2.2.4. SNS Notifications and AWS User Notifications
š” First Principle: An alert that reaches the wrong person at the wrong time is as bad as no alert. SNS is the notification bus that carries alerts from AWS services to humans and other systems. Understanding its delivery model ā fan-out to multiple subscribers ā is key to building reliable alerting architectures.
SNS Core Concepts:
| Concept | Description |
|---|---|
| Topic | A named channel; publishers send to it, subscribers receive from it |
| Subscription | A delivery endpoint for a topic (email, SMS, Lambda, SQS, HTTP/S, mobile push) |
| Publisher | Any AWS service or application that sends messages to the topic |
| Message Filtering | Subscription filter policies route only relevant messages to each subscriber |
Fan-out Pattern: One SNS message can trigger multiple actions simultaneously. This is a critical architecture pattern:
Message Filtering: Without filtering, every subscriber receives every message ā including noise irrelevant to their role. A subscription filter policy is a JSON document that specifies attribute conditions. Only messages with matching attributes are delivered to that subscriber.
{
"severity": ["CRITICAL", "HIGH"],
"environment": ["production"]
}
AWS User Notifications is a newer service that provides a unified notification experience across AWS. It aggregates notifications from multiple AWS services (Health events, Security Hub findings, CloudWatch alarms) and delivers them to multiple channels (email, AWS Console mobile app, Slack, Chime) with a consistent format. Think of it as a managed notification hub that sits above individual service alerts.
ā ļø Exam Trap: SNS topics are regional ā a topic in us-east-1 is separate from a topic in us-west-2. If you need cross-region alerting, either replicate the alarm configuration in each region or route events through EventBridge cross-region before publishing to SNS.
Reflection Question: Your team has 5 sub-teams, each responsible for different services. All alerts currently go to one SNS topic, and every engineer gets paged for every alert. How would you redesign the alerting architecture using SNS features?
