aws_codestarnotifications: Creating unreachable notification rules

[cjhelloletsgo]

Describe the bug

The aws_cdk.aws_codestarnotifications NotificationRule and CfnNotificationRule constucts both create notification rules which are unable to reach a sns target.

The correct policy is added to the sns topic according to the docs but the topic is always unreachable.

https://docs.aws.amazon.com/dtconsole/latest/userguide/notification-target-create.html?icmpid=docs_acn_console_acp

Creating a sns topic target through the console works fine and if i describe a notification rule with a target created by the cdk it looks identical to the ui created target.

Regression Issue

• Select this option if this issue appears to be a regression.

Last Known Working CDK Version

No response

Expected Behavior

The sns topic should have an Active Notification target status.

Current Behavior

The target SNS topic is in an Unreachable Notification target status.

Reproduction Steps

Code example:

import aws_cdk.aws_codestarnotifications as notifications
from aws_cdk import (
    aws_codepipeline as codepipeline,
)
from aws_cdk import (
    aws_codepipeline_actions as codepipeline_actions,
)
from aws_cdk import aws_sns as sns

 pipeline_topic = sns.Topic(
     self,
    "Pipeline Topic",
    display_name="Pipeline Topic",
    enforce_ssl=True,
)

pipeline = codepipeline.Pipeline(
    self,
    "Pipeline",
    pipeline_type=codepipeline.PipelineType.V2,
    triggers=[],
    stages=[
        codepipeline.StageProps(
            stage_name="Source",
            actions=[
                codepipeline_actions.CodeStarConnectionsSourceAction(
                    action_name="Github_Source",
                    owner=github_account_owner,
                    repo=github_repo,
                    branch=git_repo_branch,
                    output=source_output,
                    connection_arn=code_connection,
                    trigger_on_push=True,
                    run_order=1,
                ),
            ],
        ),
    ],
    restart_execution_on_update=True,
)

notification_rule = notifications.NotificationRule(
    self,
    "Notification Rule",
    source=pipeline,
    events=[
        "codepipeline-pipeline-pipeline-execution-failed",
        "codepipeline-pipeline-action-execution-failed",
        "codepipeline-pipeline-stage-execution-failed",
        "codepipeline-pipeline-manual-approval-failed",
    ],
    targets=[
        pipeline_topic,
    ],
    enabled=True,
    detail_type=notifications.DetailType.FULL,
)

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.162.1 (build 10aa526)

Framework Version

No response

Node.js Version

v20.18.0

OS

Ubuntu 24.04

Language

Python

Language Version

Python 3.12.3

Other information

No response

[cjhelloletsgo]

This doesn't happen if you deploy in one go. I think it is caused by adding the target after the notification rule is already created.

[khushail]

Hey @cjhelloletsgo , thanks for reaching out.
Could you please check the Topics access policy statement because as per AWS Docs , it should look like the following -

{
  "Version": "2008-10-17",
  "Id": "__default_policy_ID",
  "Statement": [
    {
      "Sid": "__default_statement_ID",
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": [
        "SNS:GetTopicAttributes",
        "SNS:SetTopicAttributes",
        "SNS:AddPermission",
        "SNS:RemovePermission",
        "SNS:DeleteTopic",
        "SNS:Subscribe",
        "SNS:ListSubscriptionsByTopic",
        "SNS:Publish"
      ],
      "Resource": "arn:aws:sns:us-east-2:123456789012:codestar-notifications-MyTopicForNotificationRules",
      "Condition": {
        "StringEquals": {
          "AWS:SourceOwner": "123456789012"
        }
      }
    },
	{
      "Sid": "AWSCodeStarNotifications_publish",
      "Effect": "Allow",
      "Principal": {
        "Service": [
          "codestar-notifications.amazonaws.com"
        ]
      },
      "Action": "SNS:Publish",
      "Resource": "arn:aws:sns:us-east-2:123456789012:codestar-notifications-MyTopicForNotificationRules"
    }
  ]
}

Request you to share the same.