View a markdown version of this page

Using the Amazon AppConfig deployment events to Amazon SNS extension - Amazon AppConfig
Using the extension
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Using the Amazon AppConfig deployment events to Amazon SNS extension

The Amazon AppConfig deployment events to Amazon SNS extension is an Amazon authored extension that helps you monitor and act on the Amazon AppConfig configuration deployment workflow. The extension publishes messages to an Amazon SNS topic whenever a configuration is deployed. After you associate the extension to one of your Amazon AppConfig applications, environments, or configuration profiles, Amazon AppConfig publishes a message to the topic after every configuration deployment start, end, and rollback.

If you want more control over which action points send Amazon SNS notifications, you can create a custom extension and enter an Amazon SNS topic Amazon Resource Name (ARN) for the URI field. For information about creating an extension, see Walkthrough: Creating custom Amazon AppConfig extensions.

Using the extension

This section describes how to use the Amazon AppConfig deployment events to Amazon SNS extension.

Step 1: Configure Amazon AppConfig to publish messages to a topic

Add an access control policy to your Amazon SNS topic that gives Amazon AppConfig (appconfig.amazonaws.com) permission to publish messages (sns:Publish). To make sure only your own account can send these messages, add an aws:SourceAccount condition to the policy and set it to your Amazon account ID. This prevents someone in a different Amazon account from using the extension to send messages to your topic. To scope access even more tightly, you can use an aws:SourceArn condition set to the ARN of the extension association instead. For more information, see Example cases for Amazon SNS access control.

The following example policy lets Amazon AppConfig publish to your topic only when the request comes from your own account. Replace MySNSTopic and the example account ID with your own values.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowAppConfigPublish",
            "Effect": "Allow",
            "Principal": {
                "Service": "appconfig.amazonaws.com"
            },
            "Action": "SNS:Publish",
            "Resource": "arn:aws:sns:us-east-1:111122223333:MySNSTopic",
            "Condition": {
                "StringEquals": {
                    "aws:SourceAccount": "111122223333"
                }
            }
        }
    ]
}
Prevent cross-account access

You must include either the aws:SourceAccount or aws:SourceArn condition in your Amazon SNS topic policy to prevent cross-account access. Without these conditions, another Amazon account could configure its Amazon AppConfig deployment events to Amazon SNS extension to send deployment events to your topic. Always limit the policy to your own account.

Step 2: Create an extension association

Attach the extension to one of your Amazon AppConfig resources by creating an extension association. You create the association by using the Amazon AppConfig console or the CreateExtensionAssociation API action. When you create the association, you specify the ARN of an Amazon AppConfig application, environment, or configuration profile. If you associate the extension to an application or an environment, a notification is sent for any configuration profile contained within the specified application or environment. When you create the association, you must enter a value for the topicArn parameter that contains the ARN of the Amazon SNS topic you want to use.

After you create the association, when a configuration for the specified Amazon AppConfig resource is deployed, Amazon AppConfig invokes the extension and sends notifications according to the action points specified in the extension.

Note

This extension is invoked by the following action points:

  • ON_DEPLOYMENT_START

  • ON_DEPLOYMENT_COMPLETE

  • ON_DEPLOYMENT_ROLLED_BACK

You can't customize the actions points for this extension. To invoke different action points, you can create your own extension. For more information, see Walkthrough: Creating custom Amazon AppConfig extensions.

Use the following procedures to create an Amazon AppConfig extension association by using either the Amazon Systems Manager console or the Amazon CLI.

To create an extension association (console)

  1. Open the Amazon Systems Manager console at https://console.amazonaws.cn/systems-manager/appconfig/.

  2. In the navigation pane, choose Amazon AppConfig.

  3. On the Extensions tab, choose Add to resource.

  4. In the Extension resource details section, for Resource type, choose an Amazon AppConfig resource type. Depending on the resource you choose, Amazon AppConfig prompts you to choose other resources.

  5. Choose Create association to resource.

Here's a sample of the message sent to the Amazon SNS topic when the extension is invoked.

{
    "Type": "Notification",
    "MessageId": "ae9d702f-9a66-51b3-8586-2b17932a9f28",
    "TopicArn": "arn:aws:sns:us-east-1:111122223333:MySNSTopic",
    "Message": {
        "InvocationId": "7itcaxp",
        "Parameters": {
            "topicArn": "arn:aws:sns:us-east-1:111122223333:MySNSTopic"
        },
        "Application": {
            "Id": "1a2b3c4d",
            "Name": MyApp
        },
        "Environment": {
            "Id": "1a2b3c4d",
            "Name": MyEnv
        },
        "ConfigurationProfile": {
            "Id": "1a2b3c4d",
            "Name": "MyConfigProfile"
        },
        "Description": null,
        "DeploymentNumber": "3",
        "ConfigurationVersion": "1",
        "Type": "OnDeploymentComplete"
    },
    "Timestamp": "2022-06-30T20:26:52.067Z",
    "SignatureVersion": "1",
    "Signature": "<...>",
    "SigningCertURL": "<...>",
    "UnsubscribeURL": "<...>",
    "MessageAttributes": {
        "MessageType": {
            "Type": "String",
            "Value": "OnDeploymentStart"
        }
    }
}