topic-for-notification
The expected Access policy should include in "Condition", but missing.
```
"StringEquals": {
"aws:SourceAccount": "bucket-owner-account-id"
}
```
I believe this is causing S3 object create event to not trigger SNS notification
### Expected Behavior
SNS notification triggered on S3 object creation
### Current Behavior
SNS notification not triggered
### Reproduction Steps
```
const bucket = new Bucket(this, `some-bucket-name`, {
bucketName: 'some-bucket',
encryption: BucketEncryption.S3_MANAGED,
blockPublicAccess: BlockPublicAccess.BLOCK_ALL,
enforceSSL: true,
autoDeleteObjects: true,
removalPolicy: RemovalPolicy.DESTROY,
});\
//Setup SNS
const topicName = `some-topic-name`
const topic = new Topic(this, 'some-id', {
displayName: `some name`,
topicName: topicName
});
//Setup S3 event notification publish to SNS
bucket.addEventNotification(EventType.OBJECT_CREATED, new SnsDestination(topic), {prefix: 'folder/subfolder/'});
```
### Possible Solution
_No response_
### Additional Information/Context
_No response_
### CDK CLI Version
v2.105.0
### Framework Version
_No response_
### Node.js Version
v2.105.0
### OS
MacOS
### Language
TypeScript
### Language Version
_No response_
### Other information
_No response_
Contributor guide
Research direction
Start with packages/aws-cdk-lib/aws-s3-notifications/lib/sns.ts and compare the generated SNS access policy with the AWS S3 notification documentation linked in the issue. Reproduce the TypeScript example and inspect the synthesized policy and notification behavior. Done means the policy includes the expected aws:SourceAccount condition and S3 object-create notifications reach SNS.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- cloud, infrastructure
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100