如何在代码中创建 AWS SNS 主题（iOS Mobile Hub 开发工具包）答案

【问题标题】：How to create AWS SNS Topic in code (iOS Mobile Hub SDK)如何在代码中创建 AWS SNS 主题（iOS Mobile Hub 开发工具包）
【发布时间】：2021-04-12 16:48:00
【问题描述】：

我想在代码中动态创建 Amazon SNS 主题。我正在使用适用于 iOS 的 AWS Mobile Hub sdk。

当我尝试创建主题时

…
AWSSNSCreateTopicInput* input = [AWSSNSCreateTopicInput new];
NSString* name = @"topic_name";
[input setName:name];

[[[[AWSSNS defaultSNS] createTopic:input] continueWithSuccessBlock:^id _Nullable(AWSTask<AWSSNSCreateTopicResponse *> * _Nonnull task)
…

我从 AWS 收到一个错误：

<Message>User: (role/credentials) is not authorized to perform: SNS:CreateTopic on resource: (topic)</Message>

(role/credentials) 表示 IAM 角色及其 Cognito 凭证。 (topic) 是我通过提供主题名称请求的主题的 ARN

AWS Mobile Hub 为我的 Mobile Hub 角色创建了以下推送策略：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "sns:CreatePlatformEndpoint",
                "sns:GetEndpointAttributes",
                "sns:SetEndpointAttributes"
            ],
            "Resource": [
                "(APN role arn)"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "sns:Subscribe",
                "sns:Publish",
                "sns:Unsubscribe"
            ],
            "Resource": [
                "(dynamodb role arn)",
                "(Mobile Hub Role arn)"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "sns:ListTopics"
            ],
            "Resource": [
                "*"
            ]
        }
    ]
}

我尝试添加该行

"sns:CreateTopic",

到中间的权限集（就在“sns：Subscribe”上方），但这并没有解决错误。从错误消息和阅读 AWS 文档来看，我似乎必须为我创建的每个主题附加一个策略才能使用它。以下是来自 AWS 文档的 2 个可能相关的 sn-ps：

The following example shows the permissions that are automatically created by AWS Config for a new topic. This policy statement allows AWS Config to publish to a specified Amazon SNS topic.

If you want to use an existing SNS topic from another account or you set up your delivery channel using the API, make sure to attach the following policy to the SNS topic.

{
  "Id": "Policy1415489375392",
  "Statement": [
    {
      "Sid": "AWSConfigSNSPolicy20150201",
      "Action": [
        "SNS:Publish"
      ],
      "Effect": "Allow",
      "Resource": "arn:aws:sns:region:account-id:myTopic",
      "Principal": {
        "Service": [
          "config.amazonaws.com"
        ]
      }
    }
  ]
}

和

 IAM Role Policy for Amazon SNS Topic

Use this example policy as a model for granting AWS Config permissions to access your SNS topic:

{
  "Version": "2012-10-17",
  "Statement": 
   [
     {
      "Effect":"Allow",
      "Action":"sns:Publish",
      "Resource":"yourSNStopicARN"
     }
    ]
}

这就是我能找到的关于使用 sdk 创建主题的全部内容。谁能提供或指出一个完整的例子？

【问题讨论】：

标签： ios aws-sdk amazon-sns

【解决方案1】：

AWS Forum for Amazon SNS（简单通知服务）是支持移动推送的服务，可能是获得有关此主题帮助的更好地方。
https://forums.aws.amazon.com/forum.jspa?forumID=72

问题似乎是相应的移动应用程序用户 IAM 角色没有创建主题的权限。 Mobile Hub 默认不授予移动应用程序用户创建 SNS 主题的权限。应该给有sns:ListTopic的语句加上sns:CreateTopic权限，像这样...

    {
        "Effect": "Allow",
        "Action": [
            "sns:ListTopics",
            "sns:CreateTopic",
        ],
        "Resource": [
            "*"
        ]
    }

【讨论】：