Authorization when sending a text message using AmazonSNSClient

Question

The awa official documentation on how to send a text message using the aws SDK in java is pretty simple.

However, when sending a message, as shown in the example below, I get the error User: arn:aws:iam::xxx:user/sms-testing is not authorized to perform: SNS:Publish on resource: [phone]

Please note that [phone] is the phone number passed to the .withPhoneNumber() call, so aws api complains that my IAM user does not have the necessary permission to SNS:Publish message to the resource with this phone number.

My question is: How to create an IAM user who can send SMS notifications via the java-SDK? For now, it seems like I would need to create a permission for every number I send messages to, which seems strange and difficult to maintain.

Answer 1

The error tells you that the IAM user "sms-testing" does not have permission to publish to this resource in SNS (SNS: Publish). Your IAM user probably does not have SNS: publish permission at all, which means that you cannot publish anything. If so, you just need to add the following IAM policy to your user or add the policy to the IAM group that your IAM user belongs to.

Below is a link to the IAM panel for editing permissions for the sms-testing user. Also below is an example of a policy that allows an IAM user to publish something to SNS (SMS, topics, endpoints, etc.).

If you want to block access rights a bit, you must change the "Resource" and specify a specific SNS resource, for example Topic or application arn. If you cannot edit the IAM user policy, you need your administrator to add this policy for you.

Change IAM user: https://console.aws.amazon.com/iam/home?region=us-east-1#users/sms-testing

Sample policy for publishing SNS Publish for ALL resources:

 { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": "*" } ] } 

Since SNS does not have an SMS resource, you can hack and “Deny” the publication of SNS in the Themes and Platform applications, and then allow others to leave the publication, which leaves only SMS (for now).

Here is an example of a policy that allows you to publish only SMS and prohibit publication on topics and applications (push notifications):

 { "Version": "2012-10-17", "Statement": [ { "Effect": "Deny", "Action": [ "sns:Publish" ], "Resource": "arn:aws:sns:*:*:*" }, { "Effect": "Allow", "Action": [ "sns:Publish" ], "Resource": "*" } ] } 

Hope this helps.

-Dennis