Using CDK to grant permissions to Dead Letter Queue on SNS Topic Subscription - aws-cdk

Question

I'm trying to set up an SNS topic, with a subscription to a Queue. I want to put a Dead Letter Queue onto to the SNS Subscription.
This deploys OK, however in the AWS console, when I open the subscription, I see the error "Couldn't check Amazon SQS queue permissions. Make sure that the queue exists and that your account has permission to read the attributes of the queue".
Do I need to somehow grant write permission for SNSTopic to TopicDLQ?
export class SNSToSQSConstruct extends Construct {
public readonly TopicDLQ: IQueue
public readonly SQSQueue: IQueue
public readonly SNSTopic: ITopic
constructor(scope: Construct, id: string) {
super(scope, id);
this.TopicDLQ = new Queue(this, `${id}_TopicDLQ`, {
visibilityTimeout: cdk.Duration.seconds(300),
});
this.SQSQueue = new Queue(this, `${id}_Queue`, {
visibilityTimeout: cdk.Duration.seconds(300),
});
this.SNSTopic = new Topic(this, `${id}_Topic`, {
fifo: false, // fifo support 300tps, standard support almost unlimited
topicName: id,
});
var subscription = this.SNSTopic.addSubscription(new SqsSubscription(this.SQSQueue, {
rawMessageDelivery: true,
deadLetterQueue: this.TopicDLQ
}));
// error Subscription is not IGrantable
//this.TopicDLQ.grantSendMessages(subscription);
}
}

Answer 1

I think you can do this with addToResourcePolicy
import * as cdk from 'aws-cdk-lib';
import { Construct } from 'constructs';
import { IQueue, Queue } from 'aws-cdk-lib/aws-sqs'
import { ITopic, Topic } from 'aws-cdk-lib/aws-sns'
import { SqsSubscription } from 'aws-cdk-lib/aws-sns-subscriptions'
import { ServicePrincipal, PolicyStatement, Effect} from 'aws-cdk-lib/aws-iam'
export class SNSToSQSConstruct extends Construct {
public readonly TopicDLQ: IQueue
public readonly SQSQueue: IQueue
public readonly SNSTopic: ITopic
constructor(scope: Construct, id: string) {
super(scope, id);
this.TopicDLQ = new Queue(this, `${id}_TopicDLQ`, {
visibilityTimeout: cdk.Duration.seconds(300),
});
this.SQSQueue = new Queue(this, `${id}_Queue`, {
visibilityTimeout: cdk.Duration.seconds(300),
});
this.SNSTopic = new Topic(this, `${id}_Topic`, {
fifo: false, // fifo support 300tps, standard support almost unlimited
topicName: id,
});
var subscription = this.SNSTopic.addSubscription(new SqsSubscription(this.SQSQueue, {
rawMessageDelivery: true,
deadLetterQueue: this.TopicDLQ
}));
this.TopicDLQ.addToResourcePolicy(
new PolicyStatement({
effect: Effect.ALLOW,
principals: [new ServicePrincipal('sns.amazonaws.com')],
actions: ["sqs:SendMessage"],
resources: [this.TopicDLQ.queueArn],
conditions: {
ArnEquals: {
"aws:SourceArn": this.SNSTopic.topicArn,
},
},
})
);
}
}