Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

Clarification on AWS Config's Support for SNS Topics

0

Hello AWS Community,

I am currently integrating AWS Config across 10+ AWS accounts in my environment and need clarification regarding the compatibility of SNS topics with AWS Config.

Specifically:

Does AWS Config support SNS FIFO topics for streaming configuration data?

If FIFO topics are not supported, what is the recommended approach to ensure message order is preserved when processing Config notifications, especially in cross-account setups?

For context, AWS Config will be updated approximately every minute across these accounts, so processing notifications in order is important.

Any insights, best practices, or official documentation references would be greatly appreciated.

Thank you!

Topics
Application IntegrationManagement & Governance
Tags
AWS Managed ServicesAmazon Simple Notification Service (SNS)AWS ConfigAmazon Simple Queue Service
Language
English

asked a year ago275 views

1 Answer
0

AWS Config does not explicitly support SNS FIFO topics for streaming configuration data. The documentation doesn't mention FIFO topics as a supported option.

For using SNS with AWS Config, here are the recommended practices:

  1. Standard SNS topics are supported for receiving notifications about configuration changes, compliance status, and delivery events.

  2. For cross-account scenarios, you can use an SNS topic from another account by:

  • Attaching a policy to the topic that grants the "sns:Publish" action to AWS Config
  • Ensuring the topic grants permission to the AWS Config service principal ("config.amazonaws.com")
  • As a security best practice, restricting access using the "AWS:SourceAccount" condition

  1. AWS Config does not support encrypted SNS topics or cross-region topics.

  2. For processing information programmatically, it's recommended to use Amazon SQS as the notification endpoint for the SNS topic.

When setting up AWS Config, you can choose to "Stream configuration changes and notifications to an Amazon SNS topic" during the configuration process, where you can either create a new topic, choose one from your account, or specify a topic ARN from another account.
Sources
How AWS Config Works - AWS Config
How to configure existing AWS Config rule to send to SNS ? | AWS re:Post
Permissions for the Amazon SNS Topic - AWS Config
Manual setup for AWS Config - AWS Config

answered a year ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content