title: AWS Cloudwatch can not publish to SNS Topic with SSE
body: <p>I have a Route53 health check, which submits its metrics into Cloudwatch, and finally Cloudwatch specifies thresholds and should send alerts through SNS.</p>
  
  <p>However, I would like my SNS Topic to be encrypted. When I turn on SNS Topic encryption using the <code>alias/aws/sns</code> key I receive these messages in the Cloudwatch message history:</p>
  
  <pre><code>{
    "actionState": "Failed",
    "stateUpdateTimestamp": 123456778899,
    "notificationResource": "arn:aws:sns:xx-region-y:zzzzzzzzzz:topic_name",
    "publishedMessage": null,
    "error": "null (Service: AWSKMS; Status Code: 400; Error Code: AccessDeniedException; Request ID: ccccccccccccccccccc)"
  }
  </code></pre>
  
  <p>This <em>appears</em> to not be an IAM issue with Cloudwatch, but with SNS itself being unauthorized to use the KMS resources.</p>
  
  <p>I enjoy using the IAM Policy Simulator for IAM users to identify where their permissions are lacking, but there doesn't seem to be a way to validate a Service's access to other services. Is that a thing I can manage?</p>
  
  <p><a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_testing-policies.html" rel="noreferrer">https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_testing-policies.html</a></p>
  
  <hr>
  
  <p>I have also tried this with a CMK with the following policy:</p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Statement": [
          {
              "Sid": "",
              "Effect": "Allow",
              "Principal": {
                  "Service": "sns.amazonaws.com"
              },
              "Action": [
                  "kms:GenerateDataKey*",
                  "kms:Decrypt"
              ],
              "Resource": "*"
          },
          {
              "Sid": "",
              "Effect": "Allow",
              "Principal": {
                  "Service": "route53.amazonaws.com"
              },
              "Action": [
                  "kms:GenerateDataKey*",
                  "kms:Decrypt"
              ],
              "Resource": "*"
          },
          {
              "Sid": "",
              "Effect": "Allow",
              "Principal": {
                  "Service": "events.amazonaws.com"
              },
              "Action": [
                  "kms:GenerateDataKey*",
                  "kms:Decrypt"
              ],
              "Resource": "*"
          },
          {
              "Sid": "",
              "Effect": "Allow",
              "Principal": {
                  "AWS": "arn:aws:iam::XXXXXXXX:role/OrganizationAccountAccessRole"
              },
              "Action": "kms:*",
              "Resource": "*"
          }
      ]
  }
  </code></pre>
  
  <p>I'm pretty much throwing darts at a wall with the principals, but I think there's validation for <code>sns.amazonaws.com</code>for SNS and <code>events.amazonaws.com</code> for Cloudwatch.</p>
  
  <p>I received the exact same error, <code>"null (Service: AWSKMS; Status Code: 400; Error Code: AccessDeniedException; Request ID: ccccccccccccccccccc)"</code>, when using a CMK in this manner as well. I can understand my CMK not working properly, but the Amazon managed key I think should just work out of the box.</p>
  
  <hr>
  
  <p>I've tried using a CMK which grants <code>sns.amazonaws.com</code> and <code>events.amazonaws.com</code> with <code>kms:*</code> permissions. Same error.</p>