How to setup permissions for S3 event to SNS topic?

Question

I am trying to create an event on an S3 bucket (named testBucket) so that every time a new object is created, a message is sent to SNS.

I've done some research and added:

"ArnLike": {"aws:SourceArn": "arn:aws:s3:*:*:testBucket"}

to the target topic's policy.

But, when I try to create the event, it still shows: Permissions on the destination topic do not allow S3 to publish notifications from this bucket.

Any ideas?

Answer 1

Problem solved. Before I was adding the condition line inside the default statement:

    "ArnLike": {
        "aws:SourceArn": "arn:aws:s3:*:*:testBucket"
    }

Turns out I have to create a new statement with publish action in it.

        {
          "Sid": "publish-from-s3",
          "Effect": "Allow",
          "Principal": {
            "Service": "s3.amazonaws.com"
          },
          "Action": "SNS:Publish",
          "Resource": "arn:aws:sns:ap-southeast-2:XXXXXXXXXXXXXX:testTopicforS3",
          "Condition": {
            "ArnLike": {
              "aws:SourceArn": "arn:aws:s3:*:*:testBucket"
            }
          }
        }

Answer 2

Yeah, after create SNS, modify it to add a statement (after the default one):

{
  "Statement": [
    {
      "Sid": "__default_statement_ID",
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": [
        "SNS:Publish",
        "SNS:RemovePermission",
        "SNS:SetTopicAttributes",
        "SNS:DeleteTopic",
        "SNS:ListSubscriptionsByTopic",
        "SNS:GetTopicAttributes",
        "SNS:Receive",
        "SNS:AddPermission",
        "SNS:Subscribe"
      ],
      "Resource": "your sns arn"
    },
    {
      "Sid": "s3",
      "Effect": "Allow",
      "Principal": {
        "Service": "s3.amazonaws.com"
      },
      "Action": "SNS:Publish",
      "Resource": "your sns arn"
    }
  ]
}