sns access policy

we have created 3 sns topics using cdk through a loop in yml file we have defined topic details and through a stack we deploy these in a loop

policy used in stack is for topic_cfg in alarm_topics_config: if "topic_name" in topic_cfg: topic_name = topic_cfg["topic_name"] else: topic_name = f"{env_name}-{topic_cfg['topic_name_suffix']}"

        display_name = topic_cfg.get("display_name")

        topic_kwargs = {
            "name": topic_name,
            "enforce_ssl": True,
            "key": sns_managed_key,
        }
        if display_name:
            topic_kwargs["display_name"] = display_name

        topic = sns.Topic(
            self,
            f"{self.resource_prefix}{topic_cfg['id']}",
            **topic_kwargs,
        )

        sns.TopicPolicy(
            self,
            topic_cfg["policy_id"],
            topics=[topic],
            policy_document=iam.PolicyDocument(
                assign_sids=True,
                statements=[
                    iam.PolicyStatement(
                        actions=["sns:Publish"],
                        principals=[
                            iam.ServicePrincipal("cloudwatch.amazonaws.com")
                        ],
                        resources=[topic.topic_arn],
                        conditions={
                            "StringEquals": {
                                "AWS:SourceOwner": f"{self.account}"
                            }
                        },
                    )

out of 3 2 sns uses proper policy if "cloudwatch.amazonaws.com but 3rd sns uses "enforce_ssl": True and not cloudwatch.amazonaws.com which causes "CloudWatch Alarms is not authorized to perform: SNS:Publish on resource:arn

please suggest to debug this