Manage Notification Policies for Amazon SNS

Allow Eon to publish to the SNS topic

In your AWS account, Eon needs permissions to publish messages to the SNS topic you want to send notifications to.

To give the necessary permissions, append the highlighted object to the Statement array in the topic’s access policy, as shown in the following code block. Replace {SNS_TOPIC_ARN} with the topic’s ARN:

{
  "Statement": [
    {
      "Sid": "Allow Eon to publish to the SNS topic",
      "Effect": "Allow",
      "Principal": {
        "AWS": [
          "arn:aws:iam::058264520728:root",
          "arn:aws:iam::010438478826:root"
        ]
      },
      "Action": "SNS:Publish",
      "Resource": "{SNS_TOPIC_ARN}"
    }
  ]
}

If encrypted: Allow Eon to use the KMS key

If your SNS topic is encrypted, Eon needs to be able to use the KMS key to encrypt the message contents.

To do this, append the highlighted object to the Statement array in the topic’s key policy, as shown in the following code block. Replace {KMS_KEY_ARN} with the key’s ARN:

{
  "Statement": [
    {
      "Sid": "Allow Eon to publish to encrypted SNS topics with this key",
      "Effect": "Allow",
      "Principal": {
        "AWS": [
          "arn:aws:iam::058264520728:root",
          "arn:aws:iam::010438478826:root"
        ]
      },
      "Action": [
        "kms:GenerateDataKey*",
        "kms:Encrypt",
        "kms:Decrypt"
      ],
      "Resource": "{KMS_KEY_ARN}"
    }
  ]
}

As in the previous step, this policy allows Eon’s control plane and disaster recovery accounts to use the KMS key to encrypt and decrypt messages published to the SNS topic.

Create the notification policy in Eon

1. In your project’s Notification Policies page in the Eon console, click Create Notification Policy. The Create a Notification Policy wizard opens.

2. Enter a Notification policy name that describes the SNS topic notifications will be sent to.

3. Choose the Amazon SNS notification channel type, then click Next.

4. Enter the Topic ARN of the SNS topic you want to send notifications to.

5. Click Next to continue.

Choose the notifications to send

1. Pick the events you want to subscribe the SNS topic to.

2. Optionally, set event conditions to filter which events trigger notifications:

   To filter notifications to specific events, turn Apply event conditions on. With conditions turned on, you’ll receive notifications only for events that match the conditions you set.

   To leave Apply event conditions off, you’ll receive notifications for all events of the selected types.

   When you turn Apply event conditions on, click Set Condition to choose the event properties you want to filter by. You can filter by vaults, backup policies, resources, or source accounts.

   You can set a simple AND or OR list of conditions, or you can group conditions for fine-tuned event filtering.

   See how to work with conditions and groups

   Work with conditions

   • To add a condition: Click (Add condition), then select the property, operator, and value for the condition.

   • To add a condition within a group: Click the large (Add condition) button in the group, or select (Add condition) > Add condition > Above or Below. Then select the property, operator, and value for the condition.

   • To delete a condition: Click the condition’s (Actions) menu, then click Delete condition.

   For each condition, set the property, operator, and value.

   Work with groups

   • To nest an existing condition or group in a group: In an existing condition or group, click (Actions) > Create group. Select the group’s logical AND or OR operator.

   • To delete a group and all the conditions it contains: Click the group’s (Actions) menu, then click Delete group.

3. When you’re done, click Test and Create.

Test

Trigger one of the subscribed events to send a test notification to the SNS topic.

If everything is set up correctly, you’ll receive a notification at the SNS subscriber endpoints.

If you don’t receive the notification, check the SNS topic’s access policy and the SNS subscriber status.