title: What's the correct terraform syntax to allow an external AWS role to subscribe and read from AWS SNS topic?
body: <p>I want to create a policy so a specific aws role (not in the same account) let's say <em>arn:aws:iam::123123123123:role/sns-read-role</em> can subscribe and receive messages from my SNS topic in AWS.</p>
  <p>From the <a href="https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sns_topic_policy" rel="nofollow noreferrer">official terraform docs about aws_sns_topic_policy</a> example it would be</p>
  <pre><code>resource &quot;aws_sns_topic&quot; &quot;test&quot; {
    name = &quot;my-topic-with-policy&quot;
  }
  
  resource &quot;aws_sns_topic_policy&quot; &quot;default&quot; {
    arn = aws_sns_topic.test.arn
    policy = data.aws_iam_policy_document.sns_topic_policy.json
  }
  
  data &quot;aws_iam_policy_document&quot; &quot;sns_topic_policy&quot; {
  
    statement {
      actions = [
        &quot;SNS:Subscribe&quot;,
        &quot;SNS:Receive&quot;
      ]
  
      condition {
        test     = &quot;StringEquals&quot;
        variable = &quot;AWS:SourceOwner&quot;
        values = [
          123123123123
        ]
      }
  
      effect = &quot;Allow&quot;
  
      principals {
        type        = &quot;AWS&quot;
        identifiers = [&quot;*&quot;]
      }
  
      resources = [
        aws_sns_topic.test.arn
      ]
    }
  }
  </code></pre>
  <p>But this would translate to <em>arn:aws:iam::123123123123:root</em> and filter only on <em>account-id</em>.</p>
  <p>From <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html" rel="nofollow noreferrer">AWS JSON policy elements: Principal</a> I understand the AWS syntax is</p>
  <p><code>&quot;Principal&quot;: { &quot;AWS&quot;: &quot;arn:aws:iam::AWS-account-ID:role/role-name&quot; }</code></p>
  <p>Adding the role in the condition like this</p>
  <pre><code>condition {
      test     = &quot;StringEquals&quot;
      variable = &quot;AWS:SourceOwner&quot;
  
      values = [
          arn:aws:iam::123123123123:role/sns-read-role
      ]
  }
  </code></pre>
  <p>does not work.</p>
  <p>It would make sense to add the role to the principal like this</p>
  <pre><code>principals {
      type        = &quot;AWS&quot;
      identifiers = [&quot;arn:aws:iam::123123123123:role/sns-read-role&quot;]
  }
  </code></pre>
  <p>When I try to subscribe, I get an AuthorizationError: &quot;Couldn't subscribe to topic...&quot;</p>
  <p>Do I need the condition together with the principal? Why even bother with the condition if you can use the principal in the first place?</p>