Can I use a single (shared) SNS topic for multiple Panther log sources?

Last updated: February 17, 2026

QUESTION

Can I use a single S3 bucket and shared SNS topic for multiple Panther log sources, and are there any issues with this deployment type?

ANSWER

Yes, you can use a single S3 bucket and shared SNS topic for multiple Panther log sources. This deployment pattern is supported as long as you follow these requirements:

  1. Ensure log sources are mutually exclusive: Use S3 prefix inclusion and/or exclusion filters to ensure each log source only processes its intended data and doesn't overlap with other log sources.

  2. Configure proper S3 event notifications: All log sources must push S3 object creation event notifications to the shared SNS topic.

  3. Verify SNS subscription: Confirm that the SNS topic has a valid subscription to the Panther SQS queue (e.g., panther-input-data-notifications-queue).