Docs Home
AWS v6.78.0 published on Thursday, Apr 24, 2025 by Pulumi
aws.sns.TopicPolicy
Explore with Pulumi AI
Provides an SNS topic policy resource
NOTE: If a Principal is specified as just an AWS account ID rather than an ARN, AWS silently converts it to the ARN for the root user, causing future deployments to differ. To avoid this problem, just specify the full ARN, e.g.
arn:aws:iam::123456789012:root
Example Usage
import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";
const test = new aws.sns.Topic("test", {name: "my-topic-with-policy"});
const snsTopicPolicy = test.arn.apply(arn => aws.iam.getPolicyDocumentOutput({
policyId: "__default_policy_ID",
statements: [{
actions: [
"SNS:Subscribe",
"SNS:SetTopicAttributes",
"SNS:RemovePermission",
"SNS:Receive",
"SNS:Publish",
"SNS:ListSubscriptionsByTopic",
"SNS:GetTopicAttributes",
"SNS:DeleteTopic",
"SNS:AddPermission",
],
conditions: [{
test: "StringEquals",
variable: "AWS:SourceOwner",
values: [account_id],
}],
effect: "Allow",
principals: [{
type: "AWS",
identifiers: ["*"],
}],
resources: [arn],
sid: "__default_statement_ID",
}],
}));
const _default = new aws.sns.TopicPolicy("default", {
arn: test.arn,
policy: snsTopicPolicy.apply(snsTopicPolicy => snsTopicPolicy.json),
});
import pulumi
import pulumi_aws as aws
test = aws.sns.Topic("test", name="my-topic-with-policy")
sns_topic_policy = test.arn.apply(lambda arn: aws.iam.get_policy_document_output(policy_id="__default_policy_ID",
statements=[{
"actions": [
"SNS:Subscribe",
"SNS:SetTopicAttributes",
"SNS:RemovePermission",
"SNS:Receive",
"SNS:Publish",
"SNS:ListSubscriptionsByTopic",
"SNS:GetTopicAttributes",
"SNS:DeleteTopic",
"SNS:AddPermission",
],
"conditions": [{
"test": "StringEquals",
"variable": "AWS:SourceOwner",
"values": [account_id],
}],
"effect": "Allow",
"principals": [{
"type": "AWS",
"identifiers": ["*"],
}],
"resources": [arn],
"sid": "__default_statement_ID",
}]))
default = aws.sns.TopicPolicy("default",
arn=test.arn,
policy=sns_topic_policy.json)
package main
import (
"github.com/pulumi/pulumi-aws/sdk/v6/go/aws/iam"
"github.com/pulumi/pulumi-aws/sdk/v6/go/aws/sns"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
test, err := sns.NewTopic(ctx, "test", &sns.TopicArgs{
Name: pulumi.String("my-topic-with-policy"),
})
if err != nil {
return err
}
snsTopicPolicy := test.Arn.ApplyT(func(arn string) (iam.GetPolicyDocumentResult, error) {
return iam.GetPolicyDocumentResult(interface{}(iam.GetPolicyDocumentOutput(ctx, iam.GetPolicyDocumentOutputArgs{
PolicyId: "__default_policy_ID",
Statements: []iam.GetPolicyDocumentStatement{
{
Actions: []string{
"SNS:Subscribe",
"SNS:SetTopicAttributes",
"SNS:RemovePermission",
"SNS:Receive",
"SNS:Publish",
"SNS:ListSubscriptionsByTopic",
"SNS:GetTopicAttributes",
"SNS:DeleteTopic",
"SNS:AddPermission",
},
Conditions: []iam.GetPolicyDocumentStatementCondition{
{
Test: "StringEquals",
Variable: "AWS:SourceOwner",
Values: interface{}{
account_id,
},
},
},
Effect: "Allow",
Principals: []iam.GetPolicyDocumentStatementPrincipal{
{
Type: "AWS",
Identifiers: []string{
"*",
},
},
},
Resources: interface{}{
arn,
},
Sid: "__default_statement_ID",
},
},
}, nil))), nil
}).(iam.GetPolicyDocumentResultOutput)
_, err = sns.NewTopicPolicy(ctx, "default", &sns.TopicPolicyArgs{
Arn: test.Arn,
Policy: pulumi.String(snsTopicPolicy.ApplyT(func(snsTopicPolicy iam.GetPolicyDocumentResult) (*string, error) {
return &snsTopicPolicy.Json, nil
}).(pulumi.StringPtrOutput)),
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;
return await Deployment.RunAsync(() =>
{
var test = new Aws.Sns.Topic("test", new()
{
Name = "my-topic-with-policy",
});
var snsTopicPolicy = Aws.Iam.GetPolicyDocument.Invoke(new()
{
PolicyId = "__default_policy_ID",
Statements = new[]
{
new Aws.Iam.Inputs.GetPolicyDocumentStatementInputArgs
{
Actions = new[]
{
"SNS:Subscribe",
"SNS:SetTopicAttributes",
"SNS:RemovePermission",
"SNS:Receive",
"SNS:Publish",
"SNS:ListSubscriptionsByTopic",
"SNS:GetTopicAttributes",
"SNS:DeleteTopic",
"SNS:AddPermission",
},
Conditions = new[]
{
new Aws.Iam.Inputs.GetPolicyDocumentStatementConditionInputArgs
{
Test = "StringEquals",
Variable = "AWS:SourceOwner",
Values = new[]
{
account_id,
},
},
},
Effect = "Allow",
Principals = new[]
{
new Aws.Iam.Inputs.GetPolicyDocumentStatementPrincipalInputArgs
{
Type = "AWS",
Identifiers = new[]
{
"*",
},
},
},
Resources = new[]
{
test.Arn,
},
Sid = "__default_statement_ID",
},
},
});
var @default = new Aws.Sns.TopicPolicy("default", new()
{
Arn = test.Arn,
Policy = snsTopicPolicy.Apply(getPolicyDocumentResult => getPolicyDocumentResult.Json),
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.sns.Topic;
import com.pulumi.aws.sns.TopicArgs;
import com.pulumi.aws.iam.IamFunctions;
import com.pulumi.aws.iam.inputs.GetPolicyDocumentArgs;
import com.pulumi.aws.sns.TopicPolicy;
import com.pulumi.aws.sns.TopicPolicyArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var test = new Topic("test", TopicArgs.builder()
.name("my-topic-with-policy")
.build());
final var snsTopicPolicy = test.arn().applyValue(_arn -> IamFunctions.getPolicyDocument(GetPolicyDocumentArgs.builder()
.policyId("__default_policy_ID")
.statements(GetPolicyDocumentStatementArgs.builder()
.actions(
"SNS:Subscribe",
"SNS:SetTopicAttributes",
"SNS:RemovePermission",
"SNS:Receive",
"SNS:Publish",
"SNS:ListSubscriptionsByTopic",
"SNS:GetTopicAttributes",
"SNS:DeleteTopic",
"SNS:AddPermission")
.conditions(GetPolicyDocumentStatementConditionArgs.builder()
.test("StringEquals")
.variable("AWS:SourceOwner")
.values(account_id)
.build())
.effect("Allow")
.principals(GetPolicyDocumentStatementPrincipalArgs.builder()
.type("AWS")
.identifiers("*")
.build())
.resources(_arn)
.sid("__default_statement_ID")
.build())
.build()));
var default_ = new TopicPolicy("default", TopicPolicyArgs.builder()
.arn(test.arn())
.policy(snsTopicPolicy.applyValue(_snsTopicPolicy -> _snsTopicPolicy.json()))
.build());
}
}
resources:
test:
type: aws:sns:Topic
properties:
name: my-topic-with-policy
default:
type: aws:sns:TopicPolicy
properties:
arn: ${test.arn}
policy: ${snsTopicPolicy.json}
variables:
snsTopicPolicy:
fn::invoke:
function: aws:iam:getPolicyDocument
arguments:
policyId: __default_policy_ID
statements:
- actions:
- SNS:Subscribe
- SNS:SetTopicAttributes
- SNS:RemovePermission
- SNS:Receive
- SNS:Publish
- SNS:ListSubscriptionsByTopic
- SNS:GetTopicAttributes
- SNS:DeleteTopic
- SNS:AddPermission
conditions:
- test: StringEquals
variable: AWS:SourceOwner
values:
- ${["account-id"]}
effect: Allow
principals:
- type: AWS
identifiers:
- '*'
resources:
- ${test.arn}
sid: __default_statement_ID
Create TopicPolicy Resource
Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.
Constructor syntax
new TopicPolicy(name: string, args: TopicPolicyArgs, opts?: CustomResourceOptions);@overload
def TopicPolicy(resource_name: str,
args: TopicPolicyArgs,
opts: Optional[ResourceOptions] = None)
@overload
def TopicPolicy(resource_name: str,
opts: Optional[ResourceOptions] = None,
arn: Optional[str] = None,
policy: Optional[str] = None)func NewTopicPolicy(ctx *Context, name string, args TopicPolicyArgs, opts ...ResourceOption) (*TopicPolicy, error)public TopicPolicy(string name, TopicPolicyArgs args, CustomResourceOptions? opts = null)public TopicPolicy(String name, TopicPolicyArgs args)
public TopicPolicy(String name, TopicPolicyArgs args, CustomResourceOptions options)
type: aws:sns:TopicPolicy
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.
Parameters
- name
This property is required. string - The unique name of the resource.
- args
This property is required. TopicPolicyArgs - The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- resource_name
This property is required. str - The unique name of the resource.
- args
This property is required. TopicPolicyArgs - The arguments to resource properties.
- opts ResourceOptions
- Bag of options to control resource's behavior.
- ctx Context
- Context object for the current deployment.
- name
This property is required. string - The unique name of the resource.
- args
This property is required. TopicPolicyArgs - The arguments to resource properties.
- opts ResourceOption
- Bag of options to control resource's behavior.
- name
This property is required. string - The unique name of the resource.
- args
This property is required. TopicPolicyArgs - The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- name
This property is required. String - The unique name of the resource.
- args
This property is required. TopicPolicyArgs - The arguments to resource properties.
- options CustomResourceOptions
- Bag of options to control resource's behavior.
Constructor example
The following reference example uses placeholder values for all input properties.
var topicPolicyResource = new Aws.Sns.TopicPolicy("topicPolicyResource", new()
{
Arn = "string",
Policy = "string",
});
example, err := sns.NewTopicPolicy(ctx, "topicPolicyResource", &sns.TopicPolicyArgs{
Arn: pulumi.String("string"),
Policy: pulumi.Any("string"),
})
var topicPolicyResource = new TopicPolicy("topicPolicyResource", TopicPolicyArgs.builder()
.arn("string")
.policy("string")
.build());
topic_policy_resource = aws.sns.TopicPolicy("topicPolicyResource",
arn="string",
policy="string")
const topicPolicyResource = new aws.sns.TopicPolicy("topicPolicyResource", {
arn: "string",
policy: "string",
});
type: aws:sns:TopicPolicy
properties:
arn: string
policy: string
TopicPolicy Resource Properties
To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.
Inputs
In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.
The TopicPolicy resource accepts the following input properties:
Outputs
All input properties are implicitly available as output properties. Additionally, the TopicPolicy resource produces the following output properties:
Look up Existing TopicPolicy Resource
Get an existing TopicPolicy resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.
public static get(name: string, id: Input<ID>, state?: TopicPolicyState, opts?: CustomResourceOptions): TopicPolicy@staticmethod
def get(resource_name: str,
id: str,
opts: Optional[ResourceOptions] = None,
arn: Optional[str] = None,
owner: Optional[str] = None,
policy: Optional[str] = None) -> TopicPolicyfunc GetTopicPolicy(ctx *Context, name string, id IDInput, state *TopicPolicyState, opts ...ResourceOption) (*TopicPolicy, error)public static TopicPolicy Get(string name, Input<string> id, TopicPolicyState? state, CustomResourceOptions? opts = null)public static TopicPolicy get(String name, Output<String> id, TopicPolicyState state, CustomResourceOptions options)resources: _: type: aws:sns:TopicPolicy get: id: ${id}- name
This property is required. - The unique name of the resulting resource.
- id
This property is required. - The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- resource_name
This property is required. - The unique name of the resulting resource.
- id
This property is required. - The unique provider ID of the resource to lookup.
- name
This property is required. - The unique name of the resulting resource.
- id
This property is required. - The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
This property is required. - The unique name of the resulting resource.
- id
This property is required. - The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
This property is required. - The unique name of the resulting resource.
- id
This property is required. - The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
The following state arguments are supported:
Import
Using pulumi import, import SNS Topic Policy using the topic ARN. For example:
$ pulumi import aws:sns/topicPolicy:TopicPolicy user_updates arn:aws:sns:us-west-2:123456789012:my-topic
To learn more about importing existing cloud resources, see Importing resources.
Package Details
- Repository
- AWS Classic pulumi/pulumi-aws
- License
- Apache-2.0
- Notes
- This Pulumi package is based on the
awsTerraform Provider.