Publish from lambda function in KMS encrypted SNS

Question

I am trying to publish from a Python 3.8 Lambda function into a KMS encrypted SNS topic. The code of my lambda is:

import os
import boto3

sns = boto3.client('sns')


def handler(event, context):
    message = 'Hello world'

    response = sns.publish(
        TopicArn='<My topic ARN>',
        Message=message,
    )

If the SNS is not encrypted the code works perfectly...

... but when I encrypt the SNS topic through the following option:

I get the following error when the lambda is executed:

{ "errorMessage": "An error occurred (KMSNotFound) when calling the Publish operation: Invalid keyId aws/sns (Service: AWSKMS; Status Code: 400; Error Code: NotFoundException; Request ID: d81234100-9cb4-4af2-0032-c4a568a955f4)", "errorType": "KMSNotFoundException", "stackTrace": [ " File \"/var/task/lambda.py\", line 10, in handler\n boto3.client('sns').publish(\n", " File \"/var/runtime/botocore/client.py\", line 316, in _api_call\n return self._make_api_call(operation_name, kwargs)\n", " File \"/var/runtime/botocore/client.py\", line 626, in _make_api_call\n raise error_class(parsed_response, operation_name)\n" ] }

What I am missing in my code?

Arcones · Accepted Answer · 2020-04-12 12:08:54Z

9

AWS support kindly pointed my out that I was missing KMS permissions in my lambda execution role.

Lambda function execution role must have the following to be able to publish in the SNS encrypted topic:

{
  "Version": "2012-10-17",
  "Statement": {
    "Effect": "Allow",
    "Action": [
      "kms:GenerateDataKey",
      "kms:Decrypt"
    ],
    "Resource": "<the-key-with-which-the-topic-is-encrypted>"
  }
}

answered Apr 12, 2020 at 12:08

Arcones

4,8328 gold badges29 silver badges52 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

marcin2x4 Over a year ago

Where did you post that part of code in entire script?

Arcones Over a year ago

hi @marcin2x4, I don't fully get your question, the code is the same as in the question but only the role policy has to be changed (so this JSON should not be in the python but in AWS policy definition itself)

user3608245 Over a year ago

aws.amazon.com/blogs/compute/…

Collectives™ on Stack Overflow

Publish from lambda function in KMS encrypted SNS

1 Answer 1

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related