在 cloudformation 中启用 SNS 传递状态日志记录配置

Question

I'm trying to set up an SNS topic with AWS CloudFormation. I'm able to get the topics and its SQS subscriptions up and running, but I couldn't find a way to specify the delivery status logging options (the ones that tell the topic to write its logs to cloudwatch).

The official SNS/Cloudformation docs say nothing about this capability.

I found here that apparently it's not implemented yet. Does anyone have up-to-date status about this?

Below is the template (fragment) I have:

SNSBouncesTopic:
  Type: AWS::SNS::Topic
  Properties: 
    DisplayName: SNS-Bounces
    Subscription: 
     - Endpoint: !GetAtt
        - SQSBouncesQueue
        - Arn
       Protocol: sqs
    TopicName: SNS-Bounces

The SQSBouncesQueue is another resource of the stack that handles the SNS messages.

Answer 1

At the moment, CloudFormation does not support enabling SNS Delivery Status Logging.

You'll need to use either the console, SDK or CLI. If you still need to use CloudFormation workflow then review the following workaround below :

This workaround involves using a Lambda-backed custom resource to enable SNS Delivery Status logging by adding the necessary attributes to the SNS Topic.

A custom resource essentially triggers a Lambda function when your CFN stack is created, updated, or deleted.

To set up the topic attributes, you would need the following:

a) An IAM role with the permissions for the SNS service to assume the role. It should include the following:

  Permissions : 
  Actions : 
  "logs:CreateLogGroup"
  "logs:CreateLogStream”
  "logs:PutLogEvents”
  "logs:PutMetricFilter"
  "logs:PutRetentionPolicy"

b) An SNS Topic

c) The custom resource that takes in the IAM Role ARN and the SNS Topic ARN and invokes a Lambda function that sets the topic attributes accordingly.

In the Lambda function, you will need to specify the SNS TopicArn, set the topic attributes using set_topic_attributes() method. For the AttributeName, you will have to specify it as “LambdaSuccessFeedbackRoleArn” to set the attribute for a successful delivery and as “LambdaFailureFeedbackRoleArn” to set the attribute for a failed delivery.

Note:

1. The AttributeValue for both successful and failed would be the ARN of an IAM Role with access to modify the CloudWatch logs.

2. This function should be called twice, once to set the attribute for a successful delivery and another to set the attribute for a failed delivery.

Answer 2

Having faced the same issue today trying to set up delivery status logging to SQS, my solution was to use CLI commands integrated into our CI/CD pipeline after using CloudFormation to create the IAM roles.

First I needed to discover the correct attributes names that should be applied to the topic for SQS delivery logging and that can be done using the following CLI command:

aws sns get-topic-attributes --topic-arn <topic-arn>

The required attributes for SQS are:

• SQSSuccessFeedbackRoleArn
• SQSFailureFeedbackRoleArn
• SQSSuccessFeedbackSampleRate

Thus the CLI commands to configure the required logging were as follows:

aws sns set-topic-attributes --topic-arn $TopicArn --attribute-name SQSSuccessFeedbackRoleArn --attribute-value $SuccessRoleArn
aws sns set-topic-attributes --topic-arn $TopicArn --attribute-name SQSFailureFeedbackRoleArn --attribute-value $FailureRoleArn
aws sns set-topic-attributes --topic-arn $TopicArn --attribute-name SQSSuccessFeedbackSampleRate --attribute-value 10

(above commands written in powershell)