serverless-iam-roles-per-function icon indicating copy to clipboard operation
serverless-iam-roles-per-function copied to clipboard

Aws Lambda is not authorized to perform: SNS:Publish on resource: +358

Open alakdam07 opened this issue 2 years ago • 0 comments

I have made Cognito PostConfirmation lambda function. When user will successfully signup then I want to send them SMS. For that I am using AWS-SNS. I have created one Sns Topic and attached to my PostConfirmation lambda function. I gave permission to the lambda for Sns publishing. In cloudwatch it says, That lambda does not have authorize to perform this Sns publishing.

I am getting this error in cloudwatch:

PostConfirmation is not authorized to perform: SNS:Publish on resource: +358.... because no identity-based policy allows the SNS:Publish action

I am not sure what I am missing.

This is my YAML file:

  plugins:
    - serverless-webpack
    - serverless-offline
    - serverless-plugin-warmup
    - serverless-iam-roles-per-function
  ## post Confirmation
  PostConfirmation:
    handler: src/handlers/postConfirmation.postConfirmation
    events:
      - cognitoUserPool:
          pool: ${self:provider.environment.COGNITO}
          trigger: PostConfirmation
          existing: true
    iamRoleStatements:
      - Effect: Allow
        Action:
          - cognito-idp:*
        Resource: arn:aws:cognito-idp:*:*:*
      - Effect: Allow
        Action:
          - dynamodb:PutItem
          - lambda:InvokeFunction # Added this like mentioned above
        Resource: 'arn:aws:dynamodb:${opt:region, self:provider.region}:*:table/${self:provider.environment.ITEM_TABLE}'
      - Effect: Allow
        Action:
          - sns:Publish ## This is where I am giving my permisson 
          - sns:SetSMSAttributes
        Resource: !Ref SendMessageSns ## Sns Topic

resources:
  Resources:
    SendMessageSns:
      Type: AWS::SNS::Topic
      Properties:
        DisplayName: It will send sms when user successfully signUp
        TopicName: ${self:service}-${opt:stage, self:provider.stage}-successful

This is how I am trying to publishing the message

import { SNS } from '@aws-sdk/client-sns';
const snsClient = new SNS({ region: 'eu-north-1' });
exports.postConfirmation = async (event: any, context: any) => {

  const messageParams = {
    Message:
      'congrats it works',
    PhoneNumber: '+358.......',
  };

  try {
    console.log('1');
    const snsSucess = await snsClient.publish(messageParams);
    console.log('Success.', snsSucess);
    console.log('2');
    context.done(null, event);
  } catch (error) {
    console.log('error', { error });
    return {
      statusCode: 500,
      body: JSON.stringify(error),
    };
  }
};



alakdam07 avatar Apr 13 '22 05:04 alakdam07