Module: sns_topic_policy

Attaches access policies to SNS topics created by the SNS Topics & Subscriptions module. Its primary use is letting AWS services publish to a topic — EventBridge delivers to SNS targets via the topic's resource policy, not a target role_arn, so any topic used as an EventBridge target needs an entry here.

Input Map Key Pattern

Root variable: sns_topic_policy (map of objects).

Field	Type	Required	Description
topic	string	yes	Key into the topics map; resolved to the topic ARN inside the module.
allow_service_publish	list(string)	optional	AWS service principals granted SNS:Publish (e.g. ["events.amazonaws.com"]), scoped to this account via AWS:SourceAccount.

Behavior

• Every policy includes an AllowOwnerFullControl statement replicating the default owner permissions SNS grants when a topic has no explicit policy (scoped by AWS:SourceOwner), so attaching a policy never locks the account out of its own topic.
• When allow_service_publish is non-empty, an AllowServicePublish statement grants those service principals SNS:Publish, conditioned on AWS:SourceAccount matching the current account.

EventBridge SNS targets do not use a role

Unlike Lambda or SSM automation targets, EventBridge cannot assume a role to publish to SNS — authorization comes solely from the topic policy. An eb_targets entry pointing at a topic should omit role_arn, and the topic must allow events.amazonaws.com here or deliveries fail silently.

Example

sns_topic_policy = {
  patching-windows-topic-policy = {
    topic                 = "patching-windows-sns-topic"
    allow_service_publish = ["events.amazonaws.com"]
  }
  su-deploy-topic-policy = {
    topic                 = "su-deploy-sns-topic"
    allow_service_publish = ["events.amazonaws.com"]
  }
}