Question: Why do I get an authorization error when I try to subscribe my Lambda function to my Amazon SNS topic?

I receive an authorization error when I try to subscribe my AWS Lambda function to my Amazon Simple Notification Service (Amazon SNS) topic. How do I resolve the error?Short descriptionWhen you subscribe a Lambda function to an SNS topic, you can receive an authorization error for the following reasons:You tried to create the subscription from a different AWS account than the one that your Lambda function is in.-or-The AWS Identity and Access Management (IAM) identity that you used to create the subscription doesn't have permissions to run the following API operations:(Lambda) AddPermission(Amazon SNS) SubscribeTo resolve the issue, you must do one of the following, depending on what's causing the error:Make sure that you subscribe your Lambda function to the SNS topic from the AWS account where your function is located.-or-Make sure that the IAM identity that you're using has permissions to run both the Lambda AddPermission and SNS Subscribe API operations.

ResolutionVerify what's causing the error based on the error message that Lambda returnsIf you create the subscription from a different AWS account than the one that your function is in, then Lambda returns one of the following errors:AWS CLI error example: You tried to create the subscription from a different account than the one that your Lambda function is inAn error occurred (AuthorizationError) when calling the Subscribe operation: The account YOUR_AWS_ACCOUNT_ID_1 is not the owner of the endpoint arn:aws:lambda:us-east-1:YOUR_AWS_ACCOUNT_ID_2:function: your_Lambda_function_ARNAWS Management Console error example: You tried to create the subscription from a different account than the one that your Lambda function is inError code: AccessDeniedException - Error message: User: arn:aws:sts::XXXXXXX:XXXXXXX/XXXXX/XXXXXX is not authorized to perform: lambda:AddPermission on resource: arn:aws:lambda:us-west-2:XXXXXXX:function:XXXXXXXIf you're using the correct account, but your IAM identity lacks the required permissions, then Lambda or SNS returns one of the following errors:AWS CLI error example: The IAM identity that you used to create the subscription doesn't have permissions to run the Lambda AddPermission actionAn error occurred (AccessDeniedException) when calling the AddPermission operation: User: arn:aws:iam::XXXXXXX:user/XXXXXXXX is not authorized to perform: lambda:AddPermission on resource: arn:aws:lambda:us-west-2:XXXXXX:function:XXXXXXX because no identity-based policy allows the lambda:AddPermission actionAWS Management Console error example: The IAM identity that you used to create the subscription doesn't have permissions to run the Lambda AddPermission actionError code: AccessDeniedException - Error message: User: arn:aws:sts:XXXXXXXX:assumed-role/XXXXXXXX/XXXXX-XXXXXX is not authorized to perform: lambda:AddPermission on resource: arn:aws:lambda:us-west-2:XXXXXXXXX:function:XXXXXXX because no identity-based policy allows the lambda:AddPermission actionAWS CLI error example for when you try to use an IAM identity that doesn't have permission to run the SNS Subscribe actionAn error occurred (AuthorizationError) when calling the Subscribe operation: User: arn:aws:iam::XXXXXXX:user/XXXXXXXX is not authorized to perform: SNS:Subscribe on resource: arn:aws:sns:us-west-2:XXXXXXXX:XXXXXXX because no resource-based policy allows the SNS:Subscribe actionMake sure that you subscribe your Lambda function to the SNS topic from the AWS account where your function is locatedYou can use the Lambda console or AWS CLI to subscribe your Lambda function to an SNS topic.To subscribe a function to an SNS topic using the Lambda consoleNote: When you add the SNS trigger using the Lambda console, the console automatically allows the lambda:InvokeFunction permission from the principal service:sns.amazonaws.com.1.    On the Functions page of the Lambda console, choose your function.2.    Under Overview, choose Add trigger.3.    For Trigger configuration, choose Select a trigger, and then choose SNS.4.    For SNS topic, paste the SNS topic Amazon Resource Name (ARN) from the other AWS account.5.    Select the Enable trigger check box.6.    Choose Add.For more information, see Configuring Lambda function options.Note: If you receive the following error, then you must grant Subscribe API action permissions to the IAM identity that you're using. For troubleshooting instructions, see the following article: How do I resolve authorization errors when trying to add subscribers to an Amazon SNS topic?An error occurred (AuthorizationError) when calling the Subscribe operation: User: your_IAM_user_or_role is not authorized to perform: SNS:Subscribe on resource: your_SNS_topic_ARNTo subscribe a function to an SNS topic using the AWS CLINote: If you receive errors when running AWS CLI commands, make sure that you’re using the most recent AWS CLI version.1.    Configure your AWS CLI with an IAM user that belongs to the AWS account where your Lambda function is located:aws configure --profile-name your_profile_nameImportant: Make sure that you pass the AWS Access Key Id and Secret Key of your IAM user.2.    Allow Lambda invocations from the SNS topic by adding the lambda:InvokeFunction permission from the principal service:sns.amazonaws.com:aws lambda add-permission --function-name your_lambda_function_name --statement-id sns_invoke_permission --action lambda:InvokeFunction --principal sns.amazonaws.com --source-arn your_sns_topic_arn3.    Subscribe your Lambda function to your SNS topic:aws sns subscribe --topic-arn your_sns_topic_ARN --protocol lambda --notification-endpoint your_lambda_function_arn --profile your_profile_name_passed_on_#1Note: If you receive the following error, you must grant Subscribe API action permissions to the IAM identity that you're using. For troubleshooting instructions, see the following article: How do I resolve authorization errors when trying to add subscribers to an Amazon SNS topic?An error occurred (AuthorizationError) when calling the Subscribe operation: User: your_IAM_user_or_role is not authorized to perform: SNS:Subscribe on resource: your_SNS_topic_ARNMake sure that the IAM identity that you're using has permissions to run the Lambda AddPermission and SNS Subscribe API operationsReview your IAM identity's identity-based policy. Make sure that the policy explicitly allows the IAM identity to run both of the following actions:lambda:AddPermissionSNS:SubscribeIf the identity-based policy doesn't grant the required permissions, add the required permissions to the policy. Then, subscribe your Lambda function to the SNS topic from the AWS account that the function is in.