Aurora事件未推送至SNS Topic？求助排查与解决方法

我通过Terraform配置Aurora PostgreSQL数据库，期望将集群或实例的所有事件推送至指定邮箱。完成订阅并通过邮箱验证后，收到了订阅成功通知，但后续AWS控制台显示每小时有事件产生，SNS却未接收除初始通知外的其他事件，也未推送邮件。已反复检查权限但问题仍未解决，附上相关Terraform代码，寻求排查方向与解决方法：

resource "aws_kms_key" "writer_rds_sns_encryption_key" {
  key_usage = "ENCRYPT_DECRYPT"
  policy = <<POLICY
  {
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": [
          "arn:aws:iam::${var.aws_account}:root",
          "${var.rds_role}"
        ]
      },
      "Action": [
        "kms:*"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "events.rds.amazonaws.com"
      },
      "Action": [
        "kms:Encrypt",
        "kms:DescribeKey",
        "kms:*"
      ],
      "Resource": "*"
    }
  ]
}
POLICY
  enable_key_rotation = true
}

resource "aws_sns_topic" "cluster_event_topic" {
  name              = "..."
  kms_master_key_id = aws_kms_key.writer_rds_sns_encryption_key.id
}

#tfsec:ignore:aws-iam-no-policy-wildcards
data "aws_iam_policy_document" "event_subscription_policy" {
  statement {
    actions = [
      "sns:AddPermission",
      "sns:DeleteTopic",
      "sns:GetDataProtectionPolicy",
      "sns:GetTopicAttributes",
      "sns:ListSubscriptionsByTopic",
      "sns:Publish",
      "sns:PutDataProtectionPolicy",
      "sns:RemovePermission",
      "sns:SetTopicAttributes",
      "sns:Subscribe"
    ]

    effect = "Allow"

    principals {
      type        = "Service"
      identifiers = ["events.rds.amazonaws.com"]
    }

    resources = ["*"]
  }
}

resource "aws_sns_topic_policy" "event_subscription_policy_attach" {
  arn    = aws_sns_topic.cluster_event_topic.arn
  policy = data.aws_iam_policy_document.event_subscription_policy.json
}

resource "aws_db_event_subscription" "cluster_event_subscription" {
  name             = "..."
  sns_topic        = aws_sns_topic.cluster_event_topic.arn

  source_type      = "db-cluster"
  source_ids       = [aws_rds_cluster.aurora_db.id]

  event_categories = [
    "failover",
    "migration",
    "failure",
    "notification",
    "serverless",
    "creation",
    "deletion",
    "maintenance",
    "configuration change",
    "global-failover"
  ]
  lifecycle {
    replace_triggered_by = [
      aws_rds_cluster.aurora_db.id
    ]
  }
}

resource "aws_sns_topic_subscription" "audit_topic_subscription" {
  topic_arn = aws_sns_topic.cluster_event_topic.arn
  protocol  = "email"
  endpoint  = "..."
}

1. 修正KMS密钥的服务主体权限 #

RDS事件通知的服务主体应为rds.amazonaws.com，而非events.rds.amazonaws.com，这是核心问题之一。修改KMS策略中的对应Principal，并精简必要权限：

{
  "Effect": "Allow",
  "Principal": {
    "Service": "rds.amazonaws.com"
  },
  "Action": [
    "kms:Encrypt",
    "kms:GenerateDataKey",
    "kms:DescribeKey"
  ],
  "Resource": "*"
}

2. 优化SNS Topic Policy #

• 将资源范围从通配符*改为当前SNS Topic的ARN，避免权限范围过大：

  resources = [aws_sns_topic.cluster_event_topic.arn]
  

• 精简权限，RDS仅需要sns:Publish权限即可发布事件到SNS，移除其他不必要的Action：

  actions = ["sns:Publish"]
  

• 同步修正服务主体为rds.amazonaws.com，和KMS策略保持一致。

3. 检查DB Event Subscription配置 #

• 测试时可将event_categories改为["all"]，确认是否能收到所有事件，再逐步缩小到需要的类别；
• 确认source_ids是否正确：可尝试替换为aws_rds_cluster.aurora_db.arn，确保集群关联无误；
• 如果需要接收实例级事件，需新增source_type = "db-instance"的订阅。

4. 其他验证步骤 #

• 确认SNS订阅状态为confirmed，可在AWS控制台或Terraform状态中查看aws_sns_topic_subscription.audit_topic_subscription的confirmation_status；
• 查看CloudTrail日志，搜索sns:Publish和rds:GenerateDbEvent操作，排查是否有访问拒绝错误；
• 检查邮箱垃圾邮件文件夹，确认事件邮件未被误归类。

内容的提问来源于stack exchange，提问作者Dave McGinnis