Can't create S3 event notification to SNS topic from specific bucket

Question

I'm trying to create S3 event notification to SNS topic from an existing S3 bucket. I'm receiving "Unable to validate the following destination configurations".

Initially I thought the issue was with the SNS topic Access Policy and tried different troubleshooting suggestions, such as this video https://www.youtube.com/watch?v=RjSW75YsBMM, but nothing worked.

I'm using the following policy:

```
{
    "Version": "2012-10-17",
    "Id": "example-ID",
    "Statement": [
        {
            "Sid": "Example SNS topic policy",
            "Effect": "Allow",
            "Principal": {
                "Service": "s3.amazonaws.com"
            },
            "Action": [
                "SNS:Publish"
            ],
            "Resource": "SNS-topic-ARN",
            "Condition": {
                "ArnLike": {
                    "aws:SourceArn": "arn:aws:s3:*:*:bucket-name"
                },
                "StringEquals": {
                    "aws:SourceAccount": "bucket-owner-account-id"
                }
            }
        }
    ]
}  
```

Then I decided to focus on the S3 bucket part of the equation and created brand new bucket with exactly the same configuration, switched the SourceArn in the policy with the new bucket's arn and the event notification was successfully created.

What could be the reason for a given SNS topic with a given policy to work with one S3 bucket, but not with another?

rePost-User-venky · Answer

One of the reasons for the validation failure could be an incorrect or misspelled ARN. Or it could be the event types that trigger the SNS notifications. Verify the bucket configuration to make sure it is properly setup to receive event notifications. Specifically it can trigger the right SNS topic. In addition, double check on the regions where the S3 and SNS services are created and the validations will fail if they are in different regions.

Sourav Manna · Answer

In SNS topic access policy change the "AWS:SourceOwner" to "AWS:SourceAccount" and add "ArnLike": {
          "aws:SourceArn": "arn:aws:s3:::your bucket name"
        }

Then it will work.

Can't create S3 event notification to SNS topic from specific bucket

Relevant content