highIntermediateSymptom-first#sns#subscription#lambda#sqs

SNS delivery failing to Lambda or SQS subscribers

Topic publish succeeds but subscribers never receive

Likely source:connectivityconfiguration

Focused incident mode — strips away everything but this runbook.

Symptoms

  • Topic publish succeeds but subscribers never receive
  • Notifications missing while topic metrics show MessagesPublished
  • Subscription logs show delivery failure / InvalidParameter

Evidence to grab

Collect these artifacts before you change anything — they prove (or rule out) each cause.

  • Topic publish volume

    aws cloudwatch get-metric-statistics --namespace AWS/SNS --metric-name NumberOfMessagesPublished --dimensions Name=TopicName,Value=<TOPIC-NAME> --start-time <ISO> --end-time <ISO> --period 300 --statistics Sum

  • Subscription list

    aws sns list-subscriptions-by-topic --topic-arn <TOPIC-ARN> --query 'Subscriptions[].{Endpoint:Endpoint,Protocol:Protocol,Arn:SubscriptionArn}'

Diagnostic flow

Run the steps in order, marking each claim confirmed or refuted. The evidence you gather feeds the ranked causes below.

Guided decision tree is ready.

Steps with commands, expected output, and pass/fail branches.

Ranked root causes

Evidence checklist

  • Subscription is to lambda:functions:... but never invokes
  • Lambda 'Resource-based policy' lacks sns.amazonaws.com

Confirm before fixing

aws lambda get-policy --function-name <FUNCTION>
READ

Does the function trust SNS?

Expected: A policy statement allowing sns:InvokeFunction from the topic

Adding the subscription from the console wires the resource policy; doing it purely via CLI (create-topic-subscription) often leaves it missing.

Fix

aws lambda add-permission --function-name <FUNCTION> --statement-id sns-topic --action lambda:InvokeFunction --principal sns.amazonaws.com --source-arn <TOPIC-ARN>
CHANGE

Grant SNS permission to invoke the function

Expected: Permision added

Resolution runbook

Apply from top to bottom after the cause is confirmed. Review every command before running it — risk tags are shown on each.

1
aws sns get-topic-attributes --topic-arn <TOPIC-ARN> --query 'Attributes.{Published:NumberOfMessagesPublished,Delivered:NumberOfNotificationsDelivered}'
READ

Confirm delivery divergence

2
aws sns list-subscriptions-by-topic --topic-arn <TOPIC-ARN>
READ

Subscription health (PendingConfirmation?)

3
aws lambda add-permission --function-name <FUNCTION> --statement-id sns-topic --action lambda:InvokeFunction --principal sns.amazonaws.com --source-arn <TOPIC-ARN>
CHANGE

Fix the Lambda resource policy

4
aws sns publish --topic-arn <TOPIC-ARN> --message 'test' --message-attributes file://diag-attrs.json
CHANGE

Publish a test and watch the target receive

Prevention

  • Enable delivery-status logging on every production subscription.
  • Create Lambda subscriptions via the console/IaC so resource policies are generated.
  • Alarm on NumberOfNotificationsDelivered < NumberOfMessagesPublished divergence.

Related runbooks

Same stack, same failure family — worth a skim.

Messages stuck in SQS dead-letter queuehigh

DLQ ApproximateNumberOfMessages keeps rising or flat at a ceiling

AWSAdvanced2 causes
Open runbook
Lambda execution role not authorized — invoke failshigh

Invoke returns 403 'The provided execution role does not have permissions'

AWSFoundation3 causes
Open runbook

Commands marked READ CHANGE DESTRUCTIVE — never run DESTRUCTIVE commands against production data you cannot restore. Copy → verify → execute.