Add SNS as a event listener to the s3 without adding additional policy - aws-cdk

Question

I have an SNS which will listen to multiple S3 buckets. SNS is having the access policy like below.
{
"Sid": "0",
"Effect": "Allow",
"Principal": {
"Service": "s3.amazonaws.com"
},
"Action": "sns:Publish",
"Resource": "arn:aws:sns:us-east-1:XXXXXXXXXXX:dummy-topic-name",
"Condition": {
"StringEquals": {
"AWS:SourceAccount": "XXXXXXXXXXX"
}
}
}
This permission will allow all s3 buckets to send notification to the SQS. Currently, I'm adding SNS to S3 buckets event settings like below.
bucketList.forEach(bucket => bucket.addEventNotification(EventType.OBJECT_CREATED, new SnsDestination(snsTopic)));
This one works well, but it adds additional policy to the SNS access policy, like below.
{
"Sid": "2",
"Effect": "Allow",
"Principal": {
"Service": "s3.amazonaws.com"
},
"Action": "sns:Publish",
"Resource": "arn:aws:sns:us-east-1:XXXXXXXXXXX:dummy-topic-name",
"Condition": {
"ArnLike": {
"aws:SourceArn": "arn:aws:s3:::dummy-s3-bucket"
}
}
}
I have lots of buckets (in the 100's) sending notifications to the same SNS. Now, 100 policies like above will hit the SNS access policy size limit.
Is there a way to add SNS to the S3 event notification without updating the SNS access policy using CDK?

Answer 1

TL;DR Replace the CDK-generated AWS::SNS::TopicPolicy with a manually defined one.
As you say, bucket.addEventNotification adds a bucket-specific statement to the topic's resource policy resource (AWS::SNS::TopicPolicy). Use escape hatch syntax to delete the generated AWS::SNS::TopicPolicy. Add a new one by hand:
Identify the generated CfnTopicPolicy's CDK construct id.
const childIds = topic.node.children.map((c) => c.node.id);
console.log(childIds); // -> [ 'Resource', 'Policy' ]
Looks like the construct id is "Policy". Remove it.
const success = topic.node.tryRemoveChild('Policy');
if (!success) throw new Error('Could not remove the Topic Policy!');
Add the desired policy manually.
new sns.TopicPolicy(this, 'TopicPolicy', {
topics: [topic],
policyDocument: new iam.PolicyDocument({
statements: [
new iam.PolicyStatement({
actions: ['sns:Publish'],
principals: [new iam.ServicePrincipal('s3.amazonaws.com')],
conditions: { StringEquals: { 'AWS:SourceAccount': this.account } },
resources: [topic.topicArn],
}),
],
}),
});