How to fix Error: Error creating SNS Topic: AuthorizationError in Terraform

TerraformINTERMEDIATEHIGHUpdated Dec 30, 2025· 103 views

This error occurs when Terraform lacks the necessary IAM permissions to create or manage SNS topics in AWS. Fix it by ensuring your IAM user or role has sns:CreateTopic and sns:SetTopicAttributes permissions.

Quick fix

Fixes Error: Error creating SNS Topic: AuthorizationError

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "sns:CreateTopic",
        "sns:SetTopicAttributes",
        "sns:GetTopicAttributes",
        "sns:DeleteTopic"
      ],
      "Resource": "*"
    }
  ]
}
  1. Check your IAM permissions
  2. Attach SNS permissions to your IAM entity
  3. Re-run Terraform with updated credentials
  4. For cross-account SNS, verify trust relationships
terraform — error
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "sns:CreateTopic",
        "sns:SetTopicAttributes",
        "sns:GetTopicAttributes",
        "sns:DeleteTopic"
      ],
      "Resource": "*"
    }
  ]
}
Error: Error creating SNS Topic: AuthorizationError

What this error means

The AuthorizationError when creating SNS topics in Terraform indicates that the AWS credentials you're using don't have the required Identity and Access Management (IAM) permissions to create or configure SNS resources. When Terraform attempts to create an SNS topic, AWS validates the caller's permissions through IAM policies. If the policy doesn't explicitly allow the sns:CreateTopic action or related actions like sns:SetTopicAttributes, AWS returns an AuthorizationError instead of proceeding with the resource creation. This error commonly occurs in cross-account scenarios, when using restricted IAM roles, or when IAM policies haven't been properly configured with the necessary SNS permissions.

Typical symptoms

  • Terraform plan or apply fails immediately when attempting to create aws_sns_topic resources
  • Error message explicitly mentions AuthorizationError and SNS actions
  • The error occurs even with valid AWS credentials that work for other AWS services
  • Cross-account SNS subscriptions fail with AuthorizationError for ListSubscriptionsByTopic

Common causes

  1. IAM user or role lacks the sns:CreateTopic action permission
  2. Missing sns:SetTopicAttributes permission (required for topic creation with attributes)
  3. Cross-account scenario where the assume role policy or topic policy doesn't grant necessary permissions
  4. Terraform AWS provider version mismatch (some versions added additional required permissions)
  5. Explicit deny policy overriding SNS permissions for the IAM entity
  6. Region mismatch between where the topic is being created and where permissions are defined

How to fix "Error: Error creating SNS Topic: AuthorizationError"

1Check your IAM permissions

Verify that your AWS IAM user or role has the necessary SNS permissions. Log into the AWS console and navigate to the IAM dashboard to check the attached policies.

Look for an inline or managed policy that includes SNS permissions. The policy should contain:

json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "sns:CreateTopic",
        "sns:SetTopicAttributes",
        "sns:GetTopicAttributes",
        "sns:DeleteTopic"
      ],
      "Resource": "*"
    }
  ]
}

If this policy doesn't exist, you'll need to add it in the next step.

2Attach SNS permissions to your IAM entity

If your IAM user or role lacks SNS permissions, attach the necessary policy. The simplest approach is to use the AWS managed policy, but a more restrictive approach is better for security.

For a minimally privileged policy, create an inline policy with the following (replace ACCOUNT_ID and TOPIC_NAMES with your values):

json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "sns:CreateTopic",
        "sns:SetTopicAttributes",
        "sns:GetTopicAttributes",
        "sns:DeleteTopic",
        "sns:ListTopics",
        "sns:ListSubscriptionsByTopic"
      ],
      "Resource": "arn:aws:sns:*:ACCOUNT_ID:*"
    }
  ]
}

Or, attach the AWS managed policy AmazonSNSFullAccess for full access (less restrictive):

bash
aws iam attach-user-policy \
  --user-name your-username \
  --policy-arn arn:aws:iam::aws:policy/AmazonSNSFullAccess

After attaching the policy, wait 2-5 minutes for IAM changes to propagate.

3Re-run Terraform with updated credentials

Once you've added the SNS permissions, refresh your Terraform credentials and retry the deployment.

If using AWS CLI environment variables, re-export them:

bash
export AWS_ACCESS_KEY_ID="your-key-id"
export AWS_SECRET_ACCESS_KEY="your-secret-key"
export AWS_DEFAULT_REGION="us-east-1"

Then re-run Terraform:

bash
terraform init
terraform plan
terraform apply

The SNS topic should now be created successfully.

4For cross-account SNS, verify trust relationships

If you're working with cross-account SNS topics, ensure both the assume role policy and the SNS topic policy allow the necessary permissions.

The assume role policy (trust relationship) must allow the Terraform role to be assumed:

json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::SOURCE_ACCOUNT:root"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "unique-external-id"
        }
      }
    }
  ]
}

The SNS topic policy must also explicitly grant permissions:

json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::SOURCE_ACCOUNT:role/terraform-role"
      },
      "Action": [
        "sns:CreateTopic",
        "sns:SetTopicAttributes",
        "sns:Subscribe",
        "sns:Publish"
      ],
      "Resource": "arn:aws:sns:*:ACCOUNT_ID:*"
    }
  ]
}
5Check for explicit deny policies

Search your IAM policies for any explicit deny statements that might override allow statements.

bash
aws iam list-attached-user-policies --user-name your-username
aws iam get-user-policy --user-name your-username --policy-name policy-name

Look for any policy containing:

json
{
  "Effect": "Deny",
  "Action": "sns:*"
}

If you find explicit denies, either remove them or add a condition to exclude your Terraform operations. Remember that explicit denies always override allows in AWS IAM.

Advanced notes

Version-specific considerations: AWS Provider v5.94.0+ changed how SNS subscriptions are queried, requiring additional ListSubscriptionsByTopic permissions. If upgrading causes AuthorizationErrors, ensure your IAM policy includes this action.

ABAC (Attribute-Based Access Control): Some organizations use ABAC tags instead of traditional IAM policies. Ensure your ABAC tags grant the necessary SNS actions if your organization uses attribute-based policies.

Terraform State Lock: If using a remote state backend (S3, Terraform Cloud), ensure the backend credentials also have appropriate IAM permissions. Backend credential issues can appear as SNS-related errors in some cases.

IAM Policy Propagation: AWS IAM policy changes can take 2-5 minutes to fully propagate across all AWS regions and services. If you've just updated a policy, wait a few minutes before retrying.

Frequently asked questions

What does "Error: Error creating SNS Topic: AuthorizationError" mean?
The AuthorizationError when creating SNS topics in Terraform indicates that the AWS credentials you're using don't have the required Identity and Access Management (IAM) permissions to create or configure SNS resources. When Terraform attempts to create an SNS topic, AWS validates the caller's permissions through IAM policies. If the policy doesn't explicitly allow the sns:CreateTopic action or related actions like sns:SetTopicAttributes, AWS returns an AuthorizationError instead of proceeding with the resource creation.
How do I fix "Error: Error creating SNS Topic: AuthorizationError"?
This error occurs when Terraform lacks the necessary IAM permissions to create or manage SNS topics in AWS. Fix it by ensuring your IAM user or role has sns:CreateTopic and sns:SetTopicAttributes permissions.
What causes "Error: Error creating SNS Topic: AuthorizationError"?
IAM user or role lacks the sns:CreateTopic action permission Missing sns:SetTopicAttributes permission (required for topic creation with attributes) Cross-account scenario where the assume role policy or topic policy doesn't grant necessary permissions
Is the "Error: Error creating SNS Topic: AuthorizationError" error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading