为何EventBridge无法向默认权限SNS主题发消息而CloudWatch可以？

背景信息 #

某SNS主题配置了如下默认访问策略：

{
  "Version": "2008-10-17",
  "Id": "__default_policy_ID",
  "Statement": [
    {
      "Sid": "__default_statement_ID",
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": [
        "SNS:GetTopicAttributes",
        "SNS:SetTopicAttributes",
        "SNS:AddPermission",
        "SNS:RemovePermission",
        "SNS:DeleteTopic",
        "SNS:Subscribe",
        "SNS:ListSubscriptionsByTopic",
        "SNS:Publish"
      ],
      "Resource": "arn:aws:sns:us-east-1:############:NotificationTopic-test",
      "Condition": {
        "StringEquals": {
          "AWS:SourceOwner": "############"
        }
      }
    }
  ]
}

问题 #

CloudWatch告警可向该主题发送消息，但EventBridge规则无法发送。请问：EventBridge是否需要在SNS访问策略中指定Principal为{"Service": "events.amazonaws.com"}，而CloudWatch不需要？若是，原因是什么？

回答 #

是的，EventBridge需要单独在SNS访问策略中指定Principal: {"Service": "events.amazonaws.com"}，而CloudWatch告警不需要，核心原因在于两者调用SNS时的身份验证逻辑差异：

• CloudWatch告警调用SNS的Publish接口时，是以你的AWS账户身份发起请求，请求携带的AWS:SourceOwner会匹配策略中配置的账户ID，因此能通过默认策略的Condition校验，顺利发送消息。
• EventBridge规则调用SNS时，是以EventBridge服务自身的身份发起请求，此时请求的AWS:SourceOwner属于EventBridge服务所属的AWS账户，无法匹配你的账户ID，自然过不了默认策略的Condition校验。必须在SNS策略中单独添加一条允许events.amazonaws.com服务主体调用SNS:Publish的语句，才能让EventBridge成功推送消息到该主题。

示例补充策略语句：

{
  "Sid": "AllowEventBridgePublish",
  "Effect": "Allow",
  "Principal": {
    "Service": "events.amazonaws.com"
  },
  "Action": "SNS:Publish",
  "Resource": "arn:aws:sns:us-east-1:############:NotificationTopic-test"
}

内容的提问来源于stack exchange，提问作者himmel