CODEWITHSUNDEEP
amazon-web-servicesaws-lambdaamazon-iamamazon-sns
Krisna
Krisna

Reputation: 3423

Aws Lambda is not authorized to perform: SNS:Publish on resource: +358

I have made Cognito PostConfirmation lambda function. When user will successfully signup then I want to send them SMS. For that I am using AWS-SNS. I have created one Sns Topic and attached to my PostConfirmation lambda function. I gave permission to the lambda for Sns publishing. In cloudwatch it says, That lambda does not have authorize to perform this Sns publishing.

I am getting this error in cloudwatch:

PostConfirmation is not authorized to perform: SNS:Publish on resource: +358.... because no identity-based policy allows the SNS:Publish action

I am not sure what I am missing.

This is my YAML file:

  plugins:
    - serverless-webpack
    - serverless-offline
    - serverless-plugin-warmup
    - serverless-iam-roles-per-function
  ## post Confirmation
  PostConfirmation:
    handler: src/handlers/postConfirmation.postConfirmation
    events:
      - cognitoUserPool:
          pool: ${self:provider.environment.COGNITO}
          trigger: PostConfirmation
          existing: true
    iamRoleStatements:
      - Effect: Allow
        Action:
          - cognito-idp:*
        Resource: arn:aws:cognito-idp:*:*:*
      - Effect: Allow
        Action:
          - dynamodb:PutItem
          - lambda:InvokeFunction # Added this like mentioned above
        Resource: 'arn:aws:dynamodb:${opt:region, self:provider.region}:*:table/${self:provider.environment.ITEM_TABLE}'
      - Effect: Allow
        Action:
          - sns:Publish ## This is where I am giving my permisson 
          - sns:SetSMSAttributes
        Resource: !Ref SendMessageSns ## Sns Topic

resources:
  Resources:
    SendMessageSns:
      Type: AWS::SNS::Topic
      Properties:
        DisplayName: It will send sms when user successfully signUp
        TopicName: ${self:service}-${opt:stage, self:provider.stage}-successful

This is how I am trying to publishing the message

import { SNS } from '@aws-sdk/client-sns';
const snsClient = new SNS({ region: 'eu-north-1' });
exports.postConfirmation = async (event: any, context: any) => {

  const messageParams = {
    Message:
      'congrats it works',
    PhoneNumber: '+358.......',
  };

  try {
    console.log('1');
    const snsSucess = await snsClient.publish(messageParams);
    console.log('Success.', snsSucess);
    console.log('2');
    context.done(null, event);
  } catch (error) {
    console.log('error', { error });
    return {
      statusCode: 500,
      body: JSON.stringify(error),
    };
  }
};

Upvotes: 1

Views: 3488

Answers (1)

Milan Gatyás
Milan Gatyás

Reputation: 2787

You allowed publish to the SNS topic, but are trying to send the SMS directly to the phone number. When publishing to the SNS topic you need to publish message to the topic and subscribe the phone number to the topic, see https://docs.aws.amazon.com/sns/latest/dg/sms_publish-to-topic.html

Alternatively you can publish directly to phone number, but you'd need to modify the IAM policy and also possibly move outside of SMS sandbox - https://docs.aws.amazon.com/sns/latest/dg/sms_publish-to-phone.html

Upvotes: 1

Related Questions