How do I invoke a cross-account Amazon SNS topic with a CloudWatch alarm?

Resolution

Note: The following resolution uses two accounts.

Use account A to create the CloudWatch alarm and account B to create an Amazon SNS topic. Then, update the SNS topic's access policy to allow account A's alarm to publish messages.

Create an SNS topic in account B

Complete the following steps:

1. Open the Amazon SNS console.
2. In the navigation pane, choose Topics, and then choose Create topic.
3. Choose Standard for the topic type, and then provide a name for the topic.
4. Choose Create topic, and then copy the Amazon Resource Name (ARN) of the topic.
5. In the navigation pane, choose Subscriptions, and then choose Create subscription.
6. Add the topic's ARN in the Topic ARN section, and then choose Email as the protocol.
7. Choose Create subscription, and then check your email to confirm the subscription.

Create a CloudWatch alarm in account A

Complete the following steps:

1. Open the CloudWatch console.
2. In the navigation pane, choose Alarms, and then choose Create alarm.
3. Select your metric, and then provide details for the threshold and comparison parameters.
4. From Configure Actions, under Notifications, choose Use topic ARN to notify other accounts, and then enter the topic ARN from Account B.
5. Create a name for the alarm, and then choose Create alarm.

Update the access policy of the SNS topic in account B

When you update the access policy of the SNS topic in account B, this allow the alarm to publish messages.

Complete the following steps:

1. Open the SNS console.

2. In the navigation pane, choose Topics, and then select the topic.

3. Choose Edit, and then add the following statement to the policy:

   {
       "Statement": [{
           "Effect": "Allow",
           "Principal": {
               "Service": "cloudwatch.amazonaws.com"
           },
           "Action": "SNS:Publish",
           "Resource": "arn:aws:sns:us-east-2:444455556666:MyTopic",
           "Condition": {
               "ArnLike": {
                   "aws:SourceArn": "arn:aws:cloudwatch:us-east-2:111122223333:alarm:*"
               },
               "StringEquals": {
                   "aws:SourceAccount": "111122223333"
               }
           }
       }]
   }

   Note: In the preceding policy, replace example values with your values.

Test the alarm

To test the alarm, either change the alarm threshold based on the metric data points, or run the set-alarm-state command. When you change the alarm threshold or alarm state, you receive an email notification.

Related information

Allow any CloudWatch alarm to publish to a topic in a different account

Why didn't I receive an SNS notification for my CloudWatch alarm trigger?