How do I invoke a cross-account SNS topic with a CloudWatch alarm?

Resolution

To invoke a cross-account Amazon SNS topic with a CloudWatch alarm, complete the following steps:

Note: The following steps use two accounts. Account A is used to create the CloudWatch alarm and account B is used to create an Amazon SNS topic.

Create an Amazon SNS topic in account B

Complete the following steps:

1. Open the Amazon SNS console.
2. In the navigation pane, choose Topics, and then choose Create Topic.
3. Choose Standard for the topic type, and then create a name for the topic.
4. Choose Create topic, and then copy the ARN of the topic.
5. In the navigation pane, choose Subscriptions, and then choose Create Subscription.
6. Add the topic's ARN in the Topic ARN section, and then choose Email as the protocol.
7. Choose Create Subscription, and then check your email to confirm the subscription.

Create a CloudWatch alarm in account A

Complete the following steps:

1. Open the CloudWatch console.
2. In the navigation pane, choose Alarms, and then choose Create Alarm.
3. Select your metric, and then provide details for the threshold and comparison parameters.
4. From Configure Actions, under Notifications, choose Use topic ARN to notify other accounts, and then enter the topic ARN from Account B.
5. Create a name for the alarm, and then choose Create Alarm.

Update the access policy of the Amazon SNS topic in account B

To update the access policy of the Amazon SNS topic in account B to allow the alarm to publish messages, complete the following steps:

1. Open the Amazon SNS console.
2. In the navigation pane, choose Topics, and then select the topic.
3. Choose Edit, and then make sure that the policy is in the following example format:

   {
     "Version": "2008-10-17",
     "Id": "__default_policy_ID",
     "Statement": [
       {
         "Sid": "__default_statement_ID",
         "Effect": "Allow",
         "Principal": {
           "AWS": ""
         },
         "Action": [
           "SNS:GetTopicAttributes",
           "SNS:SetTopicAttributes",
           "SNS:AddPermission",
           "SNS:RemovePermission",
           "SNS:DeleteTopic",
           "SNS:Subscribe",
           "SNS:ListSubscriptionsByTopic",
           "SNS:Publish"
         ],
         "Resource": "example-topic-arn-account-b"
         "Condition": {
           "ArnLike": {
             "aws:SourceArn": "arn:aws:cloudwatch:example-region:111122223333:alarm:"
         }
         }
       }
     ]
   }

Test the alarm

To test the alarm, either change the alarm threshold based on the metric data points, or manually change the alarm state. When you change the alarm threshold or manually change the alarm state, you receive an email notification.

Related information

Allow any CloudWatch alarm to publish to a topic in a different account

Why didn't I receive an SNS notification for my CloudWatch alarm trigger?

SetAlarmState