How do I recreate a deleted Amazon SNS topic subscription for an Amazon SQS queue in another account?

Short description

If you call the Amazon SNS Unsubscribe API from an account that doesn't own the subscription, then the subscription enters the Deleted status for 72 hours. When the SNS topic subscription has the Deleted status, the account that owns the subscription can't resubscribe the same endpoint to the topic.

After 72 hours, Amazon SNS clears the Deleted subscription and the account that owns the subscription can resubscribe the same endpoint to the topic.

When you delete an SNS topic subscription for an SQS queue in another account, Amazon SNS sends an UnsubscribeConfirmation message to the SQS queue. Use the information in the UnsubscribeConfirmation message to recreate the subscription.

To recreate the subscription in less than 72 hours, use one of the following methods.

Note: It's a best practice to run the Subscribe and Unsubscribe API calls from the same account. When you call the Subscribe API, the account that you use to make the call becomes the subscription owner.

Important: The following methods also apply to HTTP and HTTPS endpoint subscribers. The methods don't apply to AWS Lambda function subscribers.

Resolution

Note: If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, then see Troubleshooting errors for the AWS CLI. Also, make sure that you're using the most recent AWS CLI version.

Send an HTTP GET request to the SubscribeURL

To use SubscribeURL to recreate the subscription, complete the following steps:

1. Review the UnsubscribeConfirmation message from your SQS queue. If the message isn't in the main queue, then check the dead-letter queue (DLQ).
   Note: A consumer for the SQS queue such as a Lambda function might consume and delete the message. If this occurs, then recover the message from the consumer logs. If the Lambda function code prints the event record, then check the logs in Amazon CloudWatch Logs. You can also check the consumer application logs. If no logs exist from the consumer side, then you can't recreate the subscription with this method. Contact AWS Support or wait 72 hours for the Deleted status to clear.
2. Copy the SubscribeURL from the message body.
3. To send an HTTP GET request to the SubscribeURL and restore the subscription, run the following command in AWS CloudShell:

   curl -X GET "https://sns.us-west-2.amazonaws.com/?Action=ConfirmSubscription&TopicArn=arn:aws:sns:us-west-2:123456789012:MyTopic&Token=token"

   Note: Replace the URL with the SubscribeURL from your UnsubscribeConfirmation message.

Call the Amazon SNS ConfirmSubscription API

To use the AWS CLI to recreate the subscription, complete the following steps:

1. Review the UnsubscribeConfirmation message from your SQS queue.
2. Copy the Token value from the message body.
3. To confirm the subscription, run the following confirm-subscription AWS CLI command from the AWS account that owns the SNS topic:

   aws sns confirm-subscription \
     --topic-arn arn:aws:sns:REGION:ACCOUNT-ID:TOPIC-NAME \
     --token TOKEN-VALUE \
     --authenticate-on-unsubscribe true

   Note: Replace REGION with your Region, ACCOUNT-ID with the account ID that owns the SNS topic, TOPIC-NAME with the name of your SNS topic. Also, replace TOKEN-VALUE with your token value.

The --authenticate-on-unsubscribe true parameter allows only the topic owner and subscription owner to unsubscribe. All other subscribers who choose the unsubscribe link receive the following error:

"Your subscription could not be removed because of an error. If you wish to unsubscribe but do not have AWS credentials, or have any other questions about Amazon SNS, please contact Amazon at sns-question@amazon.com."

Use the SubscribeURL in a web browser

To use a web browser to recreate the subscription, complete the following steps:

1. Review the UnsubscribeConfirmation message from your SQS queue.
2. Copy the SubscribeURL from the message body.
3. Open a new browser tab and paste the SubscribeURL into the address bar.
4. To navigate to the URL, press Enter. The subscription moves to the Confirmed state.

Prevent future subscription issues

Take the following actions:

• Verify that the SQS queue policy allows the SNS topic to send messages to the queue. For more information, see Basic examples of Amazon SQS policies.
• Archive UnsubscribeConfirmation messages before your application consumes and deletes them.
• Use AWS Identity and Access Management (IAM) policies to restrict which users and roles can call the Unsubscribe API.

Related information

Deleting an Amazon SNS topic and subscription

Sending Amazon SNS messages to an Amazon SQS queue in a different account

Fanout Amazon SNS notifications to Amazon SQS queues for asynchronous processing

ConfirmSubscription

HTTP/HTTPS unsubscribe confirmation JSON format