User is not authorized to perform: SNS:CreateTopic on resource

Question

I wanted to monitor certain parameters (TotalErrorRate and Latency) with CloudWatch and I wanted a "Simple Notification Service" (SNS) to send me an email, when an (cloudWatch) alarm is thrown:

EscalationTopic:
  Type: "AWS::SNS::Topic"
  Properties:
    DisplayName: My Monitoring
    Subscription:
      - Endpoint: !Ref EmailForNotification
        Protocol: email

EscalationTopicEmailSubscriber:
  Type: "AWS::SNS::Subscription"
  Properties:
    Endpoint: !Ref EmailForNotification
    Protocol: email
    TopicArn: !Ref EscalationTopic

But I get this error: User is not authorized to perform: SNS:CreateTopic on resource(Service: AmazonSNS; Status Code: 403; Error Code: AuthorizationError (see screenshot)

What I did to solve it, is creating a topicPolicy:

   SNSTopicPolicy:
     Type: 'AWS::SNS::TopicPolicy'
     Properties:
       Topics:
         - !Ref EscalationTopic
       PolicyDocument:
         Version: '2012-10-17'
         Statement:
           - Effect: Allow
             Action: 'sns:CreateTopic'
             Resource: !Ref EscalationTopic
             Principal:
               AWS: '*'

But the problem still persists.

EDIT: In the SNS console, I could manually create a new topic. Shouldn't it mean that I got the permission in order to createTopic?

Answer 1

The error message states the problem quite accurately. The credentials used to create the CloudFormation stack (presumably your login credentials unless you specified a Role during stack creation) is not authorized to create an Amazon SNS topic.

You should look at the permissions associated with your IAM User and add the necessary permissions.

Adding an SNS Topic Policy will have no impact because it is used to give SNS a set of permissions, whereas you need permissions to create the Topic itself.

Answer 2

I had a similar issue with Amazon SES. Apparently my "AmazonSESFullAccess" permission wasn't enough and I solved it by adding the "AmazonSNSFullAccess" permission to my IAM user at https://console.aws.amazon.com/iam/home#/users/MY_IAM_USER_NAME_GOES_HERE