I trying to implementing AWS Budgets in my AWS Organization/Member Account and trigger the SNS topic present in Root Account.
AWS Account hierarchy :
- In the Member/ Organization Account (XYZ), I have created an AWS budget.
- When the budget threshold is crossed, it publish a message to the SNS topic that is been created in the Root AWS Account (ABC).
- The SNS Topic will trigger a lambda function to perform some business logic.
Architecture :
Issue is that when i paste the Root account SNS Topic ARN in Member account AWS Budget setting its throws this error -> "Your budget must have permissions to send a notification to your topic"
So, I followed the steps mentioned in the AWS Doc : https://docs.aws.amazon.com/cost-management/latest/userguide/budgets-sns-policy.html and added SNS Topic Access policy
But still getting the same error.

SNS Topic Access Policy :
{
"Version": "2008-10-17",
"Id": "__default_policy_ID",
"Statement": [
{
"Sid": "__default_statement_ID",
"Effect": "Allow",
"Principal": {
"AWS": "*"
},
"Action": [
"SNS:Publish",
"SNS:RemovePermission",
"SNS:SetTopicAttributes",
"SNS:DeleteTopic",
"SNS:ListSubscriptionsByTopic",
"SNS:GetTopicAttributes",
"SNS:AddPermission",
"SNS:Subscribe"
],
"Resource": "arn:aws:sns:us-east-1:ROOT_ACCOUNT_ID:AWS_Sandbox_Budget",
"Condition": {
"StringEquals": {
"AWS:SourceOwner": "*"
}
}
},
{
"Sid": "AWSBudgetsSNSPublishingPermissions",
"Effect": "Allow",
"Principal": {
"Service": "budgets.amazonaws.com"
},
"Action": "SNS:Publish",
"Resource": "arn:aws:sns:us-east-1:ROOT_ACCOUNT_ID:AWS_Sandbox_Budget",
"Condition": {
"StringEquals": {
"AWS:SourceOwner": "*"
}
}
}
]
}
How do i fix this ?
PLEASE help me fix this issue, I don't want to move the Root account Architecture to member account.

