title: AWS Cloudwatch alarm from Account A unable to publish to SNS topic in Account B
body: <p>Just when I thought I had cross org permissions sorted I am stuck with CloudWatch alarms and SNS. 
  Have tried several options but am not able to get the access policy right on the SNS topic. Cloudwatch and SNS topic are in the same region but different accounts in the same org. Surely I don't need lambda in the middle to manage this, AWS have cross org support for CloudWatch now. Few options below I have tried.</p>
  
  <p>SNS Topic is in account A = 1111111111
  Cloudwatch alarm is in account B = 22222222</p>
  
  <p>Option 1 - Account B has publish rights to the SNS topic</p>
  
  <pre><code>{
      "Sid": "__console_pub_0",
      "Effect": "Allow",
      "Principal": {
        "AWS": [
          "arn:aws:iam::111111111111:root",
          "arn:aws:iam::222222222222:root"
        ]
      },
      "Action": "SNS:Publish",
      "Resource": "arn:aws:sns:us-east-1:111111111111:alerttopicname"
    }
  </code></pre>
  
  <p>Option 2 - Gave the Cloudwatch service access to publish to the SNS topic</p>
  
  <pre><code> {
          "Sid": "Allow_Publish_Alarms",
          "Effect": "Allow",
          "Principal":
          {
              "Service": [
                  "cloudwatch.amazonaws.com"
              ]
          },
          "Action": "sns:Publish",
          "Resource": "arn:aws:sns:us-east-1:111111111111:alerttopicname"
      }
  </code></pre>
  
  <p>Option 3 - Cross org permissions, I updated the IAM role in account B too</p>
  
  <pre><code> {
         "Sid": "CrossOrgPublish01",
         "Effect": "Allow",
         "Principal": {
            "AWS": "*"
         },
         "Action": "SNS:Publish",
         "Resource": "arn:aws:sns:us-east-1:111111111111:alerttopicname",
         "Condition": {
            "ArnLike": {
               "aws:SourceArn": "arn:aws:cloudwatch:us-east-1:222222222222:alarm:*"
            }
         }
      }
  </code></pre>