CODEWITHSUNDEEP
amazon-s3amazon-snsterraform
Bond
Bond

Reputation: 955

Error putting S3 notification configuration error

I am having trouble trying to create s3 event notifications. Does anyone know the resolutions to this?

Error is:

*Error applying plan:
1 error(s) occurred:
* module.Test-S3-Bucket.aws_s3_bucket_notification.s3-notification: 1 error(s) occurred:
* aws_s3_bucket_notification.s3-notification: Error putting S3 notification configuration: InvalidArgument: Unable to validate the following destination configurations
status code: 400, request id: AD9B5BF2FF84A6CB, host id: ShUVJ+TdkpqAZfpeDM3grkF9Vue3Q/AF0LydchperKTF6XdQyDM6BisZi/38pGAh/ZqS+gNyrSM=*

Below is the code that gives me the error:

resource "aws_s3_bucket" "s3-bucket" {
  bucket = "${var.bucket_name}"
  acl    = ""

  lifecycle_rule {
    enabled = true
    prefix  = ""

    expiration {
      days = 45
    }
  }

  tags {
    CostC = "${var.tag}"
  }
}


resource "aws_s3_bucket_notification" "s3-notification" {

  bucket = "${var.bucket_name}"

  topic {
    topic_arn     = "arn:aws:sns:us-east-1:1223445555:Test"
    events        = [ "s3:ObjectCreated:*", "s3:ObjectRemoved:*" ]
    filter_prefix = "test1/"
  }
}

Upvotes: 2

Views: 12543

Answers (3)

morten
morten

Reputation: 1

Adding following permissions to account used by Terraform solves the issue:

s3:GetBucketNotification

s3:PutBucketNotification

Upvotes: 0

Viktor Husiev
Viktor Husiev

Reputation: 95

Well, I know that this is not your exact case, but I had the same error and I didn't manage to find an answer here, and because this post is the first that Google gave me, I will leave the answer to my case here in the hope that it will help someone else.

So, I notice that after Terraform apply I had this error and I went to the UI to see what happened and found this message:

The Lambda console can't validate one or more event sources for this trigger. The most common cause is when a source ARN includes a wildcard (*) character. You can manage unvalidated triggers using the AWS CLI or AWS SDK.

And guess what? I really had a wildcard (*) character in ARN like this:

source_arn = "{aws_s3_bucket.bucket.arn}/*"

So I changed it to:

source_arn = aws_s3_bucket.bucket.arn

And it worked. So, if you read this - there might be the same mistake in your case.

Upvotes: 4

Tom Bunting
Tom Bunting

Reputation: 1875

If you haven't done it already, you need to specify a policy on the topic that grants the SNS:Publish permission to S3 (only from the bucket specified in the Condition attribute) - if you are also provisioning the topic via Terraform then something like this should do it (we know, as it caught us out just a few days ago too!):

resource "aws_sns_topic" "my-sns-topic" {
    name = "Test"
    policy = <<POLICY
{
    "Version":"2012-10-17",
    "Statement":[{
        "Effect": "Allow",
        "Principal": {
            "Service": "s3.amazonaws.com"
            },
        "Action": "SNS:Publish",
        "Resource": "arn:aws:sns:us-east-1:1223445555:Test",
        "Condition":{
            "ArnLike":{"aws:SourceArn":"${aws_s3_bucket.s3-bucket.arn}"}
        }
    }]
}
POLICY
}

Hope that helps.

Upvotes: 5

Related Questions