How do I fix the "Unable to validate the following destination configurations" error in CloudFormation?

Resolution

To resolve the "Unable to validate" error message, take the troubleshooting actions for your configuration.

Note: If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, then see Troubleshooting errors for the AWS CLI. Also, make sure that you're using the most recent AWS CLI version.

Issues with Lambda notification configuration

Lambda function ARN doesn't exist or isn't valid

If your Amazon Simple Storage Service (Amazon S3) bucket uses the AWS Lambda property LambdaConfigurations, then you might receive the "lambda function does not exist" error message. This error occurs if the Amazon Resource Name (ARN) configured for the Lambda function in the CloudFormation template doesn't exist or isn't valid.
To check whether the Lambda function exists, run the following get-function AWS CLI command:

aws lambda get-function --function-name 111122223333

Note: Replace 111122223333 with your function's ARN.
If you receive an error in the command output, then the function's ARN isn't valid or doesn't exist. Update the template to include the correct ARN. Then, create a new stack with the updated template, or update the existing stack template.

Lambda function doesn't have permission to invoke Amazon S3

If your Lambda function is missing a required permission, then you might receive the "resource you requested does not exist" error message.
To resolve this error, complete the following steps:

1. To check the Lambda function permissions, run the following get-policy AWS CLI command:

   aws lambda get-policy --function-name 111122223333 --region aa-example-1

   Note: Replace 111122223333 with your function's ARN and aa-example-1 with your AWS Region.
2. To allow the Lambda function to invoke Amazon S3, update the CloudFormation template to attach the following permissions:

   S3Permission:      Type: AWS::Lambda::Permission
     Properties:
       FunctionName: 111122223333
       Action: lambda:InvokeFunction
       Principal: s3.amazonaws.com
       SourceAccount: !Ref 'AWS::555555555555'

   Note: Replace 111122223333 with your function's ARN and 555555555555 with the AWS account that owns the function. You can use the AWS::AccountId pseudo parameter to automatically replace the account ID where CloudFormation creates the stack.
3. To make sure that CloudFormation creates the S3 bucket only after the Lambda function has the required permissions, add the following DependsOn attribute:

   S3Bucket:      Type: AWS::S3::Bucket
     DependsOn: "S3Permission"
     Properties:
       NotificationConfiguration:
         LambdaConfigurations:
           - Function: 111122223333
               Event: "s3:ObjectCreated:Put"

   Note: Replace 111122223333 with your function's ARN.

Issues with Amazon SNS notification configuration

Amazon SNS ARN doesn't exist or isn't valid
If your S3 bucket uses the TopicConfigurations property and the Amazon Simple Notification Service (Amazon SNS) topic doesn't exist or isn't valid, then you might receive the "Unable to validate the following destination configurations" error message. The ARN format and value must match the SNS topic's ARN.
To check whether the SNS topic's ARN exists in your account, run the following list-topics AWS CLI command:

aws sns list-topics \--region aa-example-1\
--query "Topics[?TopicArn=='111122223333']"

Note: Replace aa-example-1 with your Region and 111122223333 with the topic's ARN.
If you don't receive records in the command output, then the SNS topic either doesn't exist or isn't valid.
To resolve this issue, create the SNS topic. Make sure that you provide a valid topic ARN in the TopicConfigurations property.

SNS topic doesn't have a required access policy
To verify that the SNS topic has the required access policy, complete the following steps:

1. To check the access policy that's attached to the SNS topic, run the following get-topic-attributes AWS CLI command:

   aws sns get-topic-attributes \--topic-arn 111122223333 \
   --region aa-example-1 \
   --query 'Attributes.Policy'

   Note: Replace 111122223333 with your topic ARN and aa-example-1 with your Region.
2. The access policy must allow the Amazon S3 service to publish to the topic. If the policy doesn't have those permissions, then edit the topic's access policy to include the following permissions:

   {           "Sid": "S3AccessForNotification",      
         "Effect": "Allow",
         "Principal": {
           "Service": "s3.amazonaws.com"
         },
         "Action": "SNS:Publish",
         "Resource": "111122223333"
   }

   Note: Replace 111122223333 with your topic ARN.
3. Verify that you can now create a new stack, or update the existing stack template.

Issue with the AWS KMS key policy that's associated with the SNS topic
The AWS Key Management Service (AWS KMS) policy must allow Amazon S3 to access the AWS KMS key. To view the encryption configuration and the minimum required policy, complete the following steps:

To check whether the SNS topic is encrypted with an AWS KMS key, run the following get-topic-attributes AWS CLI command:

aws sns get-topic-attributes \--topic-arn 111122223333 \--region aa-example-1\--query "Attributes.KmsMasterKeyId"

Note: Replace 111122223333 with your topic ARN and aa-example-1 with your Region. If the SNS topic is encrypted, then the command's output shows the AWS KMS key ARN.

To check the AWS KMS key policy, run the get-key-policy command:

aws kms get-key-policy \--key-id 111122223333 \  
--policy-name default \  
--region aa-example-1 | jq -r '.Policy' | jq .

Note: Replace 111122223333 with your AWS KMS key ARN, and aa-example-1 with your Region. For better readability, it's a best practice to use the jq command to show the policy contents in a JSON format. For more information, see ./jq on the jq website.

The following example policy shows the minimum required AWS KMS key policy:

{    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "s3.amazonaws.com"
            },
            "Action": ["kms:GenerateDataKey*", "kms:Decrypt"],
            "Resource": "111122223333"
        }
    ]
}

Note: Replace 111122223333 with your AWS KMS key ARN.
If your policy doesn't have the required permissions, then update the AWS KMS key policy.

Issues with Amazon SQS notification configuration

The Amazon SQS ARN doesn't exist or isn't valid
If your S3 bucket uses the QueueConfigurations property and your Amazon Simple Queue Service (Amazon SQS) ARN doesn't exist or isn't valid, then you might receive the SQS queue does not exist error.

To check whether the Amazon SQS queue exists in the account, run the following list-queues AWS CLI command:

aws sqs list-queues --queue-name-prefix YOUR-SQS-QUEUE-NAME 
--region aa-example-1

Note: Replace YOUR-SQS-QUEUE-NAME with your SQS queue name, and aa-example-1 with your Region.

If the SQS queue doesn't exist, then either create a new queue or update the template with an existing queue.

Example template:

Resources:
  SNSTopic:
    Type: AWS::SNS::Topic
  SNSTopicPolicy:
    Type: AWS::SNS::TopicPolicy
    Properties:
      PolicyDocument:
        Id: MyTopicPolicy
        Version: '2012-10-17'
        Statement:
          - Sid: Statement-id
            Effect: Allow
            Principal:
              Service: s3.amazonaws.com
            Action: "SNS:Publish"
            Resource: !Ref SNSTopic
            Condition:
              ArnLike:
                aws:SourceArn: !Join
                  - ''
                  - - 'arn:aws:s3:::'
                    - !Ref S3Bucket
      Topics:
        - !Ref SNSTopic
  S3Bucket:
    Type: AWS::S3::Bucket
    Properties:
      AccessControl: BucketOwnerFullControl

SQS queue doesn't have the required access policy
To verify that the SQS queue has the required access policy, you can use the AWS CLI or the CloudFormation console.

To use the AWS CLI to verify your queue's access policy, complete the following steps:

1. To check the SQS queue policy, run the following get-queue-attributes AWS CLI command:

   aws sqs get-queue-attributes \--queue-url YOUR-SQS-QUEUE-URL \
   --region aa-example-1\
   --attribute-names Policy | jq .

   Note: Replace YOUR-SQS-QUEUE-URL with your queue URL and aa-example-1 with your Region. For better readability, it's a best practice to use the jq command to show the policy contents in a JSON format. For more information, see ./jq on the jq website.
2. If your policy doesn't have access to Amazon S3, then create a new access policy in a JSON file.
   Example JSON file:

   {"Policy": "{\"Version\":\"2012-10-17\",\"Statement\":
   [{\"Sid\":\"S3AccessForNotification\",\"Effect\":\"Allow\",\"Principal\":
   {\"Service\":\"s3.amazonaws.com\"},\"Action\":\"SQS:SendMessage\",\"Resource\":\"111122223333\"}]}"}

   Note: Replace 111122223333 with the queue ARN.
3. To update the policy, run the following set-queue-attributes AWS CLI command:

   aws sqs set-queue-attributes --queue-url YOUR-SQS-QUEUE-URL 
   --attributes file://sqs-policy.json

   Note: Replace YOUR-SQS-QUEUE-URL with your queue URL and sqs-policy.json with your policy JSON file.

To use the CloudFormation console to verify your queue's access policy, update the CloudFormation template to include the following resource:

SampleSQSPolicy: 
  Type: AWS::SQS::QueuePolicy
  Properties: 
    Queues: 
      - YOUR-SQS-QUEUE-URL
    PolicyDocument: 
      Statement: 
        - 
          Action: 
            - "SQS:SendMessage"
          Effect: "Allow"
          Resource: 111122223333
          Principal:  
            Service: 
              - "s3.amazonaws.com"

Note: Replace YOUR-SQS-QUEUE-URL with your queue URL and 111122223333 with your queue ARN.

After you create or update the policy, verify that you can create a new stack, or update the existing stack template.

For more information, see How do I grant access to an Amazon SQS queue?

If you still encounter issues, then see How do I troubleshoot the Amazon SQS error "Invalid value for the parameter policy"?

Issue with the AWS KMS key policy associated with the SQS queue
To resolve issues with the AWS KMS key policy, complete the following steps:

1. To get the SQS queue URL, run the following list-queues AWS CLI command:

   aws sqs list-queues --queue-name-prefix YOUR-SQS-QUEUE-NAME 
   --region aa-example-1

   Note: Replace YOUR-SQS-QUEUE-NAME with your SQS queue name and aa-example-1 with your Region.
2. To get the AWS KMS key ID, run the following get-queue-attributes AWS CLI command:

   aws sqs get-queue-attributes \--queue-url YOUR-SQS-QUEUE-URL \
   --region aa-example-1\
   --attribute-names KmsMasterKeyId

   Note: Replace YOUR-SQS-QUEUE-URL with your queue URL, and aa-example-1 with your Region.
3. To get the AWS KMS key ARN, run the following describe-key AWS CLI command:

   aws kms describe-key --key-id YOUR-KMS-KEY-ID

   Note: Replace YOUR-KMS-KEY-ID with the key ID.
4. To view the full key policy, run the following get-key-policy AWS CLI command:

   aws kms get-key-policy \--key-id 111122223333 \
   --policy-name default \
   --region aa-example-1

   Note: Replace 111122223333 with your AWS KMS key ARN, and aa-example-1 with your Region.
5. In the output, verify that the policy allows Amazon S3 to use the AWS KMS key.
   Example permissions:

   {    "Version": "2012-10-17",
       "Statement": [
           {
               "Effect": "Allow",
               "Principal": {
                   "Service": "s3.amazonaws.com"
               },
               "Action": ["kms:GenerateDataKey*", "kms:Decrypt"],
               "Resource": "111122223333"
           }
       ]
   }

   Note: Replace 111122223333 with the AWS KMS key's ARN.

If your policy doesn't have the required permissions, then update the key policy.

Circular dependency between resources

Important: Before you subscribe an SNS topic to S3 Event Notifications, you must create the AWS::SNS::TopicPolicy with the required permissions. The topic policy must exist before you create the subscription.

To create the topic policy first, you must use a DependsOn attribute on the AWS::S3::Bucket resource. This attribute creates the topic policy before the bucket. Or, you can use two stack operations to create the resources first, and then update the S3Bucket resource to include the NotificationConfiguration property. Take one of the following actions.

Specify a value for BucketName in your CloudFormation template

Use a static name for your S3 bucket in the BucketName property in the S3Bucket resource of your CloudFormation template. A static S3 bucket name removes the intrinsic dependency between the SNS topic policy and Amazon S3.

Important: S3 bucket names must be globally unique.

The following example CloudFormation template specifies a hardcoded -Bucket-Name- value for the BucketName property. The S3Bucket resource has an explicit DependsOn attribute that's set to SNSTopicPolicy. The attribute specifies that the template creates the SNSTopicPolicy resource before the S3Bucket resource.

Example CloudFormation template:

Resources:
  SNSTopic:
    Type: AWS::SNS::Topic
  SNSTopicPolicy:
    Type: AWS::SNS::TopicPolicy
    Properties:
      PolicyDocument:
        Id: MyTopicPolicy
        Version: '2012-10-17'
        Statement:
          - Sid: Statement-id
            Effect: Allow
            Principal:
              Service: s3.amazonaws.com
            Action: "SNS:Publish"
            Resource: !Ref SNSTopic
            Condition:
              ArnLike:
                aws:SourceArn: !Join
                  - ''
                  - - 'arn:aws:s3:::'
                    - '-Bucket-Name-'
      Topics:
        - !Ref SNSTopic
  S3Bucket:
    Type: AWS::S3::Bucket
    DependsOn:
      - SNSTopicPolicy
    Properties:
      AccessControl: BucketOwnerFullControl
      BucketName: "-Bucket-Name-"
      NotificationConfiguration:
        TopicConfigurations:
          - Topic: !Ref SNSTopic
            Event: s3:ObjectCreated:Put

Note: Replace -Bucket-Name- with your bucket's name.

Use a parameter for BucketName

Parameters allow you to use the same CloudFormation template for S3 buckets with different names. During the stack creation, you can set a value for the paramBucketName parameter. In the following example policy, the S3Bucket resource has an explicit DependsOn attribute that's set to SNSTopicPolicy.

Example policy:

Parameters:
  paramBucketName:
    Type: String
    Description: Bucket Name
Resources:
  SNSTopic:
    Type: AWS::SNS::Topic
  SNSTopicPolicy:
    Type: AWS::SNS::TopicPolicy
    Properties:
      PolicyDocument:
        Id: MyTopicPolicy
        Version: '2012-10-17'
        Statement:
          - Sid: Statement-id
            Effect: Allow
            Principal:
              Service: s3.amazonaws.com
            Action: "SNS:Publish"
            Resource: !Ref SNSTopic
            Condition:
              ArnLike:
                aws:SourceArn: !Join
                  - ''
                  - - 'arn:aws:s3:::'
                    - !Ref paramBucketName
      Topics:
        - !Ref SNSTopic
  S3Bucket:
    Type: AWS::S3::Bucket
    DependsOn:
      - SNSTopicPolicy
    Properties:
      AccessControl: BucketOwnerFullControl
      BucketName: !Ref paramBucketName
      NotificationConfiguration:
        TopicConfigurations:
          - Topic: !Ref SNSTopic
            Event: s3:ObjectCreated:Put

Create a stack, and then update the stack

In this method, the S3Bucket resource doesn't include the BucketName property. As a result, CloudFormation creates a unique bucket name for you. To avoid the circular dependency, don't use a DependsOn attribute.

First, create the stack without the NotificationConfiguration property in the S3Bucket resource.

Example CloudFormation template:

Resources:
  SNSTopic:
    Type: AWS::SNS::Topic
  SNSTopicPolicy:
    Type: AWS::SNS::TopicPolicy
    Properties:
      PolicyDocument:
        Id: MyTopicPolicy
        Version: '2012-10-17'
        Statement:
          - Sid: Statement-id
            Effect: Allow
            Principal:
              Service: s3.amazonaws.com
            Action: "SNS:Publish"
            Resource: !Ref SNSTopic
            Condition:
              ArnLike:
                aws:SourceArn: !Join
                  - ''
                  - - 'arn:aws:s3:::'
                    - !Ref S3Bucket
      Topics:
        - !Ref SNSTopic
  S3Bucket:
    Type: AWS::S3::Bucket
    Properties:
      AccessControl: BucketOwnerFullControl

Add the NotificationConfiguration property in the S3Bucket resource, and then update the stack template.

Example CloudFormation template:

Resources:
  SNSTopic:
    Type: AWS::SNS::Topic
  SNSTopicPolicy:
    Type: AWS::SNS::TopicPolicy
    Properties:
      PolicyDocument:
        Id: MyTopicPolicy
        Version: '2012-10-17'
        Statement:
          - Sid: Statement-id
            Effect: Allow
            Principal:
              Service: s3.amazonaws.com
            Action: "SNS:Publish"
            Resource: !Ref SNSTopic
            Condition:
              ArnLike:
                aws:SourceArn: !Join
                  - ''
                  - - 'arn:aws:s3:::'
                    - !Ref S3Bucket
      Topics:
        - !Ref SNSTopic
  S3Bucket:
    Type: AWS::S3::Bucket
    Properties:
      AccessControl: BucketOwnerFullControl
      NotificationConfiguration:
        TopicConfigurations:
          - Topic: !Ref SNSTopic
            Event: s3:ObjectCreated:Put

Related information

Granting permissions to publish event notification messages to a destination

Managing AWS resources as a single unit with AWS CloudFormation stacks

Setting up Amazon SNS notifications