Fix: remove KMS from SNS topics — EventBridge deliveries all failing#40
Merged
Conversation
EventBridge cannot publish to SNS topics encrypted with the AWS-managed SNS key (alias/aws/sns) because the key policy doesn't grant events.amazonaws.com the kms:GenerateDataKey permission. This caused ALL EventBridge → SNS deliveries to fail silently: - Resource creation alerts: 3/3 failed - Resource modification alerts: 1/1 failed - Console login alerts: 5/5 failed These are internal alert routing topics, not carrying sensitive data.
Terraform PlanChanges detected — review required. Plan output |
LLM Plan ReviewRisk: 🟢 LOW Removing KMS encryption from SNS topics - a routine configuration change with minimal security impact.
|
Alexanderamiri
added a commit
that referenced
this pull request
May 9, 2026
…40) ## Summary All EventBridge → SNS deliveries have been failing because the AWS-managed SNS KMS key (`alias/aws/sns`) doesn't allow `events.amazonaws.com` to use it for encryption. **Impact:** Zero resource alerts, console login alerts, or modification alerts have been delivered to Slack since the SNS topics were encrypted. 9/9 deliveries failed. **Fix:** Remove `kms_master_key_id` from both SNS topics. These are internal alert routing topics. ## Test plan - [ ] Merge and apply - [ ] Create a test S3 bucket → verify alert appears in Slack - [ ] Login to console → verify login alert appears
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
All EventBridge → SNS deliveries have been failing because the AWS-managed SNS KMS key (
alias/aws/sns) doesn't allowevents.amazonaws.comto use it for encryption.Impact: Zero resource alerts, console login alerts, or modification alerts have been delivered to Slack since the SNS topics were encrypted. 9/9 deliveries failed.
Fix: Remove
kms_master_key_idfrom both SNS topics. These are internal alert routing topics.Test plan