How can I subscribe an AWS Lambda function to a push-based event source in AWS CloudFormation?

Last updated: 2019-04-19

I can't subscribe my AWS Lambda function to an Amazon Simple Storage Service (Amazon S3) event notification or Amazon Simple Notification Service (Amazon SNS) topic in my AWS CloudFormation stack. If I use the AWS::Lambda::EventSourceMapping resource, I receive the following error: "Unrecognized event source, must be kinesis or dynamodb stream."

Short Description

The AWS::Lambda::EventSourceMapping resource is designed for pull-based event sources, such as Amazon DynamoDB event streams and Amazon Kinesis. With push-based event sources, such as Amazon S3 event notifications or Amazon SNS messages, the event source is responsible for invoking the Lambda function. For a push event source to invoke a Lambda function, the function’s resource policy must authorize a supported event source.

Resolution

In your AWS CloudFormation template, add a resource-based policy using the AWS::Lambda::Permission resource. For example, the resource-based policy in the following code sample allows an Amazon SNS topic to invoke a Lambda function:

"LambdaResourcePolicy": {
  "Type": "AWS::Lambda::Permission",
  "Properties": {
    "FunctionName" : { "Ref" : "MyFunction" },
    "Principal": "sns.amazonaws.com",
    "Action": "lambda:InvokeFunction",
    "SourceArn" : { "Ref" : "MySNSTopic" }
  }
}

For the preceding example, you must have a notification configuration statement that subscribes the Lambda function to the Amazon S3 bucket. For an Amazon SNS topic event source, you must define a topic policy with the required permissions.

AWS CloudFormation Best Practices

AWS Lambda Permissions

Update Behaviors of Stack Resources 

Did this article help you?

Yes
No

Anything we could improve?

Let us know

Need more help?

Contact AWS Support