aws / aws/aws-cdk

aws-sns: addSubscription() doesn't add necessary policies for messages to be sent

Open
#29,098 2 comments 1 reaction 0 assignees View on GitHub
@aws-cdk/aws-sns bug effort/medium p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

To subscribe an SNS to an SQS, you can write something like

```
myTopic.addSubscription(new SqsSubscription(mySqs));
```
and expect the messages to reach SQS. But this is not happening. On further debugging, I found that the `sqs:SendMessage` permission is not granted to the SNS.

### Expected Behavior

SNS should be granted the required permissions to send messages to SQS.

### Current Behavior

Necessary permissions are not added to SNS or SQS

### Reproduction Steps

```
mySqs = Queue.fromQueueArn(this, 'MyQ');
myTopic = new Topic(this, 'MyTopic');
myTopic.addSubscription(new SqsSubscription(mySqs));
```

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### CDK CLI Version

2.123.0

### Framework Version

_No response_

### Node.js Version

v16.20.2

### OS

Linux/UNIX

### Language

TypeScript

### Language Version

_No response_

### Other information

Similar to #12120

Contributor guide

Open the contributing guide

Research direction

Start at the SqsSubscription entry point and reproduce the setup using an imported Queue ARN and a new Topic, as shown in the issue. Trace how the SNS-to-SQS subscription handles permissions, then verify that the required sqs:SendMessage permission is present and messages reach SQS.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.