title: KMS Access Denied exception on SNS Topic to SQS queue
body: <p><strong>Background:</strong> I am trying to execute a lambda function by using a SQS queue as the trigger. And once the lambda function finishes executing, I am trying to send a response to another SQS queue via a SNS topic.</p>
  <p>SQS Queue -&gt; Lambda -&gt; SNS topic -&gt; SQS Queue</p>
  <p>I initially tried to use Destinations to send Lambda's response to SQS, but that only works for async invocations and SQS is considered as a sync invocation. Fine. So now I trigger a SNS topic which then handles adding the message to the SQS queue. This integration works fine.</p>
  <p><strong>Problem:</strong> The SNS topic always ends up failing to post to the SQS queue. I can see that the deadletter queue has the messages always and never the actual queue. This is the error message I found on CloudWatch</p>
  <pre><code>{
      &quot;delivery&quot;: {
          &quot;providerResponse&quot;: &quot;{\&quot;ErrorCode\&quot;:\&quot;KMS.AccessDeniedException\&quot;,\&quot;ErrorMessage\&quot;:\&quot;null (Service: AWSKMS; Status Code: 400; Error Code: AccessDeniedException; Request ID: c)\&quot;,\&quot;sqsRequestId\&quot;:\&quot;Unrecoverable\&quot;}&quot;,
          &quot;dwellTimeMs&quot;: 51,
          &quot;attempts&quot;: 1,
          &quot;statusCode&quot;: 400
      },
      &quot;status&quot;: &quot;FAILURE&quot;
  }
  </code></pre>
  <p>I can see that KMS is denying access to something. But I'm not sure who is getting denied by KMS. The SNS topic has no encryption set. It is disabled. I initially enabled it, but after facing the problem, I disabled it. But the problem still persists.</p>
  <p><strong>What have I tried:</strong></p>
  <ol>
  <li>I've tried disabling and enabling the encryption on SNS topic settings.</li>
  <li>I've tried looking at IAM roles associated with the SNS topic and SQS queue. Very few service roles were created and none of them have any restrictions.</li>
  </ol>