Why didn't my encrypted SNS topic receive a notification from an AWS service?

Resolution

Confirm that the SNS topic policy grants the AWS service permissions

Make sure that the SNS topic policy grants the AWS service the required permissions to publish messages to the SNS topic similar to the following:

{
"Sid": "My-statement-id",
"Effect": "Allow",
"Principal": {
"Service": "aws-service.amazonaws.com"
},
"Action": "SNS:Publish",
"Resource": "arn:aws:sns:us-east-1:111111111111:exampletopic"
}

Note: Replace aws-service with the service principal relevant to you. For a list of service principals, see the compatibility between encrypted topics and event sources section in Encrypting messages published to Amazon SNS with AWS KMS.

For information, see Example cases for Amazon SNS access control.

Confirm that the encryption has the required AWS KMS permissions

Confirm that the encryption key used by the encrypted topic has the required AWS Key Management (AWS KMS) permissions. After you create the AWS KMS key, make sure that there's compatibility between event sources from services and the encrypted topics.

Note: The Amazon SNS topic must use an AWS KMS customer managed key instead of the default key (AWS/SNS). This is because the default key policy doesn't include the required permissions for the AWS service to perform AWS KMS operations. You also can't modify the policy of the default key.

Troubleshoot further

If the SNS topic still didn't receive a notification, then complete the following these steps:

1. Check the Amazon SNS metric NumberOfMessagePublished. This metric shows whether the service is publishing the event to the SNS topic. If the metric doesn't populate, then there's an issue with the service to Amazon SNS configuration. Refer to the previous sections to address permission issues.
2. If the NumberOfMessagePublished metric shows data, then check the NumberOfNotificationsDelivered and NumberOfNotificationsFailed metrics. These metrics show whether the subscribing endpoints are successfully receiving messages from your Amazon SNS topic.
3. Turn on the Amazon SNS topic delivery status logs to further troubleshoot message delivery issues.

Related information

Why didn't I receive an SNS notification for my Amazon CloudWatch alarm trigger?

Why aren't messages that I publish to my Amazon SNS topic getting delivered to my subscribed Amazon SQS queue that has server-side encryption activated?