Restricting Origination Ids to IAM roles

Question

Hi Team,
I want to utilize SNS to send transactional SMS messages to customers in multiple countries, specifically for OTPs and important notifications.
I understand that I need to provision multiple origination Identities, one set for OTP use-case and another set for notifications.

Is it possible to restrict certain Origination Ids (Created for OTP use case) to be seen only to a specific IAM role. Lets say the role is for Cognito and SNS integration.
And, other origination Ids to be seen only to other IAM Role used by my web-application backend to send important notifications via SMS utilizing SNS .

Answer

yes it is possible.
You can define IAM policies that allow or deny access to SNS origination identities based on various conditions, including the identity itself, the action being performed, and the IAM role or user attempting the action.
Here's an example of how you can restrict access to specific origination identities for different IAM roles:

Define an IAM policy that allows access to specific origination identities for the IAM role used by your Cognito and SNS integration

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "sns:Publish",
            "Resource": "arn:aws:sns:REGION:ACCOUNT_ID:ORIGINATION_ID_1",
            "Condition": {
                "StringEquals": {
                    "aws:SourceArn": "arn:aws:iam::ACCOUNT_ID:role/CognitoRole"
                }
            }
        }
    ]
}

```
Define another IAM policy that allows access to different origination identities for the IAM role used by your web application backend:

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "sns:Publish",
            "Resource": "arn:aws:sns:REGION:ACCOUNT_ID:ORIGINATION_ID_2",
            "Condition": {
                "StringEquals": {
                    "aws:SourceArn": "arn:aws:iam::ACCOUNT_ID:role/WebAppRole"
                }
            }
        }
    ]
}
```

Replace REGION, ACCOUNT_ID, ORIGINATION_ID_1, ORIGINATION_ID_2, CognitoRole, and WebAppRole with the appropriate values for your environment.

With these IAM policies in place, the IAM role associated with your Cognito integration will only be able to publish messages using the specified origination identity, 
and the IAM role associated with your web application backend will only be able to publish messages using the other specified origination identity.

Restricting Origination Ids to IAM roles

Relevant content