Grant a Compute Service Permission to Publish to an SNS Topic

Your compute service (Lambda, EC2, or ECS) is connected to an SNS topic, but its IAM role has no sns:* permissions. The template deploys, but Publish calls fail at runtime with AuthorizationError. Publishing to a topic needs only the sns:Publish action scoped to that topic ARN. On the canvas, the compute→topic edge generates this automatically; the manual steps are below.

Paste into this field

IAM Role → permissions policy (or draw the edge on the canvas)

Output looks like

Canvas edge: Lambda → SNS (auto-generates an sns:Publish policy)

1Option A (recommended) — let CloudStack Canvas generate it

Without a custom IAM Role node, draw the compute→topic edge and the auto-created role receives an sns:Publish policy scoped to that topic. Re-export to clear the warning.

3Option B — fix the role in the AWS console and accept the warning

If you manage your own IAM Role node on the canvas, the validation warning will persist in CSC even after you add the policy in AWS. The warning is advisory — it alerts you that the canvas role node lacks these permissions. Add the policy below in AWS, and the template will deploy correctly; the canvas warning remains until you edit the canvas-based role definition.

5Paste a scoped publish policy

Replace REGION, ACCOUNT, and my-topic with your topic ARN values.

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": "sns:Publish",
    "Resource": "arn:aws:sns:REGION:ACCOUNT:my-topic"
  }]
}

8Save the policy

Name it AllowSNSPublish and click "Create policy". If the topic is encrypted with a customer-managed KMS key, also grant kms:GenerateDataKey and kms:Decrypt on that key.

Once you have the value, go back to CloudStack Canvas and paste it into the highlighted field.

CloudStack Canvas · Validation Guide