As was pointed out in one of the comments, you don't want to use AWS:* as a principal since it grants anyone with an AWS account access.
To create a SNS topic, and restrict access to certain services, or anyone in the account, use the following example.
The "AllowServices" SID show how to add multiple services, while the AllowAWS allows anything in the account to access it.
---
AWSTemplateFormatVersion: '2010-09-09'
Parameters:
Email:
Type: String
Default: <your name here>
Resources:
Topic:
Type: AWS::SNS::Topic
Properties:
TopicName: TestTopic
Subscription:
- Endpoint: !Ref Email
Protocol: email
TopicPolicy:
Type: AWS::SNS::TopicPolicy
Properties:
PolicyDocument:
Statement:
- Sid: AllowServices
Effect: Allow
Principal:
Service:
- events.amazonaws.com
- cloudwatch.amazonaws.com
Action: 'sns:Publish'
Resource:
- !Ref Topic
- Sid: AllowAWS
Effect: Allow
Principal:
AWS: !Sub "arn:aws:iam::${AWS::AccountId}:root"
Action: 'sns:Publish'
Resource:
- !Ref Topic
Topics:
- !Ref Topic
I think you need a AWS::SNS::TopicPolicy resource. Check out this link AWS::SNS::TopicPolicy
you can use this- i've removed the default condition which locks down own account
SNSAccessPolicy:
Type: AWS::SNS::TopicPolicy
Properties:
PolicyDocument:
Id: <Yourtopic>
Statement:
-
Action:
- "sns:Publish"
- "SNS:GetTopicAttributes"
- "SNS:SetTopicAttributes"
- "SNS:AddPermission"
- "SNS:RemovePermission"
- "SNS:DeleteTopic"
- "SNS:Subscribe"
- "SNS:ListSubscriptionsByTopic"
- "SNS:Publish"
- "SNS:Receive"
Effect: Allow
Principal:
AWS: "*"
Resource:
Ref: <Yourtopic>
Topics:
-
Ref: <Yourtopic>
The technical post webpages of this site follow the CC BY-SA 4.0 protocol. If you need to reprint, please indicate the site URL or the original address.Any question please contact:yoyou2525@163.com.