不同区域上AmazonIpSpaceChanged的SNS订阅错误

Question

Why is it that I can't susbscribe SNS on AmazonIpSpaceChanged? Please check, I need your guidance.

The guide I basically followed with is How to Automatically Update Your Security Groups for Amazon CloudFront and AWS WAF by Using AWS Lambda from the AWS Security blog.

Here's an output of the terminal:

➜  terminal $ cat ~/.aws/config
[default]
region = ap-southeast-1
➜  terminal $ aws sns subscribe --topic-arn arn:aws:sns:us-east-1:806199016981:AmazonIpSpaceChanged --protocol lambda --notification-endpoint arn:aws:lambda:ap-southeast-1:accountid_removed:function:cloudfront-securitygroup-controller

An error occurred (InvalidParameter) when calling the Subscribe operation: Invalid parameter: TopicArn
➜  terminal $ AWS_REGION=ap-southeast-1 aws sns subscribe --topic-arn arn:aws:sns:ap-southeast-1:806199016981:AmazonIpSpaceChanged --protocol lambda --notification-endpoint arn:aws:lambda:ap-southeast-1:accountid_removed:function:cloudfront-securitygroup-controller

An error occurred (AuthorizationError) when calling the Subscribe operation: User: arn:aws:iam::accountid_removed:user/removed@gmail.com is not authorized to perform: SNS:Subscribe on resource: arn:aws:sns:ap-southeast-1:806199016981:AmazonIpSpaceChanged

This is also the output when done through the AWS Web Console:

User: arn:aws:iam::accountid_removed:user/removed@gmail.com is not authorized to perform: SNS:Subscribe on resource: arn:aws:sns:ap-southeast-1:806199016981:AmazonIpSpaceChanged (Service: AmazonSNS; Status Code: 403; Error Code: AuthorizationError; Request ID: 0e87384a-e298-569e-bf2d-6a5718eedc40)

Answer 1

The error is because your API call must be made to the us-east-1 region, where the Amazon SNS topic is located.

$ aws sns subscribe --topic-arn arn:aws:sns:us-east-1:806199016981:AmazonIpSpaceChanged --protocol email --notification-endpoint xyzzy@mailinator.com --region us-east-1
{
    "SubscriptionArn": "pending confirmation"
}

It appears that subscribe a AWS Lambda function in a different region works too (or, at least did not return an error):

aws sns subscribe --topic-arn arn:aws:sns:us-east-1:806199016981:AmazonIpSpaceChanged --protocol lambda --notification-endpoint arn:aws:lambda:ap-southeast-2:123456789012:foo --region us-east-1
{
    "SubscriptionArn": "arn:aws:sns:us-east-1:806199016981:AmazonIpSpaceChanged:37dab281-1e8f-16ba-8e4a-ef9de429101b"
}

Answer 2

This is also possible from CloudFormation, with the (new) Region parameter.

Code snipped of CloudFormation (json) SNS resource:

"LambdaAmazonIpSpaceChangedSubscription" : {
  "Type" : "AWS::SNS::Subscription",
  "Properties" : {
    "Endpoint" : {"Fn::GetAtt" : ["LambdaFunction", "Arn"] },
    "Protocol" : "lambda",
    "TopicArn" : "arn:aws:sns:us-east-1:806199016981:AmazonIpSpaceChanged",

    "Region": "us-east-1"

  }
},