amazon web services - What's the correct terraform syntax to allow an external AWS role to subscribe and read from AWS SNS topic?

Question

I want to create a policy so a specific aws role (not in the same account) let's say arn:aws:iam::123123123123:role/sns-read-role can subscribe and receive messages from my SNS topic in AWS.

From the official terraform docs about aws_sns_topic_policy example it would be

resource "aws_sns_topic" "test" {
  name = "my-topic-with-policy"
}

resource "aws_sns_topic_policy" "default" {
  arn = aws_sns_topic.test.arn
  policy = data.aws_iam_policy_document.sns_topic_policy.json
}

data "aws_iam_policy_document" "sns_topic_policy" {

  statement {
    actions = [
      "SNS:Subscribe",
      "SNS:Receive"
    ]

    condition {
      test     = "StringEquals"
      variable = "AWS:SourceOwner"
      values = [
        123123123123
      ]
    }

    effect = "Allow"

    principals {
      type        = "AWS"
      identifiers = ["*"]
    }

    resources = [
      aws_sns_topic.test.arn
    ]
  }
}

But this would translate to arn:aws:iam::123123123123:root and filter only on account-id.

From AWS JSON policy elements: Principal I understand the AWS syntax is

"Principal": { "AWS": "arn:aws:iam::AWS-account-ID:role/role-name" }

Adding the role in the condition like this

condition {
    test     = "StringEquals"
    variable = "AWS:SourceOwner"

    values = [
        arn:aws:iam::123123123123:role/sns-read-role
    ]
}

does not work.

It would make sense to add the role to the principal like this

principals {
    type        = "AWS"
    identifiers = ["arn:aws:iam::123123123123:role/sns-read-role"]
}

When I try to subscribe, I get an AuthorizationError: "Couldn't subscribe to topic..."

Do I need the condition together with the principal? Why even bother with the condition if you can use the principal in the first place?

question from:https://stackoverflow.com/questions/65937815/whats-the-correct-terraform-syntax-to-allow-an-external-aws-role-to-subscribe-a

Answer 1

After some experimenting, I found that I don't need the condition. This works for me:

resource "aws_sns_topic" "test" {
  name = "my-topic-with-policy"
}

resource "aws_sns_topic_policy" "default" {
  arn = aws_sns_topic.test.arn
  policy = data.aws_iam_policy_document.sns_topic_policy.json
}

data "aws_iam_policy_document" "sns_topic_policy" {

  statement {
    actions = [
      "SNS:Subscribe",
      "SNS:Receive"
    ]

    effect = "Allow"

    principals {
      type        = "AWS"
      identifiers = [
        "arn:aws:iam::123123123123:role/sns-read-role"
      ]
    }

    resources = [
      aws_sns_topic.test.arn
    ]
  }
}

In case you want to use parameters for your module:

principals {
    type = "AWS"
    identifiers = [
      "${var.account_arn}:role/${var.role}"
    ]
}