aws / aws/aws-cdk

S3 Event Notification: SNS destination access policy not setting "aws:SourceAccount"

Open
#27,994 3 comments 0 reactions 0 assignees View on GitHub
@aws-cdk/aws-s3 bug effort/small p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

Ref: https://github.com/aws/aws-cdk/blob/v2.105.0/packages/aws-cdk-lib/aws-s3-notifications/lib/sns.ts

As per the documentation - https://docs.aws.amazon.com/AmazonS3/latest/userguide/ways-to-add-notification-config-to-bucket.html#step1-create-sns-topic-for-notification

The expected Access policy should include in "Condition", but missing.

```
"StringEquals": {
"aws:SourceAccount": "bucket-owner-account-id"
}
```

I believe this is causing S3 object create event to not trigger SNS notification

### Expected Behavior

SNS notification triggered on S3 object creation

### Current Behavior

SNS notification not triggered

### Reproduction Steps

```
const bucket = new Bucket(this, `some-bucket-name`, {
bucketName: 'some-bucket',
encryption: BucketEncryption.S3_MANAGED,
blockPublicAccess: BlockPublicAccess.BLOCK_ALL,
enforceSSL: true,
autoDeleteObjects: true,
removalPolicy: RemovalPolicy.DESTROY,
});\

//Setup SNS
const topicName = `some-topic-name`
const topic = new Topic(this, 'some-id', {
displayName: `some name`,
topicName: topicName
});

//Setup S3 event notification publish to SNS
bucket.addEventNotification(EventType.OBJECT_CREATED, new SnsDestination(topic), {prefix: 'folder/subfolder/'});
```

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### CDK CLI Version

v2.105.0

### Framework Version

_No response_

### Node.js Version

v2.105.0

### OS

MacOS

### Language

TypeScript

### Language Version

_No response_

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with packages/aws-cdk-lib/aws-s3-notifications/lib/sns.ts and compare the generated SNS access policy with the AWS S3 notification documentation linked in the issue. Reproduce the TypeScript example and inspect the synthesized policy and notification behavior. Done means the policy includes the expected aws:SourceAccount condition and S3 object-create notifications reach SNS.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.