amazon-web-servicesamazon-s3amazon-snsamazon-sesaws-access-policy

What is difference between aws:SourceAccount and aws:SourceOwner AWS SNS access policy statements


AWS documentation has examples of different SNS access control configurations.

There are two similar configuration examples:

The first one allows to publish notifications from another account's S3 bucket to SNS topic:

{
  "Effect": "Allow",
   "Principal": { 
    "Service": "s3.amazonaws.com" 
  },
  "Action": "sns:Publish",
  "Resource": "arn:aws:sns:us-east-2:111122223333:MyTopic",
  "Condition": {
    "StringEquals": {
      "AWS:SourceAccount": "444455556666"
    }       
  }
}

The second one allows to publish notifications from another account's SES email to SNS topic:

{
  "Effect": "Allow",
  "Principal": {
    "Service": "ses.amazonaws.com"
  },
  "Action": "SNS:Publish",
  "Resource": "arn:aws:sns:us-east-2:444455556666:MyTopic",
  "Condition": {
    "StringEquals": {
      "aws:SourceOwner": "111122223333"
    }
  }
}

The difference is that the first example uses aws:SourceAccount and the second one uses aws:SourceOwner.

The docs has a dedicated paragraph called "aws:SourceAccount versus aws:SourceOwner" but the distinction between these two statements is stil unclear to me.

Could you please clarify the difference between aws:SourceAccount and aws:SourceOwner policy statements?


Solution

  • The difference can be seen only when the owner of a resource is different from the account that the resource belongs to. It's an advanced setup. Here is an excerpt from the official doc that gives an example of this kind of setup.

    ... it is possible for another account to own a resource in your account. For example, the trusting account might allow the trusted account to create new resources, such as creating new objects in an Amazon S3 bucket.

    Source