How do I resolve the "publish operation" error in Amazon SNS?

Resolution

Complete the troubleshooting steps for the type of Amazon SNS "publish operation" error that you received.

"An error occurred (AuthorizationError) when calling the Publish operation"

This occurred because of incorrect AWS Identity and Access Management (IAM) role permissions for your Amazon Elastic Compute Cloud (Amazon EC2) instance and SNS policy.

To resolve this error, see How do I use an IAM role to publish an Amazon SNS topic from a cross-account Amazon EC2 instance?

"An error occurred (KMSAccessDenied) when calling the Publish operation"

This error occurs when you try to publish an SNS topic from an AWS cross-account Amazon EC2 instance that uses server-side encryption. This error occurred because of incorrect IAM and AWS Key Management Service (AWS KMS) permissions. The permissions for the IAM role of your EC2 instance and the AWS KMS key policy of your KMS key are incorrect.

To resolve the error, activate your AWS KMS key and update your AWS KMS key policy and IAM policy to the correct permissions.

Note: It's a best practice to grant least privilege permissions with IAM policies.

Complete the following steps:

1. Make sure that your AWS KMS key is activated.

2. Confirm that your EC2 instance IAM role is allowed to perform kms:GenerateDataKey* and kms:Decrypt in the AWS KMS key policy. This is the key policy of the KMS key that's used for server-side encryption on your SNS topic similar to the following:

   {  "Effect": "Allow",
     "Principal": {
       "AWS": "arn:aws:iam::111122223333:role/cross-acc-ec2-sns-publish-role"
     },
     "Action": [
       "kms:GenerateDataKey*",
       "kms:Decrypt"
     ],
     "Resource": "*"
   }
   

3. Attach the following IAM role policy to your EC2 instance with kms:GenerateDataKey* and kms:Decrypt permissions:

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Sid": "VisualEditor0",
               "Effect": "Allow",
               "Action": [
                   "kms:Decrypt",
                   "kms:GenerateDataKey*"
               ],
               "Resource": "your_KMS_Key_ARN"
           }
       ]
   }

   Note: Replace your_KMS_Key_ARN with your KMS Key Amazon Resource Name (ARN).