Creating an Amazon SNS topic for anomaly notifications
To create an anomaly detection monitor that sends notifications to an Amazon Simple Notification Service (Amazon SNS) topic, you must already have Amazon SNS topic or create a new one. You can use Amazon SNS topics to send notifications over SNS in addition to email. Amazon Cost Anomaly Detection must have permissions to send a notification to your topic.
To create an Amazon SNS notification topic and grant permissions
Sign in to the Amazon Web Services Management Console and open the Amazon SNS console at https://console.amazonaws.cn/sns/v3/home
. -
In the navigation pane, choose Topics.
-
Choose Create topic.
-
For Name, enter the name for your notification topic.
-
(Optional) For Display name, enter the name that you want displayed when you receive a notification.
-
In Access policy, choose Advanced.
-
In the policy text field, after "Statement": [, enter one of the following statements:
To allow the Amazon Cost Anomaly Detection service to publish to the Amazon SNS topic, use the following statement.
{ "Sid":
"E.g., AWSAnomalyDetectionSNSPublishingPermissions"
, "Effect": "Allow", "Principal": { "Service": "costalerts.amazonaws.com" }, "Action": "SNS:Publish", "Resource":"your topic ARN"
}To allow the Amazon Cost Anomaly Detection service to publish to the Amazon SNS topic only on behalf of a certain account, use the following statement.
{ "Sid":
"E.g., AWSAnomalyDetectionSNSPublishingPermissions"
, "Effect": "Allow", "Principal": { "Service": "costalerts.amazonaws.com" }, "Action": "SNS:Publish", "Resource":"your topic ARN"
, "Condition": { "StringEquals": { "aws:SourceAccount": ["account-ID"
] } } }Note
In this topic policy, you enter the subscription’s account ID as the value for the
aws:SourceAccount
condition. This condition has Amazon Cost Anomaly Detection interact with the Amazon SNS topic only when performing operations for the account that owns the subscription.You can restrict Amazon Cost Anomaly Detection to interact with the topic only when performing operations on behalf of a specific subscription. To do this, use the
aws:SourceArn
condition in the topic policy.For more information about these conditions, see
aws:SourceAccount
andaws:SourceArn
in the IAM User Guide. -
In the topic policy statement that you select, replace the following values:
-
Replace (for example,
AWSAnomalyDetectionSNSPublishingPermissions
) with a string. TheSid
must be unique within the policy. -
Replace
your topic ARN
with the Amazon SNS topic Amazon Resource Name (ARN). -
If you're using the statement with the
aws:SourceAccount
condition, replaceaccount-ID
with the account ID that owns the subscription. If the Amazon SNS topic has multiple subscriptions from different accounts, add multiple account IDs to theaws:SourceAccount
condition.
-
-
Choose Create topic.
Your topic now appears in the list of topics on the Topics page.
Checking or resending notification confirmation email messages
When you create an anomaly detection monitor with notifications, you also create Amazon SNS notifications. For notifications to be sent, you must accept the subscription to the Amazon SNS notification topic.
To confirm that your notification subscriptions are accepted or to resend a subscription confirmation email, use the Amazon SNS console.
To check your notification status or to resend a notification confirmation email message
Sign in to the Amazon Web Services Management Console and open the Amazon SNS console at https://console.amazonaws.cn/sns/v3/home
. -
In the navigation pane, choose Subscriptions.
-
Check the status of your notification. Under Status,
PendingConfirmation
appears if a subscription isn't accepted and confirmed. -
(Optional) To resend a confirmation request, select the subscription with a pending confirmation and choose Request confirmation. Amazon SNS sends a confirmation request to the endpoints that are subscribed to the notification.
When each owner of an endpoint receives the email, they must choose the Confirm subscription link to activate the notification.
Protecting your Amazon SNS anomaly detection alerts data with SSE and Amazon KMS
You can use server-side encryption (SSE) to transfer sensitive data in encrypted topics. SSE protects Amazon SNS messages by using keys managed in Amazon Key Management Service (Amazon KMS).
To manage SSE using Amazon Web Services Management Console or the Amazon SDK, see Enabling Server-Side Encryption (SSE) for an Amazon SNS Topic in the Amazon Simple Notification Service Getting Started Guide.
To create encrypted topics using Amazon CloudFormation, see the Amazon CloudFormation User Guide.
SSE encrypts messages as soon as Amazon SNS receives them. The messages are stored encrypted and are decrypted using Amazon SNS only when they're sent.
Configuring Amazon KMS permissions
You must configure your Amazon KMS key policies before you can use server-side encryption (SSE). You can use this configuration to encrypt topics, in addition to encrypting and decrypting messages. For information about Amazon KMS permissions, see Amazon KMS API Permissions: Actions and Resources Reference in the Amazon Key Management Service Developer Guide.
You can also use IAM policies to manage Amazon KMS key permissions. For more information, see Using IAM Policies with Amazon KMS.
Note
You can configure global permissions to send and receive message from Amazon SNS. However, Amazon KMS requires that you name the full Amazon Resource Name (ARN) of the Amazon KMS keys (KMS keys) in the specific Amazon Web Services Regions. You can find this in the Resource section of an IAM policy.
Ensure that the key policies of the KMS key allow the necessary permissions. To do this, name the principals that produce and consume encrypted messages in Amazon SNS as users in the KMS key policy.
To enable compatibility between Amazon Cost Anomaly Detection and encrypted Amazon SNS topics
-
Add one of the following policies as the KMS key policy:
To grant the Amazon Cost Anomaly Detection service access to the KMS key, use the following statement.
{ "Version":
"2012-10-17"
, "Statement": [{ "Effect": "Allow", "Principal": { "Service": "costalerts.amazonaws.com" }, "Action": [ "kms:GenerateDataKey*", "kms:Decrypt" ], "Resource":"*"
}] }To grant the Amazon Cost Anomaly Detection service access to the KMS key only when performing operations on behalf of a certain account, use the following statement.
{ "Version":
"2012-10-17"
, "Statement": [{ "Effect": "Allow", "Principal": { "Service": "costalerts.amazonaws.com" }, "Action": [ "kms:GenerateDataKey*", "kms:Decrypt" ], "Resource":"*"
, "Condition": { "StringEquals": { "aws:SourceAccount": ["account-ID"
] } } }] }Note
In this KMS key policy, you enter the subscription’s account ID as the value for the
aws:SourceAccount
condition. This condition has Amazon Cost Anomaly Detection interact with the KMS key only when performing operations for the account that owns the subscription.To have Amazon Cost Anomaly Detection interact with the KMS key only when performing operations on behalf of a specific subscription, use the
aws:SourceArn
condition in the KMS key policy.For more information about these conditions, see
aws:SourceAccount
andaws:SourceArn
in the IAM User Guide. -
If you're using the KMS key policy with the
aws:SourceAccount
condition, replaceaccount-ID
with the account ID that owns the subscription. If the Amazon SNS topic has multiple subscriptions from different accounts, add multiple account IDs to theaws:SourceAccount
condition. -
Enable SSE for your SNS topic.
Note
Make sure that you're using the same KMS key that grants Amazon Cost Anomaly Detection the permissions to publish to encrypted Amazon SNS topics.
-
Choose Save Changes.