Can I restrict a policy to enforce use of a specific SMS template in Pinpoint?

Question

I would like to give very specific, temporary permissions to a user/role to allow them to send an SMS, restricting the body template and the Sender ID.

I know I can do this in SES (https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_SendEmail.html), but is it possible with Pinpoint (or even SNS)?

Thanks for the help! :)

Answer

**IAM policy for AWS Pinpoint with the correct condition keys and version:**
```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "mobiletargeting:SendMessages",
            "Resource": "*",
            "Condition": {
                "ForAllValues:StringEquals": {
                    "aws:RequestTag/sms_channel": "true"
                },
                "StringLike": {
                    "aws:RequestTag/origination_number": "SENDER_ID",
                    "aws:RequestTag/message_body": "APPROVED_TEMPLATE*"
                }
            }
        }
    ]
}

```

Answer

Answer shortly yes :)

You can create an IAM policy that grants specific temporary permissions to a user or role allowing them to send an SMS with restricted parameters.

Aws pinpoint example

```

{
    "Version": "2023-03-26",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "mobiletargeting:SendMessages",
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "mobiletargeting:channels": "SMS"
                },
                "StringLike": {
                    "mobiletargeting:originationNumber": "SENDER_ID",
                    "mobiletargeting:messageBody": "APPROVED_TEMPLATE*"
                }
            }
        }
    ]
}

```

Aws sns example

IAM policy - since sns does not support policy templates attach this one to the user

```

{
    "Version": "2023-03-26",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "sns:Publish",
            "Resource": "*",
            "Condition": {
                "StringLike": {
                    "sns:Message": "APPROVED_TEMPLATE*",
                    "sns:SenderID": "SENDER_ID"
                }
            }
        }
    ]
}

```

Can I restrict a policy to enforce use of a specific SMS template in Pinpoint?

Relevant content