How do I resolve IAM authorization errors when I add subscribers to an Amazon SNS topic?

Short description

When an IAM entity tries to add a subscription to an Amazon SNS topic without Subscribe API action permissions, SNS returns the following error:

"An error occurred (AuthorizationError) when calling the Subscribe operation: User: your_IAM_user_or_role is not authorized to perform: sns:Subscribe on resource: YOUR_SNS_TOPIC_ARN"

Note: Check your specific error message to determine if the error is from an identity-based policy or a resource-based policy.

To resolve this error, grant the IAM entity permission to run the Subscribe API action on the Amazon SNS topic.

Resolution

To grant the IAM entity permission to run the Subscribe API action on the Amazon SNS topic, complete the following steps:

Cross-account access

If the IAM entity is in an AWS cross-account for your SNS topic, then complete the following steps:

1. Attach the following identity-based policy to the IAM entity that allows the entity to run the sns:Subscribe API action:

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Sid": "SNSSubscribePermission",
               "Effect": "Allow",
               "Action": "sns:Subscribe",
               "Resource": "YOUR_SNS_TOPIC_ARN"
           }
       ]
   }

   Note: Replace YOUR_SNS_TOPIC_ARN with your Amazon SNS topic's Amazon Resource Name (ARN).

2. Attach the following resource-based policy to your topic's access policy that allows the IAM entity to run the sns:Subscribe API action:

   {
       "Sid": "AllowIAMEntity",
       "Effect": "Allow",
       "Principal": {
           "AWS": "YOUR_IAM_ENTITY_ARN "
       },
       "Action": "sns:Subscribe",
       "Resource": "YOUR_SNS_TOPIC_ARN"
   }

   Note: Replace YOUR_IAM_ENTITY_ARN with your IAM entity's ARN. Replace YOUR_SNS_TOPIC_ARN with your Amazon SNS topic's ARN.

Same account access

If the IAM entity is in the same AWS account as your SNS topic, then attach a policy to allow permission to the sns:Subscribe action. Attach either an identity-based policy or a resource-based policy from the preceding steps.

Related information

Using identity-based policies with Amazon SNS