Guard Duty: Event Rule not sending SNS

I have created MalwareProtection for s3. When an event pattern detects malware finding in s3, an associated SNS topic should send an email. It doesn't. I have the following CloudFormation, and since I have paid AWS Support, I created a service/support case 15+ days ago:

    MalwarePolicy:
        Type: AWS::IAM::ManagedPolicy
        Properties:
            PolicyDocument:
                Version: 2012-10-17
                Statement:
                  - Sid: AllowManagedRuleToSendS3EventsToGuardDuty
                    Effect: Allow
                    Action:
                      - events:PutRule
                      - events:PutTargets
                      - events:DeleteRule
                      - events:RemoveTargets
                    Resource: !Sub arn:aws:events:${AWS::Region}:${AWS::AccountId}:rule/DO-NOT-DELETE-AmazonGuardDutyMalwareProtectionS3*
                    Condition:
                        StringLike:
                            'events:ManagedBy': malware-protection-plan.guardduty.amazonaws.com

                  - Sid: AllowGuardDutyToMonitorEventBridgeManagedRule
                    Effect: Allow
                    Action:
                      - events:DescribeRule
                      - events:ListTargetsByRule
                    Resource: !Sub arn:aws:events:${AWS::Region}:${AWS::AccountId}:rule/DO-NOT-DELETE-AmazonGuardDutyMalwareProtectionS3*

                  - Sid: AllowPostScanTag
                    Effect: Allow
                    Action:
                      - s3:PutObjectTagging
                      - s3:PutObjectVersionTagging
                      - s3:GetObjectTagging
                      - s3:GetObjectVersionTagging
                    Resource: !Sub arn:aws:s3:::${BucketName}/*

                  - Sid: AllowEnableS3EventBridgeEvents
                    Effect: Allow
                    Action:
                      - s3:PutBucketNotification
                      - s3:GetBucketNotification
                    Resource: !Sub arn:aws:s3:::${BucketName}

                  ##
                  ## Note: when S3 malware protection enabled, test file malware-protection-resource-validation-object
                  ##        is automatically created
                  ##
                  - Sid: AllowPutValidationObject
                    Effect: Allow
                    Action:
                      - s3:PutObject
                    Resource: !Sub arn:aws:s3:::${BucketName}/malware-protection-resource-validation-object

                  - Sid: AllowCheckBucketOwnership
                    Effect: Allow
                    Action:
                      - s3:ListBucket
                    Resource: !Sub arn:aws:s3:::${BucketName}

                  - Sid: AllowMalwareScan
                    Effect: Allow
                    Action:
                      - s3:GetObject
                      - s3:GetObjectVersion
                    Resource: !If
                      - HasFullPrefixes
                      - !Split [',', !Ref FullPrefixes]
                      - !Sub arn:aws:s3:::${BucketName}/${FullPrefixes}

                  - Sid: AllowDecryptForMalwareScan
                    Effect: Allow
                    Action:
                      - kms:GenerateDataKey
                      - kms:Decrypt
                    Resource: !Sub arn:aws:kms:${AWS::Region}:${AWS::AccountId}:key/*
                    Condition:
                        StringLike:
                            'kms:ViaService': !Sub s3.${AWS::Region}.amazonaws.com

    MalwarePolicyRole:
        Type: AWS::IAM::Role
        Properties:
            RoleName: !Sub GuardDutyMalwareProtection-${BucketName}
            AssumeRolePolicyDocument:
                Version: 2012-10-17
                Statement:
                  - Effect: Allow
                    Principal:
                        Service: malware-protection-plan.guardduty.amazonaws.com
                    Action: sts:AssumeRole
            ManagedPolicyArns: [!Ref MalwarePolicy]

    MalwareProtection:
        Type: AWS::GuardDuty::MalwareProtectionPlan
        Properties:
            Actions:
                Tagging:
                    Status: !Ref TaggingStatus
            ProtectedResource:
                S3Bucket:
                    BucketName: !Ref BucketName
                    ObjectPrefixes: !If
                      - HasObjectPrefixes
                      - !Split [',', !Ref ObjectPrefixes]
                      - !Ref AWS::NoValue
            Role: !GetAtt MalwarePolicyRole.Arn

    SnsTopic:
        Type: AWS::CloudFormation::Stack
        Properties:
            TemplateURL: ../path/sns.yaml
            Parameters:
                DisplayName: !Ref BucketName
                TopicName: !Join [ '-', !Split ['.', !Ref BucketName] ]

    SnsTopicSubscription:
        Type: AWS::SNS::Subscription
        Properties:
            Endpoint: !Ref AdminEmail
            Protocol: email
            TopicArn: !GetAtt SnsTopic.Outputs.TopicArn
        DependsOn: SnsTopic

    ##
    ## eventbridge: https://docs.aws.amazon.com/guardduty/latest/ug/monitor-with-eventbridge-s3-malware-protection.html
    ##
    MalwareEventRuleNotification:
        Type: AWS::Events::Rule
        Properties:
            Name: !Join
              - '-'
              - - S3GuardDuty
                - !Join [ '-', !Split ['.', !Ref BucketName] ]
            Description: !Sub malware detection notification for ${BucketName} bucket
            EventPattern:
                source:
                  - aws.guardduty
                detail-type:
                  - GuardDuty Malware Protection Object Scan Result
            Targets:
              - Id: AdminEmail
                Arn: !GetAtt SnsTopic.Outputs.TopicArn

I got a response from the support engineer to hardcode the SNS topic arn instead of using my above GetAtt on the AWS::Events::Rule. Alternatively, I was told that I could use SSM parameter store. Per recommendation from AWS, since I have paid AWS Support, I did something anti pattern to my norm. I created the SNS topic from a parent stack, then in the same parent stack stored the ARN into SSM parameter. Again from the parent stack, I passed the SSM path to the nested/child stack, so that I could Ref it in the above AWS::Events::Rule >> Targets >> Targets >> Arn, then drop a trivial eicar.com file, no email notifications are sent to me.

I'm lucky that guard duty is free trial for 30 days (though I haven't really tried anything, nothing works, and I've wasted my own time at expense of AWS Support I'm paying for). I got maybe 15 days left of free trial, maybe someone here can provide me better support than AWS paid support?