Cross account, cross region SNS message processing

Question

We are working on SNS to HTTPS API integration between 2 teams. So, another team has SNS topic configured in us-east-1 region and our HTTPS API is running in us-west-2 region.

Just wanted to check if we can process SNS messages generated from us-east-1 and a different AWS account in us-west-2 region.

I read somewhere (can't remember the blog post link now), that if SNS messages are generated in us-east-1 , they have to be processed in us-east-1 only. If we try to process in us-east-2 , message signature verification will fail and throws an invalid TopicArn exception.

Please guide if this is correct.

Answer 1

So, another team has SNS topic configured in us-east-1 region and our HTTPS API is running in us-west-2 region.

When SNS is publishing to an HTTPS endpoint, the endpoint can be anywhere on the Internet. It doesn't even need to be in AWS at all. As long as your HTTPS endpoint is accessible from the Internet and has a valid SSL certificate (matches the hostname, not expired, signed by an accredited certificate authority, not self-signed), that is all SNS will require.

The destination region and destination AWS account lose all meaningfulness in such a setup. There is no constraint, here.

If the topic is in us-east-1 then all requests sent to SNS must be sent to the us-east-1 endpoint (eg Subscribe or Publish ) but even then, they can be sent from anywhere on the Internet.

Answer 2

SNS can be configured across regions via HTTPS endpoint of lambda by attaching the API Gateway to that lambda and copying the HTTPS URL of same.

After getting the HTTPS URL of the lambda may be whichever region. It may be that you just add in SNS service subscription part in SNS service by creating the subscription in the service.

After that, just publish a message. You will see entries in your Cloudwatch logs if you print an event in lambda. You will see something like "Subscribe URL". Copy that URL and paste it in the SNS service where you will be able to see "Pending on Subscription". This will work with latest amazon SNS service.

I tried and tested it to verify that this works.