Amazon SNS

Amazon Simple Notification Service (SNS) is a web service that allows users to send and receive notifications from the cloud.

In order to integrate Amazon SNS with Relyance AI you will need create a custom SNS role, and establish a trust relationship with Relyance's service account, and provide the Role ARN, External ID, and Region to Relyance.

In Amazon SNS:

1. Login to your Amazon account.
2. To to the IAM console and select Roles from the left-hand navigation menu.
3. Click the Create role button.
4. Select AWS account for the Trusted entity type.
5. Click Next.
6. In the Add permissions screen you'll want to find the AmazonSNSReadOnlyAccess policy and apply.
7. Click Next.
8. In the final step, provide a meaningful Role name (eg. RelyanceSNSReadOnly) and click the Create role button.
9. Create an External ID - this can be anything. (e.g. '9599ec49-abb3-47bb-a5b6-86c79fc10d32') The external ID is a secret that you will use and enter in the Relyance platform for additional security. While it could be anything, we recommend using a secret generator such as https://www.uuidgenerator.net/version4 to generate.
10. Once created, edit the new role and select the Trust relationships tab.
11. Update the trust policy to use the Relyance service account. Click the Edit trust policy button and update the policy accordingly:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::580082088342:user/tenant-prod-access"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "<< external ID >>"
        }
      }
    }
  ]
}

Ensure you replace '<< external ID >>' with the external ID you created previously. The line with "AWS": "arn:aws:iam::580082088342:user/tenant-prod-access" grants permission to the Relyance Service Account access to the resources associated with this role. 12. Copy this Role ARN to to be used in Relyance.

In the Relyance AI application:

1. Login to your Relyance AI account.
2. Navigate to the Settings (bottom-left corner).
3. Select Integrations.
4. Search and locate the Amazon SNS integration card and click on it.
5. Click on the Add Connection button on the top right.
6. Provide a meaningful name for the integration and click on the Add button.
7. In the Overview section, select the integration features you wish to enable for the integration, review the Scope and Permission, and Endpoint details and click on Continue. For more details, see Integration Features.
8. In the Connection section, provide the appropriate values and click on Continue,
   • Connection Name: This property allows you to update the integration specified in Step 6. If you have multiple integrations for the same vendor, you may want to assign distinct names to each. This helps streamline filtering by Discovery Source across the Inventory, Visual Maps, Assets, and Data Flow Analysis pages.
   • Rescan Frequency: This property allows you to configure how often Relyance executes scans against this Vendor connection.
   • Business Atlas Associations (required): the business entities or products that newly discovered third parties, services and assets from this integration are attributed to. Choose at least one from the Select Associations dropdown — the wizard will not advance past this step without one. For more details, see Business Atlas.
9. In the Authentication section, choose the authentication method SNS Assume-Role and provide the following, retrieved from the In Amazon SNS section, then click Continue.
   • SNS Role ARN — the full ARN of the role you created, not just its name.
   • External ID
   • Region — defaults to us-east-1.
10. In the Data Inspection section, provide the appropriate values and click on Continue,
    • Minimum Confidence Level: This property adjusts the sensitivity of the Data Inspection feature. Lower likelihoods (e.g.,Very Low) offer more coverage but may produce false positives, while higher sensitivity (e.g., very High) provides greater accuracy but less coverage.
11. Review the configuration summary from the Completion section and click on Finish.
12. Confirm the integration Status reflects Connected

Verify the connection is really working

Relyance reads topics and their subscriptions: sns:ListTopics, sns:GetTopicAttributes, sns:ListSubscriptions, plus sns:ListOriginationNumbers and sns:ListSMSSandboxPhoneNumbers for SMS endpoints. AmazonSNSReadOnlyAccess covers them all.

1. A failure at Authenticate is the trust policy or the external ID.
2. Topics appear with no detail. sns:ListTopics returns ARNs; sns:GetTopicAttributes is what fills in the rest. Granting the first without the second produces a list of topics with nothing attached.
3. No SMS endpoints. The two origination-number actions are separate grants, and an account that has never used SMS legitimately has none — check in the console before treating it as a permission problem.
4. One connection per account and region. SNS topics are regional.

Manage this integration with Terraform

Connections for this integration can be managed as code with the Relyance Terraform provider. Non-secret fields go in auth.params; secret fields go in auth.secrets_wo, which is write-only — never stored in Terraform state. Rotate secrets by bumping auth.secrets_wo_version.

resource "relyance_integration_connection" "aws_sns" {
  vendor = "aws_sns"
  name   = "<your connection name>"

  auth = {
    method = "iam-role"
    params = {
      vendor_role_arn = "<vendor_role_arn>"
      region = "us-east-1"
    }
    # Secret fields are write-only: sent to Relyance, never stored in state.
    secrets_wo = {
      external_id = var.aws_sns_external_id
    }
    secrets_wo_version = 1
  }

  scans = { "data-inspection" = { enabled = true } }
}