# Amazon SNS

![amazon_sns.webp](https://assets.relyanceuat.xyz/images/docs/34534583653005/34534569016845.webp)
Amazon Simple Notification Service (SNS) is a web service that allows users to send and receive notifications from the cloud.

In order to integrate Amazon SNS with Relyance AI you will need create a custom SNS role, and establish a trust relationship with Relyance's service account, and provide the **Role ARN**, **External ID**, and **Region** to Relyance.

#### In Amazon SNS:

1. Login to your Amazon account.
2. To to the **IAM** console and select **Roles** from the left-hand navigation menu.
3. Click the **Create role** button.
4. Select **AWS account** for the **Trusted entity type**.
5. Click **Next**.
6. In the **Add permissions** screen you'll want to find the *AmazonSNSReadOnlyAccess* policy and apply.
7. Click **Next**.
8. In the final step, provide a meaningful **Role name** (eg. RelyanceSNSReadOnly) and click the **Create role** button.
9. Create an **External ID** - this can be anything. (e.g. '9599ec49-abb3-47bb-a5b6-86c79fc10d32') The external ID is a secret that you will use and enter in the Relyance platform for additional security. While it could be anything, we recommend using a secret generator such as [https://www.uuidgenerator.net/version4](https://www.uuidgenerator.net/version4) to generate.
10. Once created, edit the new role and select the **Trust relationships** tab.
11. Update the trust policy to use the Relyance service account. Click the **Edit trust policy** button and update the policy accordingly:
```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::580082088342:user/tenant-prod-access"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "<< external ID >>"
        }
      }
    }
  ]
}
```
Ensure you replace '<< external ID >>' with the external ID you created previously. The line with "AWS": "arn:aws:iam::580082088342:user/tenant-prod-access" grants permission to the Relyance Service Account access to the resources associated with this role.
12. Copy this **Role ARN** to to be used in Relyance.

#### In the Relyance AI application:

1. Login to your Relyance AI account.
2. Navigate to the **Settings** (bottom-left corner).
3. Select **Integrations**.
4. Search and locate the **Amazon SNS** integration card and click on it.
5. Click on the **Add Connection** button on the top right.
6. Provide a meaningful name for the integration and click on the **Add** button.
7. In the **Overview** section, select the integration features you wish to enable for the integration, review the **Scope and Permission**, and **Endpoint** details and click on **Continue**. For more details, see [Integration Features](/docs/introduction-to-relyance-ai/integration-features/).
8. In the **Connection** section, provide the appropriate values and click on **Continue**,
    - **Connection Name**: This property allows you to update the integration specified in Step 6. If you have multiple integrations for the same vendor, you may want to assign distinct names to each. This helps streamline filtering by **Discovery Source** across the **Inventory**, **Visual** **Maps**, **Assets**, and **Data Flow Analysis** pages.
    - **Rescan Frequency**: This property allows you to configure how often Relyance executes scans against this Vendor connection.
    - **Business Atlas Associations** (required): the business entities or products that newly discovered third parties, services and assets from this integration are attributed to. Choose at least one from the **Select Associations** dropdown — the wizard will not advance past this step without one. For more details, see [Business Atlas](/docs/other-settings/business-atlas-overview/).
9. In the **Authentication** section, choose the authentication method **SNS Assume-Role** and provide the following, retrieved from the **In Amazon SNS** section, then click **Continue**.
    - **SNS Role ARN** — the full ARN of the role you created, not just its name.
    - **External ID**
    - **Region** — defaults to `us-east-1`.
10. In the Data Inspection section, provide the appropriate values and click on **Continue**,
    - **Minimum Confidence Level:** This property adjusts the sensitivity of the Data Inspection feature. Lower likelihoods (e.g.,Very Low) offer more coverage but may produce false positives, while higher sensitivity (e.g., very High) provides greater accuracy but less coverage.
11. Review the configuration summary from the **Completion** section and click on **Finish.**
12. Confirm the integration Status reflects **Connected**

![Screenshot](https://assets.relyanceuat.xyz/images/docs/34534583653005/34534583650701.png)

![Screenshot](https://assets.relyanceuat.xyz/images/docs/34534583653005/34534569017485.png)

![Screenshot 2025-11-07 111928.png](https://assets.relyanceuat.xyz/images/docs/34534583653005/40945593841677.png)

![Screenshot](https://assets.relyanceuat.xyz/images/docs/34534583653005/34534583651853.png)

![Screenshot](https://assets.relyanceuat.xyz/images/docs/34534583653005/34534569023885.png)

### Verify the connection is really working

Relyance reads topics and their subscriptions: `sns:ListTopics`,
`sns:GetTopicAttributes`, `sns:ListSubscriptions`, plus
`sns:ListOriginationNumbers` and `sns:ListSMSSandboxPhoneNumbers` for SMS
endpoints. **AmazonSNSReadOnlyAccess** covers them all.

1. **A failure at Authenticate** is the trust policy or the external ID.
2. **Topics appear with no detail.** `sns:ListTopics` returns ARNs;
   `sns:GetTopicAttributes` is what fills in the rest. Granting the first without
   the second produces a list of topics with nothing attached.
3. **No SMS endpoints.** The two origination-number actions are separate grants, and
   an account that has never used SMS legitimately has none — check in the console
   before treating it as a permission problem.
4. **One connection per account and region.** SNS topics are regional.

<!-- terraform-examples:begin (generated from the integration catalog; do not hand-edit) -->

## Manage this integration with Terraform

Connections for this integration can be managed as code with the [Relyance Terraform provider](https://registry.terraform.io/providers/Relyance/relyance/latest). Non-secret fields go in `auth.params`; secret fields go in `auth.secrets_wo`, which is write-only — never stored in Terraform state. Rotate secrets by bumping `auth.secrets_wo_version`.

```hcl
resource "relyance_integration_connection" "aws_sns" {
  vendor = "aws_sns"
  name   = "<your connection name>"

  auth = {
    method = "iam-role"
    params = {
      vendor_role_arn = "<vendor_role_arn>"
      region = "us-east-1"
    }
    # Secret fields are write-only: sent to Relyance, never stored in state.
    secrets_wo = {
      external_id = var.aws_sns_external_id
    }
    secrets_wo_version = 1
  }

  scans = { "data-inspection" = { enabled = true } }
}
```

<!-- terraform-examples:end -->