Config remediation AWS-PublishSNSNotification cloudformation failure

Question

Hi all

I created a cloudformation template to create an AWS Config rule remediation for the Config managed rule - https://docs.aws.amazon.com/config/latest/developerguide/s3-account-level-public-access-blocks-periodic.html.

```

S3AccountLevelPublicAccessBlocksPeriodicRemediation:
    DependsOn: S3AccountLevelPublicAccessBlocksPeriodic
    Type: 'AWS::Config::RemediationConfiguration'
    Properties:
      ConfigRuleName: S3AccountLevelPublicAccessBlocksPeriodic
      TargetId: "AWS-PublishSNSNotification"
      TargetType: "SSM_DOCUMENT"
      TargetVersion: "1"
      Parameters:
        AutomationAssumeRole:
          StaticValue:
            Values:
              - arn:aws:iam::[account-id]:role/SNSRole
        Message:
          StaticValue:
            Values: 
              - "S3AccountLevelPublicAccessBlocksPeriodic"
        TopicArn:
          ResourceValue:
            Value: !Ref SNSPublishMessageTopicARN
      ExecutionControls:
        SsmControls:
          ConcurrentExecutionRatePercentage: 10
          ErrorPercentage: 10
      Automatic: True
      MaximumAutomaticAttempts: 10
      RetryAttemptSeconds: 600

```

But the template failed, the error message is as follows:

```
1 validation error detected: Value 'arn:aws:sns:us-west-2:[account-id]:sns-to-simplhug' at 'remediationConfigurations.1.member.parameters.TopicArn.member.resourceValue.value' failed to satisfy constraint: Member must satisfy enum value set: [RESOURCE_ID] (Service: AmazonConfig; Status Code: 400; Error Code: ValidationException; Request ID: a32d82d8-8aca-47dd-bc16-58fd978aed67; Proxy: null)
```

what did go wrong?

Thanks.

re:Post Agent · Accepted Answer

Change the TopicArn section in your template from:

```yaml
TopicArn:
  ResourceValue:
    Value: !Ref SNSPublishMessageTopicARN
```

to:

```yaml
TopicArn:
  StaticValue:
    Values:
      - !Ref SNSPublishMessageTopicARN
```

This modification uses StaticValue instead of ResourceValue and provides the SNS topic ARN as a static value. The Values key is an array, which is why the ARN is nested under it.

Also, ensure that the SNSPublishMessageTopicARN is properly defined elsewhere in your template or passed as a parameter.

This change should resolve the validation error you're encountering. The AWS-PublishSNSNotification remediation action expects the TopicArn to be provided as a static value rather than a resource value.

Remember to update the IAM role (SNSRole in your template) to have the necessary permissions to publish to the SNS topic. The role should have a policy that allows the "sns:Publish" action on the specified SNS topic.
      
**Sources**  
[How to configure existing AWS Config rule to send to SNS ? | AWS re:Post](https://repost.aws/questions/QUNsZEziT5Q6yfE-ZxBfMyEw/how-to-configure-existing-aws-config-rule-to-send-to-sns)  
[SNS tOPIC does not send message to my AWS Chatbot | AWS re:Post](https://repost.aws/questions/QUd_bah7oGRhm2cSMcizwEsQ/sns-topic-does-not-send-message-to-my-aws-chatbot)

Config remediation AWS-PublishSNSNotification cloudformation failure

Add your answer

Relevant content