What SNS topic access policy to use for a CloudFormation CustomResource to post messages to a SNS topic in different AWS account?

Hello,

The access policy to use for a CloudFormation CustomResource to post messages to a SNS topic in another AWS account, you’ll need to set up cross-account permissions. You will create a create an SNS topic access policy in the AWS account where the SNS topic resides( the “ destination” account) and grant the necessary permissions to the AWS account where the CloudFormation custom resource is located( the “source” account)

[+] https://docs.aws.amazon.com/sns/latest/dg/sns-access-policy-use-cases.html

To add the SNS topic access policy that allows messages with a specific string, you can use the ‘aws:sourceArn’ condition key along with string comparison condtions in the SNS topic’s access policy. This will allow you to filter messages based on their source ARN, which can be set by the publisher of the message.

An example:

[+] https://docs.aws.amazon.com/sns/latest/dg/sns-using-identity-based-policies.html