search

aws / aws-cdk

The AWS Cloud Development Kit is a framework for defining cloud infrastructure in code
https://aws.amazon.com/cdk
Apache License 2.0
11.41k stars 3.8k forks source link

aws-sns: addSubscription() doesn't add necessary policies for messages to be sent #29098

Open Exter-dg opened 5 months ago

Exter-dg commented 5 months ago

Describe the bug

To subscribe an SNS to an SQS, you can write something like

myTopic.addSubscription(new SqsSubscription(mySqs));

and expect the messages to reach SQS. But this is not happening. On further debugging, I found that the sqs:SendMessage permission is not granted to the SNS.

Expected Behavior

SNS should be granted the required permissions to send messages to SQS.

Current Behavior

Necessary permissions are not added to SNS or SQS

Reproduction Steps

mySqs = Queue.fromQueueArn(this, 'MyQ');
myTopic = new Topic(this, 'MyTopic');
myTopic.addSubscription(new SqsSubscription(mySqs));

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.123.0

Framework Version

No response

Node.js Version

v16.20.2

OS

Linux/UNIX

Language

TypeScript

Language Version

No response

Other information

Similar to #12120

Exter-dg commented 5 months ago

The workaround would be to add this policy manually in the SQS queue. But my SQS queue is being created in other stack. When I add a addToResourcePolicy to my imported SQS queue, cdk diff shows no changes.

Is this expected? Can we not update policy of existing CDK resources? - This seems to convey the same..

pahud commented 5 months ago

I think manual grant would be expected because addSubscription requires ITopicSubscription which could be an existing resource from the same or different account and CDK could not be able to access that.