diff --git a/changelogs/fragments/sns_topic-cross-account.yml b/changelogs/fragments/sns_topic-cross-account.yml new file mode 100644 index 00000000000..968811b7693 --- /dev/null +++ b/changelogs/fragments/sns_topic-cross-account.yml @@ -0,0 +1,2 @@ +bugfixes: +- sns_topic - avoid fetching attributes from subscribers when not setting them, this can cause permissions issues (https://github.com/ansible-collections/community.aws/pull/1418). diff --git a/plugins/modules/sns_topic.py b/plugins/modules/sns_topic.py index 7bf643cb96e..bcaf44a8840 100644 --- a/plugins/modules/sns_topic.py +++ b/plugins/modules/sns_topic.py @@ -519,8 +519,8 @@ def _set_topic_subs_attributes(self): for sub in list_topic_subscriptions(self.connection, self.module, self.topic_arn): sub_key = (sub['Protocol'], sub['Endpoint']) sub_arn = sub['SubscriptionArn'] - if sub_key not in self.desired_subscription_attributes: - # subscription isn't defined in desired, skipping + if not self.desired_subscription_attributes.get(sub_key): + # subscription attributes aren't defined in desired, skipping continue try: