How can I troubleshoot GuardDuty custom Amazon SNS notifications that are not being delivered?
Why are my Amazon GuardDuty custom Amazon Simple Notification Service (Amazon SNS) notifications not being delivered?
"Why are my Amazon GuardDuty custom Amazon Simple Notification Service (Amazon SNS) notifications not being delivered?Short descriptionI followed the instructions to configure an Amazon EventBridge rule for GuardDuty to send custom SNS notifications if specific AWS service event types trigger. However, the SNS notifications weren't delivered.ResolutionFollow these instructions to confirm the correct settings for:Amazon SNS subscription confirmation.Amazon SNS topic AWS Identity and Access Management (IAM) access policy.AWS Key Management Service (AWS KMS) permissions.EventBridge event pattern JSON object finding type.Confirm the Amazon SNS subscriptionOpen the Amazon SNS console, and then choose Subscriptions.For your Amazon SNS subscription ID, verify that the status is Confirmed.If the status is Pending confirmation, follow the instructions to confirm the subscription.Confirm permissions for the SNS topic access policyOpen the Amazon SNS console, and then choose Topics.In Name, choose your Amazon SNS topic.In Details, choose the Access policy tab.Verify that the IAM policy allows permission to publish the events.amazonaws.com principal similar to the following:{      "Sid": "AWSEvents",      "Effect": "Allow",      "Principal": {        "Service": "events.amazonaws.com"      },      "Action": "sns:Publish",      "Resource": "arn:aws:sns:YOUR-REGION:YOUR-ACCOUNT-ID:YOUR-SNS-TOPIC"}Confirm AWS Key Management Service (AWS KMS) permissionsOpen the AWS KMS console, and then choose Customer managed keys.In Key ID, choose your AWS KMS key.In Key policy, choose Switch to policy view.Verify that the KMS key policy allows permission to publish the events.amazonaws.com principal similar to the following:{    "Sid": "AWSEvents",    "Effect": "Allow",    "Principal": {        "Service": "events.amazonaws.com"    },    "Action": [        "kms:GenerateDataKey",        "kms:Decrypt"    ],    "Resource": "*"}Confirm the EventBridge event pattern JSON object finding typeOpen the EventBridge console, and then choose Rules.In Name, choose your rule.In Event pattern, verify that the JSON object finding type matches the specific AWS service similar to the following:{  "source": [    "aws.guardduty"  ],  "detail-type": [    "GuardDuty Finding"  ]}Related informationMonitoring your security with GuardDuty in real time with Amazon Elasticsearch Service (Amazon ES)GuardDuty finding typesFollow"