# Solved: Publishing to created SNS topic

**URL:** <https://forum.serverless.com/t/solved-publishing-to-created-sns-topic/1426>\
**Category:** Serverless Framework\
**Created:** [March 2, 2017, 10:28pm UTC](https://forum.serverless.com/t/solved-publishing-to-created-sns-topic/1426 "2017-03-02T22:28:10Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![jjasonclark](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/jjasonclark/32/303_2.png) [@jjasonclark](https://forum.serverless.com/u/jjasonclark)\
**Post date:** [March 2, 2017, 10:28pm UTC](https://forum.serverless.com/t/solved-publishing-to-created-sns-topic/1426/1 "2017-03-02T22:28:10Z")

</div>

My pair of lambda functions cannot communicate via SNS. One publishes events and the other consumes them.

The first function subscribes to a topic. And I know it works because I can trigger it manually by adding to the topic. The other method is having an issue. It times out while waiting for the publish call to return.

What do I do to allow the publishing function publish to the SNS topic?

My current config looks like this

```auto
service: something

provider:
  name: aws
  runtime: nodejs4.3
  region: us-east-1
  memorySize: 128
  cfLogs: true
  iamRoleStatements:
    - Effect: 'Allow'
      Action:
        - "sns:Publish"
      Resource:
        - ${self:custom.myTopic}

custom:
  myTopic:
    Fn::Join:
      - ":"
      - - arn
        - aws
        - sns
        - Ref: AWS::Region
        - Ref: AWS::AccountId
        - myTopic

functions:
  published:
    handler: published.handler
    description: Receives SNS published events
    timeout: 90
    events:
      - sns:
          topicName: myTopic
          displayName: My topic

  publisher:
    handler: publisher.handler
    description: Publishes SNS events
    timeout: 30
    events:
      - schedule: cron(0 1 * * ? *)

```

I thought permissions was the issue so I added AdministratorAccess and AmazonSNSFullAccess to the created role. And that didn’t help.

My publish method is the following. I know it’s working because the topic handler lambda can publish messages back to the same topic and get the lambda launched to handle them with success.

> <https://gist.github.com/jjasonclark/ba8782ef1f2f213b3c0088a32e777778>

---

<div class="post-metadata">

**Author:** ![jjasonclark](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/jjasonclark/32/303_2.png) [@jjasonclark](https://forum.serverless.com/u/jjasonclark)\
**Post date:** [March 2, 2017, 10:45pm UTC](https://forum.serverless.com/t/solved-publishing-to-created-sns-topic/1426/2 "2017-03-02T22:45:50Z")

</div>

I also manually added code to the publish consuming function to post back to the same topic to verify the publishing code worked. It did, and a new sns message was posted.

---

<div class="post-metadata">

**Author:** ![jjasonclark](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/jjasonclark/32/303_2.png) [@jjasonclark](https://forum.serverless.com/u/jjasonclark)\
**Post date:** [March 3, 2017, 11:25pm UTC](https://forum.serverless.com/t/solved-publishing-to-created-sns-topic/1426/3 "2017-03-03T23:25:05Z")

</div>

Manually publishing messages to the topic via the AWS console works as expected. The `published` method fires and works without errors.

I also added in code to post from the published lambda back to the same topic, thus causing a 2nd run of the lambda handler. Published ran twice as expected. Meaning the same code used to publish from the publisher function works. At least it works in the context of the published function while handing a message.

I’m guessing its permissions since the published lambda can publish new messages. I thought it was just the “sns:Publish” permission, but it seems there needs to be something else.

---

<div class="post-metadata">

**Author:** ![buggy](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/buggy/32/177_2.png) [@buggy](https://forum.serverless.com/u/buggy)\
**Post date:** [March 4, 2017, 10:12am UTC](https://forum.serverless.com/t/solved-publishing-to-created-sns-topic/1426/4 "2017-03-04T10:12:49Z")

</div>

It’s always hard to debug code from fragments. Have you tried adding a

```javascript
.then(result => console.log("Success", result))
.catch(err => console.error("Error", err));

```

after the `promise()` to see what’s actually returned?

If you haven’t given the Lambda permissions to publish to the topic then my money is on that.

---

<div class="post-metadata">

**Author:** ![jjasonclark](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/jjasonclark/32/303_2.png) [@jjasonclark](https://forum.serverless.com/u/jjasonclark)\
**Post date:** [March 4, 2017, 6:18pm UTC](https://forum.serverless.com/t/solved-publishing-to-created-sns-topic/1426/5 "2017-03-04T18:18:02Z")

</div>

Its the VPC!!

I did my best to narrow down the problem by isolating components and have discovered its the VPC settings. Now I’m trying to figure how to both publish to SNS and also connect to my RDS hosted DB. From my readings I think need a NAT gateway on a subnet that the lambda is on in addition to the subnet that the DB is on.

---

<div class="post-metadata">

**Author:** ![jjasonclark](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/jjasonclark/32/303_2.png) [@jjasonclark](https://forum.serverless.com/u/jjasonclark)\
**Post date:** [March 7, 2017, 2:11am UTC](https://forum.serverless.com/t/solved-publishing-to-created-sns-topic/1426/6 "2017-03-07T02:11:20Z")

</div>

Found this great blog post

[New – Access Resources in a VPC from Your Lambda Functions](https://aws.amazon.com/blogs/aws/new-access-resources-in-a-vpc-from-your-lambda-functions/)

* * *

It says this

> Internet Access – As soon as you enable this functionality for a particular function, the function no longer has access to the Internet by default. If your function requires this type of access, you will need to set up a Managed NAT Gateway in your VPC (see New – Managed NAT (Network Address Translation) Gateway for AWS for more information) or run your own NAT (see NAT Instances).

---

<div class="post-metadata">

**Author:** ![jfk2000](https://avatars.discourse-cdn.com/v4/letter/j/da6949/32.png) [@jfk2000](https://forum.serverless.com/u/jfk2000)\
**Post date:** [March 13, 2017, 9:09am UTC](https://forum.serverless.com/t/solved-publishing-to-created-sns-topic/1426/7 "2017-03-13T09:09:04Z")

</div>

> [@jjasonclark](#):
>
> Internet Access – As soon as you enable this functionality for a particular function, the function no longer has access to the Internet by default.

I ran into the same thing with a function that when it was VPC enabled suddenly couldn’t interact with SQS. Solved by splitting the functions out (rather than fight with network security bods who controlled the security group config)