Aws Lambda 无权执行：SNS：在资源上发布：+358

Question

I have made Cognito PostConfirmation lambda function. When user will successfully signup then I want to send them SMS. For that I am using AWS-SNS . I have created one Sns Topic and attached to my PostConfirmation lambda function. I gave permission to the lambda for Sns publishing. In cloudwatch it says, That lambda does not have authorize to perform this Sns publishing.

I am getting this error in cloudwatch:

PostConfirmation is not authorized to perform: SNS:Publish on resource: +358.... because no identity-based policy allows the SNS:Publish action

I am not sure what I am missing.

This is my YAML file:

  plugins:
    - serverless-webpack
    - serverless-offline
    - serverless-plugin-warmup
    - serverless-iam-roles-per-function
  ## post Confirmation
  PostConfirmation:
    handler: src/handlers/postConfirmation.postConfirmation
    events:
      - cognitoUserPool:
          pool: ${self:provider.environment.COGNITO}
          trigger: PostConfirmation
          existing: true
    iamRoleStatements:
      - Effect: Allow
        Action:
          - cognito-idp:*
        Resource: arn:aws:cognito-idp:*:*:*
      - Effect: Allow
        Action:
          - dynamodb:PutItem
          - lambda:InvokeFunction # Added this like mentioned above
        Resource: 'arn:aws:dynamodb:${opt:region, self:provider.region}:*:table/${self:provider.environment.ITEM_TABLE}'
      - Effect: Allow
        Action:
          - sns:Publish ## This is where I am giving my permisson 
          - sns:SetSMSAttributes
        Resource: !Ref SendMessageSns ## Sns Topic

resources:
  Resources:
    SendMessageSns:
      Type: AWS::SNS::Topic
      Properties:
        DisplayName: It will send sms when user successfully signUp
        TopicName: ${self:service}-${opt:stage, self:provider.stage}-successful

This is how I am trying to publishing the message

import { SNS } from '@aws-sdk/client-sns';
const snsClient = new SNS({ region: 'eu-north-1' });
exports.postConfirmation = async (event: any, context: any) => {

  const messageParams = {
    Message:
      'congrats it works',
    PhoneNumber: '+358.......',
  };

  try {
    console.log('1');
    const snsSucess = await snsClient.publish(messageParams);
    console.log('Success.', snsSucess);
    console.log('2');
    context.done(null, event);
  } catch (error) {
    console.log('error', { error });
    return {
      statusCode: 500,
      body: JSON.stringify(error),
    };
  }
};

Answer 1

You allowed publish to the SNS topic, but are trying to send the SMS directly to the phone number. When publishing to the SNS topic you need to publish message to the topic and subscribe the phone number to the topic, see https://docs.aws.amazon.com/sns/latest/dg/sms_publish-to-topic.html

Alternatively you can publish directly to phone number, but you'd need to modify the IAM policy and also possibly move outside of SMS sandbox - https://docs.aws.amazon.com/sns/latest/dg/sms_publish-to-phone.html