为什么在使用加密的 SNS 主题时收不到 AWS RDS 事件通知？
我已通过 RDS 事件订阅设置了快照事件警报，以使用 SNS 主题（通过电子邮件订阅）。一切工作正常，直到我使用 KMS 密钥加密主题（SSE）。 我尝试过“默认”密钥，然后尝试了 CMK。对于 CMK，我使用了将服务主体指定为 rds.amazonaws.com 的密钥策略，但没有成功。我也尝试添加 sns.amazonaws.com 。最后我想出了最允许的关键政策（如下），但再次没有成功。
{
"Sid": "Allow access for Key User (SNS Service Principal)",
"Effect": "Allow",
"Principal": {
"Service": "*"
},
"Action": "kms:*",
"Resource": "*"
}
我发现这个领域（加密 SNS）的记录很少，而且我还没有找到关于加密 SNS 支持哪些服务、哪些不支持的明确规范。 我得到的最接近的是这个（RDS未列出）：
https://aws.amazon.com/blogs/compute/encrypting-messages-published-to-amazon-sns-with-aws-kms/
我将不胜感激。
I've set up alerts for snapshot events with RDS Event subscription to use SNS topic ( with email subscription ). Everything worked fine until I've encrypted the topic (SSE) with KMS key.
I've tried "default" key and then I've tried CMK. For CMK I've used Key policy specifying service principal as rds.amazonaws.com with no success. I've also tried adding sns.amazonaws.com as well. Finally I came up with most permitting key policy ( below ) and again with no success.
{
"Sid": "Allow access for Key User (SNS Service Principal)",
"Effect": "Allow",
"Principal": {
"Service": "*"
},
"Action": "kms:*",
"Resource": "*"
}
I found this area (encrypted SNS) poorly documented and I haven't found clear specifications on which services are supported by encrypted SNS and which are not.
Closest I got is this ( RDS is not listed ):
https://aws.amazon.com/blogs/compute/encrypting-messages-published-to-amazon-sns-with-aws-kms/
I would appreciate any help on this.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
发现：
只有未加密的SNS主题才支持RDS事件通知。如果您指定加密的 SNS 主题，Amazon RDS 无法将事件通知发送到您的主题。
如果您在加密部分看到已配置，则您的主题已加密。您还可以看到您的 AWS KMS 密钥（KMS 密钥）和 KMS ARN。
如果您的主题已加密，请完成禁用 SNS 主题加密部分中的步骤。
https://aws.amazon.com/premiumsupport/knowledge-中心/sns-topics-rds-notifications/
Found it:
Only unencrypted SNS topics support RDS event notifications. If you specify an encrypted SNS topic, Amazon RDS can't send event notifications to your topic.
If you see Configured in the Encryption section, then your topic is encrypted. You also see your AWS KMS key (KMS key) and KMS ARN.
If your topic is encrypted, complete the steps in the Disable encryption from your SNS topic section.
https://aws.amazon.com/premiumsupport/knowledge-center/sns-topics-rds-notifications/
需要在 KMS 密钥策略中添加
events.rds.amazonaws.com作为服务主体Need to add
events.rds.amazonaws.comas the service principal in the KMS key policy