How do I prevent mailing list recipients from unsubscribing everyone from my Amazon SNS topic emails?

Short description

When you publish messages to an Amazon SNS topic with email subscribers, the email message that the subscribers receive has a link to unsubscribe. A message near the link reads: "If you wish to stop receiving notifications from this topic, please click or visit the link below to unsubscribe."

If you choose the link when you subscribe to an Amazon SNS topic with your email address, then you unsubscribe your email address. If a member of an Amazon SNS topic mailing list chooses the unsubscribe link, then they unsubscribe the email address of the mailing list. Then, everyone on the mailing list gets an "Unsubscribe Confirmation" message.

Note: Email spam filters can unsubscribe the email address of the mailing list.

To prevent the unsubscribe action, create a subscription that requires authentication to unsubscribe. This allows only the topic owner and subscription owner to unsubscribe. All other subscribers who choose the link receive the following error:

"Your subscription could not be removed because of an error. If you wish to unsubscribe but do not have AWS credentials, or have any other questions about Amazon SNS, please contact Amazon at sns-question@amazon.com."

Resolution

To replace an existing subscription with a subscription that requires authentication, unsubscribe the existing subscription. Then, use either of the following methods to set up the new subscription.

Important: You must have access to the subscription confirmation email message to confirm a new subscription and complete setup. If you subscribe a mailing list to your topic, then add your email address to the mailing list first to confirm the subscription.

(Amazon SNS console) Set up an email subscription that requires authentication to unsubscribe

1. Open the Amazon SNS console, and then subscribe your email address to your topic.
2. In your email, find the subscription confirmation message from AWS Notifications. The sender is usually "no-reply@sns.amazonaws.com".
   Important: Don't use the link in the subscription confirmation email to confirm the subscription.
3. Copy the URL from the Confirm subscription link.
4. In the navigation pane of the console, choose Subscriptions.
5. On the Subscriptions page, select the subscription that's "Pending confirmation," and then choose Confirm subscription.
6. In the Confirm subscription dialog box, paste the subscription confirmation URL that you copied.
7. Choose Confirm subscription.

(AWS CLI) Set up an email subscription that requires authentication to unsubscribe

Note: If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, then see Troubleshooting errors for the AWS CLI. Also, make sure that you're using the most recent AWS CLI version.

1. To get a list of the Amazon SNS topics, run the following list-topics command:

   sns list-topics --region us-east-1

   Important: Replace region us-east-1 with the AWS Region for your topic.
2. In the output, copy the TopicArn value of the topic that you want to subscribe to. The topic Amazon Resource Name (ARN) looks similar to the following example: arn:aws:sns:us-east-1:0123456789012:my-topic
3. To subscribe and endpoint to an Amazon SNS topic, run the following subscribe command:

   sns subscribe --topic-arn arn:aws:sns:us-east-1:0123456789012:my-topic --protocol email --notification-endpoint test@amazon.com --region us-east-1
   

   Important: Replace topic-arn with the topic ARN that you copied. Replace notification-endpoint with the email address that you want to subscribe to your topic. Replace region with your topic's Region.
4. In your email, find the subscription confirmation message from AWS Notifications. The sender is usually "no-reply@sns.amazonaws.com".
   Important: Don't use the link in the subscription confirmation email to confirm the subscription.
5. Copy the URL from the Confirm subscription link, paste the URL into a text editor, and then copy the token. The token is a long series of numbers and letters in the middle of the URL after "Token=" and before "&Endpoint=". It looks similar to this example:
   https://sns.us-east-1.amazonaws.com/confirmation.html?TopicArn=arn:aws:sns:us-east-1:123456789012:my-topic&Token=2336412f37fb687f5d51e6e241da92fcfd03593fd8dfa4bd75978a2ad7255afb88e71028f6a034d06f469f6c7ef2
   0a609348542a0c68a9561c03a39d59beb02e2b7112c45f7ae26c344819b39cf07f15bef6c6c09766f9caa1fa55c236e7
   7c33a50870bc027c74640ff64a7e99a67117&Endpoint=test@amazon.com
6. To verify the subscription token, run the following confirm-subscription command:

   sns confirm-subscription --token 2336412f37fb687f5d51e6e241da92fcfd03593fd8dfa4bd75978a2ad7255afb88e71028f6a034d06f469f6c7ef20a609348542a0c68a9561c03a39d59beb02e2b7112c45f7ae26c344819b39cf07f15bef6c6c09766f9caa1fa55c236e77c33a50870bc027c74640ff64a7e99a67117 --topic-arn arn:aws:sns:us-east-1:0123456789012:my-topic --authenticate-on-unsubscribe true --region us-east-1

   Important: Replace token with the token that you copied. Replace topic-arn with the topic ARN that you copied. Replace region with your topic's Region.