Message

trigger.sns_event

TriggerAmazon Web Servicesconnection requiredruns in-engine

Subscribes an https endpoint to the topic at publish, confirms the subscription itself, and starts one run per notification — each verified against SNS's X.509 signature.

Start a run when a message is published to an Amazon SNS topic — CloudWatch alarms, S3 events, budgets, anything that fans out through SNS.

Ask about Amazon SNS All Amazon SNS nodes

Connection

Required: Yes — the node will not save without one
Auth type: API key
Providers: Amazon SNS
Secret shape: {"access_key_id", "secret_access_key"}
Config it needs: region
Resolved by: config.connection_id, else node.connection_id
Note: The credentials need sns:Subscribe, sns:Unsubscribe and sns:ListSubscriptionsByTopic on the topic — a policy that can publish can often not subscribe, and that only shows up at publish. Publishing also needs MANTLE_APP_PUBLIC_BASE_URL set to an https URL SNS can reach; SNS refuses to deliver to a host it cannot resolve.

Configuration

4 fields, 1 required. A dotted path is a nested object and name[] an array of objects — the editor renders the same tree.

Field	Type	Required	Default	Constraints	Example
topic_arn The SNS topic to listen to, e.g. arn:aws:sns:us-east-1:123456789012:alerts. Read at publish time, so it must be a literal ARN rather than an expression.	string	Yes	—	matches ^arn:aws[a-z-]*:sns:[a-z0-9-]+:\d{12}:[A-Za-z0-9_-]{1,256}(?:\.fifo)?$	arn:aws:sns:us-east-1:123456789012:alerts
region AWS region to sign in. Normally left empty — the region is read out of the topic ARN, which is the only region the topic can be reached in.	string	No	—	—	—
filter_policy An SNS subscription filter policy, so AWS drops the messages this workflow does not want before they are ever delivered, e.g. {"severity": ["high"]}. Leave empty to receive everything on the topic.	object	No	—	—	{"severity":["high"]}
filter_policy_scope Whether the filter policy matches the message attributes or the message body. Only meaningful together with filter_policy.	string	Conditional	MessageAttributes	one of "MessageAttributes", "MessageBody"; only with filter_policy	—

Example configuration

Every value below is the contract’s own example or default — nothing invented.

{
  "filter_policy": {
    "severity": [
      "high"
    ]
  },
  "filter_policy_scope": "MessageAttributes",
  "topic_arn": "arn:aws:sns:us-east-1:123456789012:alerts"
}

Output

One shape.

sns notification

The notification, flattened. The published body is under `message` (and `message_json` when it is JSON); the envelope's signature and unsubscribe fields are transport and are not emitted.

Field	Type	Example
id SNS's MessageId. Also the idempotency key: SNS reuses the original id for every retry of a message, so a redelivery joins the run it already started instead of starting a second.	string	22b80b92-fdea-4c2c-8f9d-bdfb0c7bf324
topic_arn The topic the message was published to — always the one this trigger subscribed to, because a message from any other topic is refused.	string	arn:aws:sns:us-east-1:123456789012:alerts
subject The optional Subject the publisher set, or '' when it set none.	string	ALARM: checkout-latency
message The message body exactly as published — a string, always, even when it contains JSON.	string	{"AlarmName": "checkout-latency", "NewStateValue": "ALARM"}
message_json The message parsed, when it is a JSON object or array (S3 events, CloudWatch alarms and Budgets all publish JSON). Empty when the message is plain text.	object	—
timestamp When SNS published the notification (GMT, ISO 8601).	string	2024-05-30T12:00:00.000Z
message_attributes The publisher's message attributes, as SNS sends them: {"name": {"Type": …, "Value": …}}. Empty when there are none.	object	—
subscription_arn The subscription that received it (x-amz-sns-subscription-arn).	string	arn:aws:sns:us-east-1:123456789012:alerts:c9135db0-26c4-47ec-8998-413945fb5a96

{
  "id": "22b80b92-fdea-4c2c-8f9d-bdfb0c7bf324",
  "message": "{\"AlarmName\": \"checkout-latency\", \"NewStateValue\": \"ALARM\"}",
  "message_attributes": {
    "severity": {
      "Type": "String",
      "Value": "high"
    }
  },
  "message_json": {
    "AlarmName": "checkout-latency",
    "NewStateValue": "ALARM"
  },
  "subject": "ALARM: checkout-latency",
  "subscription_arn": "arn:aws:sns:us-east-1:123456789012:alerts:c9135db0-26c4-47ec-8998-413945fb5a96",
  "timestamp": "2024-05-30T12:00:00.000Z",
  "topic_arn": "arn:aws:sns:us-east-1:123456789012:alerts"
}

Notes

Publishing creates the subscription at SNS and confirms it; unpublishing, disabling or archiving unsubscribes. A workflow that is off is off at AWS.
SNS confirms an https subscription by calling the endpoint back, so the trigger only goes live once that arrives — usually within a minute of publish, and the token stays valid for two days.
Every delivery is verified against SNS's own X.509 signature and refused unless its TopicArn is the topic this trigger subscribed to.
One run per notification, idempotent on MessageId — SNS reuses the original id for every retry, so a redelivery cannot start a second run.
Raw message delivery is switched off on the subscription: a raw delivery carries no signature, and an unverifiable trigger is worse than none.

Related Amazon SNS nodes

Publish

See Message run in a workflow.

In a technical demo we add the Amazon SNS connection, drop the node on the canvas and let Workflow Health pre-flight it before the first real run.

Book a technical demo Talk to sales