SNS topic not working for an SQS source created in the Panther Console
Issue
We have an SQS source created in our Panther Console, which has been used for other topics that are working. However, one of these topics is not working even though the topics appear to be set up similarly. The affected topic is configured to send data, but it doesn't appear to be ingested into Panther. We're trying to make this topic hit correctly the SQS endpoint.
Resolution
To resolve this issue, first ensure the permissions are correct.
Next, follow these steps:
- Please go into your AWS account, and navigate to the affected SNS topic.
- Go to Subscriptions. This is the tab where your SNS -> SQS subscription will appear. This will look similar to the following example screenshot, and the status will likely be "Pending."
- Select the subscription and click Request Confirmation.
Once the permissions are fixed and you have clicked Request Confirmation, a new confirmation message will be sent to our queue.
Cause
Possible causes of this issue are described below:
- The wrong permissions had been configured on the SQS queue of the SQS source.
- You tried to create an SNS->SQS subscription (from the affected SNS topic in your account) to the Panther SQS queue.