[英]SNS cross account subscription with additional layer
We own an AWS Account, account A. We rely on an external team to publish messages to their SNS topic, which is in their account B. We use an SQS queue in account A to subscribe to the SNS topic in account B. Account A has been whitelisted by the owner of account B to subscribe to the SNS topic.我们拥有一个 AWS 账户,账户 A。我们依靠外部团队将消息发布到他们的账户 B 中的 SNS 主题。我们使用账户 A 中的 SQS 队列订阅账户 B 中的 SNS 主题。账户 A已被账号 B 的所有者列入订阅 SNS 主题的白名单。
Now, we would like to subscribe to the SNS topic in Account B for multiple (new) accounts.现在,我们想为多个(新)账户订阅账户 B 中的 SNS 主题。 However, the team that owns account B does not have the capacity to manually whitelist the many accounts we will be creating.
但是,拥有账户 B 的团队无法手动将我们将创建的许多账户列入白名单。
Is there a way for us to delegate or proxy permissions from account A to all the new accounts that we are creating, via something like an IAM Role created in account A?我们有没有办法通过在账户 A 中创建的 IAM 角色之类的东西,将账户 A 的权限委托或代理到我们正在创建的所有新账户?
The problem is that account B is trying to give permission to a specific user of account A. Like you mentioned, this can be an issue if you need to setup multiple accounts.问题是帐户 B 正试图向帐户 A 的特定用户授予权限。就像您提到的,如果您需要设置多个帐户,这可能是一个问题。
You can solve this in multiple ways.您可以通过多种方式解决此问题。
Please note that if you are going with solution #1 that any IAM user in account A will be able to access the SNS resource.请注意,如果您使用解决方案 #1,账户 A 中的任何 IAM 用户都将能够访问 SNS 资源。 If multiple applications are running in account A this could be an issue.
如果多个应用程序在帐户 A 中运行,这可能是一个问题。
Your current situation is:你现在的情况是:
Queue-A
) in Account-A
owned by youAccount-A
中的 Amazon SQS 队列 ( Queue-A
)Topic-B
) in Account-B
owned by somebody elseAccount-B
中的 Amazon SNS 主题 ( Topic-B
)Topic-B
that allows Account-A
to subscribe to the topicTopic-B
添加权限,允许Account-A
订阅该主题The above has worked well.以上效果很好。
New requirements:新要求:
Account-C
and Account-D
to subscribe to Topic-B
Account-C
和Account-D
订阅Topic-B
Account-B
does not wish to modify the permissions on Topic-B
to allow these subscription requests Account-B
的所有者不希望修改Topic-B
的权限以允许这些订阅请求Solution解决方案
Instead of Account-C
and Account-D
sending a Subscribe()
request, ask the owner of Topic-B
to directly subscribe the new queues .不是
Account-C
和Account-D
发送Subscribe()
请求,而是要求Topic-B
的所有者直接订阅新队列。
You say that "the team that owns account B does not have the capacity to manually whitelist the many accounts we will be creating."你说“拥有账户 B 的团队没有能力手动将我们将创建的许多账户列入白名单。”
This is based on the idea that Account-C
and Account-D
should, themselves, send the Subscribe request to Topic-B
.这是基于
Account-C
和Account-D
应该自己将订阅请求发送到Topic-B
的想法。 Instead, I am recommending that you provide the ARNs of Queue-C
and Queue-D
to the team that owns Topic-B
and ask them to add these queues as subscribers.相反,我建议您将
Queue-C
和Queue-D
的 ARN 提供给拥有Topic-B
的团队,并要求他们将这些队列添加为订阅者。 This does not require any change to the permission policy on Topic-B
.这不需要对
Topic-B
的权限策略进行任何更改。
However, a couple of things to note:但是,有几点需要注意:
Queue-C
and Queue-D
will need to confirm the subscription. Queue-C
和Queue-D
需要确认订阅。 The easiest way to do this is to view the initial message sent to the queue after being subscribed to the topic, copy the subscription URL shown in the message and then paste it into a web browser.Queue-C
and Queue-D
will need to add permission to allow Topic-B
to send a message to their queue. Queue-C
和Queue-D
将需要添加权限以允许Topic-B
向其队列发送消息。 You probably have this in place already for Queue-A
.Queue-A
做好了准备。 The policy would look like:{
"Version": "2012-10-17",
"Id": "arn:aws:sqs:ap-southeast-2:ccc:my-queue/SQSDefaultPolicy",
"Statement": [
{
"Effect": "Allow",
"Principal": "*",
"Action": "sqs:SendMessage",
"Resource": "arn:aws:sqs:ap-southeast-2:ccc:my-queue",
"Condition": {
"ArnEquals": {
"aws:SourceArn": "arn:aws:sns:ap-southeast-2:bbb:their-topic"
}
}
}
]
}
See also:也可以看看:
If you can't rely on the owners of Account-B
to do anything for you, then your only option would be:如果您不能依靠
Account-B
的所有者为您做任何事情,那么您唯一的选择是:
Topic-A
) where you can manage subscriptionsTopic-A
) 中创建您自己的 SNS 主题,您可以在其中管理订阅Topic-A
Topic-A
Queue-A
, so that any message sent to Queue-A
will be re-sent to Topic-A
Queue-A
,以便发送到Queue-A
任何消息都将重新发送到Topic-A
Topic-A
as if it was Topic-B
Topic-A
一样使用 Topic- Topic-B
This way, you can use your existing SQS queue ( Queue-A
) as a 'relay' to a new SNS topic ( Topic-A
) under your control.这样,您可以使用现有的 SQS 队列 (
Queue-A
) 作为您控制下的新 SNS 主题 ( Topic-A
) 的“中继”。 You would also need to change your current apps that consume from Queue-A
to consume from a new queue that is subscribed to Topic-A
.您还需要将当前从
Queue-A
使用的应用程序更改为从订阅Topic-A
的新队列中使用。
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.