Why do I get an authorization error when I try to subscribe my Lambda function to my Amazon SNS topic?

Short description

When you subscribe a Lambda function to an SNS topic, you might receive an authorization error for the following reasons:

You tried to create the subscription from a different AWS account than the one that your Lambda function is in.

-or-

The AWS Identity and Access Management (IAM) identity that you used to create the subscription doesn't have permissions to run the following API operations:

• (Lambda) AddPermission
• (Amazon SNS) Subscribe

To resolve the issue, you must do one of the following, depending on what's causing the error:

Verify that you subscribe your Lambda function to the SNS topic from the AWS account where your function is located.

-or-

Verify that the IAM identity that you're using has permissions to run both the Lambda AddPermission and SNS Subscribe API operations.

Resolution

Verify what's causing the error based on the error message that Lambda returns

If you create the subscription from a different AWS account than the one that your function is in, then Lambda returns one of the following errors:

AWS Command Line Interface (AWS CLI) error example: You tried to create the subscription from a different account than the one that your Lambda function is in

"An error occurred (AuthorizationError) when calling the Subscribe operation: The account YOUR_AWS_ACCOUNT_ID_1 is not the owner of the endpoint arn:aws:lambda:us-east-1:YOUR_AWS_ACCOUNT_ID_2:function: your_Lambda_function_ARN"

AWS Management Console error example: You tried to create the subscription from a different account than the one that your Lambda function is in

"Error code: AccessDeniedException - Error message: User: arn:aws:sts::XXXXXXX:XXXXXXX/XXXXX/XXXXXX is not authorized to perform: lambda:AddPermission on resource: arn:aws:lambda:us-west-2:XXXXXXX:function:XXXXXXX"

If you're using the correct account, but your IAM identity lacks the required permissions, then Lambda or SNS returns one of the following errors:

AWS CLI error example: The IAM identity that you used to create the subscription doesn't have permissions to run the Lambda AddPermission action

"An error occurred (AccessDeniedException) when calling the AddPermission operation: User: arn:aws:iam::XXXXXXX:user/XXXXXXXX is not authorized to perform: lambda:AddPermission on resource: arn:aws:lambda:us-west-2:XXXXXX:function:XXXXXXX because no identity-based policy allows the lambda:AddPermission action"

AWS Management Console error example: The IAM identity that you used to create the subscription doesn't have permissions to run the Lambda AddPermission action

"Error code: AccessDeniedException - Error message: User: arn:aws:sts:XXXXXXXX:assumed-role/XXXXXXXX/XXXXX-XXXXXX is not authorized to perform: lambda:AddPermission on resource: arn:aws:lambda:us-west-2:XXXXXXXXX:function:XXXXXXX because no identity-based policy allows the lambda:AddPermission action"

AWS CLI error example for when you try to use an IAM identity that doesn't have permission to run the SNS Subscribe action

"An error occurred (AuthorizationError) when calling the Subscribe operation: User: arn:aws:iam::XXXXXXX:user/XXXXXXXX is not authorized to perform: SNS:Subscribe on resource: arn:aws:sns:us-west-2:XXXXXXXX:XXXXXXX because no resource-based policy allows the SNS:Subscribe action"

Subscribe your Lambda function to the SNS topic from the AWS account where your function is located

You can use the Lambda console or AWS CLI to subscribe your Lambda function to an SNS topic.

To subscribe a function to an SNS topic using the Lambda console

Note: When you add the SNS trigger using the Lambda console, the console automatically allows the lambda:InvokeFunction permission from the principal service:sns.amazonaws.com.

1. On the Functions page of the Lambda console, choose your function.
2. Under Overview, choose Add trigger.
3. For Trigger configuration, choose Select a trigger, and then choose SNS.
4. For SNS topic, paste the SNS topic Amazon Resource Name (ARN) from the other AWS account.
5. Select the Enable trigger check box.
6. Choose Add.

For more information, see Configuring Lambda function options.

Note: If you receive the following error, then you must grant Subscribe API action permissions to the IAM identity that you're using. For troubleshooting instructions, see How do I resolve authorization errors when trying to add subscribers to an Amazon SNS topic?

"An error occurred (AuthorizationError) when calling the Subscribe operation: User: your_IAM_user_or_role is not authorized to perform: SNS:Subscribe on resource: your_SNS_topic_ARN"

To subscribe a function to an SNS topic using the AWS CLI

Note: If you receive errors when you run AWS CLI commands, then see Troubleshooting errors for the AWS CLI. Also, make sure that you're using the most recent AWS CLI version.

1. Configure your AWS CLI with an IAM user that belongs to the AWS account where your Lambda function is located:

   aws configure --profile-name YOUR_PROFILE_NAME

   Note: Replace YOUR_PROFILE_NAME with your AWS CLI profile name.

   Important: Verify that you pass the AWS Access Key Id and Secret Key of your IAM user.

2. Allow Lambda invocations from the SNS topic by adding the lambda:InvokeFunction permission from the principal service:sns.amazonaws.com:

   aws lambda add-permission --function-name YOUR_LAMBDA_FUNCTION_NAME --statement-id sns_invoke_permission --action lambda:InvokeFunction --principal sns.amazonaws.com --source-arn YOUR_SNS_TOPIC_ARN

   Note: Replace YOUR_LAMBDA_FUNCTION_NAME with your Lambda function name. Replace YOUR_SNS_TOPIC_ARN with your SNS topic ARN.

3. Subscribe your Lambda function to your SNS topic:

   aws sns subscribe --topic-arn YOUR_SNS_TOPIC_ARN --protocol lambda --notification-endpoint YOUR_LAMBDA_FUNCTION_ARN --profile YOUR_PROFILE_NAME

   Note: Replace YOUR_SNS_TOPIC_ARN with your SNS topic ARN. Replace YOUR_LAMBDA_FUNCTION_ARN with your Lambda function ARN. Replace YOUR_PROFILE_NAME with the profile name you configured in step 1.

   If you receive the following error, you must grant Subscribe API action permissions to the IAM identity that you're using. For troubleshooting instructions, see How do I resolve authorization errors when trying to add subscribers to an Amazon SNS topic?

   "An error occurred (AuthorizationError) when calling the Subscribe operation: User: your_IAM_user_or_role is not authorized to perform: SNS:Subscribe on resource: your_SNS_topic_ARN"

Verify that the IAM identity has permissions to run the Lambda AddPermission and SNS Subscribe API operations

Review your IAM identity's identity-based policy. Confirm that the policy explicitly allows the IAM identity to run both of the following actions:

• lambda:AddPermission
• SNS:Subscribe

If the identity-based policy doesn't grant the required permissions, add the required permissions to the policy. Then, subscribe your Lambda function to the SNS topic from the AWS account that the function is in.