Why doesn't Amazon SNS invoke my Lambda function?

Short description

An Amazon SNS message event doesn't invoke a Lambda function that's subscribed to an SNS topic for the following reasons:

• The AWS Identity and Access Management (IAM) identity that publishes to the SNS topic doesn't have the permissions required to publish to the SNS topic.
• The Lambda function doesn't have the permissions required to allow Amazon SNS to invoke the function.
• The Lambda function's SNS topic subscription has a filter policy that doesn't match the message attributes being sent from the SNS topic.
• The Lambda function is throttled because it exceeds the account-level concurrency quota or function-level reserved concurrency quota in the AWS Region where it's hosted.
• Your SNS topic is in a default-activated Region and the Lambda function is in an opt-in Region, or the reverse. Or, your SNS topic and your Lambda function are in different AWS accounts.
  Note: For the current list of Regions that Amazon SNS supports, see Amazon SNS endpoints and quotas.

Important: Amazon SNS supports Amazon CloudWatch log delivery to the endpoints for AWS Lambda. Configure CloudWatch delivery status logging for your SNS topic. For more information, see Monitoring Amazon SNS topics using CloudWatch.

Resolution

Confirm that your IAM identity has the required permissions

Review the NumberOfMessagesPublished metric in your CloudWatch metrics for Amazon SNS.

The NumberOfMessagesPublished metric might not record the Publish requests made by the IAM entity that you use to invoke the function. If the metric doesn't record these requests, then confirm that the IAM entity has the required permissions to publish to the SNS topic. For more information and specific policy statement examples, see Example cases for Amazon SNS access control.

Then, confirm that your SNS topic permissions policy that allows the IAM entity to make the Publish API call has the SNS:Publish permission. For more information and examples of the permissions policies, see Permissions for the Amazon SNS topic.

Confirm that your Lambda function has the required permissions

View your function's permissions policy. If your function's policy doesn't include the lambda:InvokeFunction permission for your SNS topic, then update the policy to include the required permissions.

Example Lambda function with the required permissions:

{
  "Sid": "sns",
  "Effect": "Allow",
  "Principal": {
    "Service": "sns.amazonaws.com"
  },
  "Action": "lambda:InvokeFunction",
  "Resource": "arn:aws:lambda:aa-example-1:111122223333:function:my-function"
}

Note: Replace aa-example-1 with your Region, 111122223333 with your AWS account ID, and my-function with the name of your Lambda function.

Confirm that your subscription policy matches the message attributes

Review the NumberOfNotificationsFilteredOut metric in your CloudWatch metrics for Amazon SNS. The NumberOfNotificationsFilteredOut metric might show the Publish requests from your IAM entity.

If requests appear in the NumberOfNotificationsFilteredOut metric, then complete the following steps:

1. Open the Amazon SNS console.
2. In the navigation pane, choose Subscriptions.
3. Choose your subscription, and then choose Edit.
4. Choose Subscription filter policy to expand the section.
5. Review the subscription filter policy to confirm that the Publish request message attributes match the attributes required by the filter policy.
6. If the attributes don't match, then update your Publish request message attributes to match the attributes required by the filter policy.
   Note: For more information, see Amazon SNS subscription filter policies.

Troubleshoot your throttled Lambda function

To troubleshoot your throttled Lambda function, see How do I troubleshoot Lambda function "Rate exceeded" and "TooManyRequestsException" throttling errors?

Check whether your setup involves an opt-in Region or multiple accounts

Amazon SNS supports cross-Region delivery for default-activated Regions and for opt-in Regions. For the current list of default-activated Regions and opt-in Regions that Amazon SNS supports, see Amazon SNS endpoints and quotas.

Amazon SNS supports cross-Region notification delivery to AWS Lambda functions. If one of the Regions is an opt-in Region, then specify a different Amazon SNS service principal in the subscribed function's resource policy. For more information, see Sending Amazon SNS messages to an Amazon SQS queue or AWS Lambda function in a different Region. For more information about the Lambda function policy, see Opt-in Regions.

If your SNS topic and Lambda function are in different accounts, see How do I subscribe a Lambda function to an Amazon SNS topic in a cross-account?