Why didn't my Amazon SNS topic receive EventBridge notifications?

Resolution

Verify that the targets of the EventBridge rule are in the same Region as the rule

The targets that you associate with a rule must be in the same AWS Region as the rule.

Note: To find the Region that an AWS resource is in, check the resource's Amazon Resource Name (ARN).

Review your EventBridge rule's Invocations and FailedInvocations metrics to identify the issue

Use the Amazon CloudWatch console to review your EventBridge rule's Invocations and FailedInvocations metrics.

If there are data points for only the Invocations metric, then the EventBridge rule notification didn't reach the target. To resolve this issue, reconfigure the rule for the target.

If there are data points for both metrics, then the EventBridge rule notification tried to invoke the target but the invocation failed. To resolve this issue, make sure that EventBridge has the required permissions to publish messages to your topic.

Confirm that you granted EventBridge the required permissions to publish messages to your topic

Your SNS topic's resource-based policy must allow EventBridge to publish messages to the topic. Check your topic's AWS Identity and Access Management (IAM) policy to confirm that it has the required permissions.

Example policy:

{    
    "Sid": "AWSEvents_ArticleEvent_Id4950650036948",
    "Effect": "Allow",
    "Principal": {
        "Service": "events.amazonaws.com"
    },
    "Action": "sns:Publish",
    "Resource": "SNS_TOPIC_ARN"
}

Important: You must enter events.amazonaws.com as the Service value and sns:Publish as the Action value. Replace SNS_TOPIC_ARN with the ARN of your topic.

If you use an execution role, then make sure that the IAM role that's attached to the EventBridge rule is correct. To check the IAM role, open the EventBridge console, and then choose Rules. Select your rule, and then choose Targets to view the attached IAM role.

Verify that the execution role allows EventBridge to publish to the target

The execution role requires a trust relationship with EventBridge. Make sure that your role's trust policy includes events.amazonaws.com as a trusted entity to allow EventBridge to assume the target's execution role. Also, make sure that the role has permission to invoke the SNS topic with the sts:AssumeRole action.

Example IAM trust policy:

{    
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "events.amazonaws.com"
            },
            "Action": "sts:AssumeRole",
            "Condition": {
                "StringEquals": {
                    "aws:SourceAccount": "ACCOUNT-ID",
                    "aws:SourceArn": "EVENTBRIDGE-RULE-ARN"
                }
            }
        }
    ]
}

Note: Replace ACCOUNT-ID with your AWS account ID and EVENTBRIDGE_RULE_ARN with your rule's ARN.

Example IAM permissions:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "sns:Publish"
            ],
            "Resource": [
                "SNS_TOPIC_ARN"
            ]
        }
    ]
}

Note: Replace SNS_TOPIC_ARN with your SNS topic ARN.

Confirm that your topic has the required AWS KMS permissions

If you use server-side encryption (SSE), then your topic must use an AWS Key Management Service (AWS KMS) customer managed key. This AWS KMS key must have a custom key policy that allows EventBridge to use the key.

To set up the required AWS KMS permissions, complete the following steps:

1. Create a new customer managed key.
2. Use the customer managed key to configure SSE for your SNS topic.
3. Configure an AWS KMS policy that allows EventBridge to publish messages to your encrypted topic.
   Example policy:

   {    
       "Sid": "Allow EventBridge to use the key",
       "Effect": "Allow",
       "Principal": {
           "Service": "events.amazonaws.com"
       },
       "Action": [
           "kms:Decrypt",
           "kms:GenerateDataKey"
       ],
       "Resource": "*"
   }