Grants the CloudWatch alarm service principal what it needs to publish alarm
notifications to an SNS topic: sns:Publish on the topic and, when the topic is
CMK-encrypted, kms:Decrypt + kms:GenerateDataKey* on the key.
Both grants carry aws:SourceAccount and aws:SourceArn conditions to prevent the
confused-deputy problem, so the CloudWatch service principal may only act on behalf
of alarms in this account and region matching alarmNamePattern.
The KMS grant is required for CloudWatch to publish to a CMK-encrypted topic at all
see "Enable compatibility between event sources from AWS services and encrypted
topics":
https://docs.aws.amazon.com/sns/latest/dg/sns-key-management.html#compatibility-with-aws-services
It conveys no ability to read anything else the key protects: reading CloudWatch
Logs data additionally requires the logs.<region>.amazonaws.com grant with its
kms:EncryptionContext:aws:logs:arn condition. Callers that would rather not widen
a shared key's policy can pass a dedicated masterKey.
NOTE: unlike the EventBridge-to-encrypted-topic case, conditions here are both
supported and correct. AWS documents that aws:SourceAccount / aws:SourceArn /
aws:SourceOrgID are not supported in a KMS policy for EventBridge delivery, so
do not copy this conditioning onto an EventBridge grant - the KMS request does not
carry those keys and every notification would be dropped silently.
Because the conditions match on an alarm name pattern rather than on full alarm
ARNs, this can be called before the alarms are constructed. That ordering matters:
the alarms take the topic ARN as their action, so granting after the fact would
introduce a circular dependency.
Parameters
scope: Construct
Construct scope used to resolve the stack account and region
Grants the CloudWatch alarm service principal what it needs to publish alarm notifications to an SNS topic:
sns:Publishon the topic and, when the topic is CMK-encrypted,kms:Decrypt+kms:GenerateDataKey*on the key.Both grants carry
aws:SourceAccountandaws:SourceArnconditions to prevent the confused-deputy problem, so the CloudWatch service principal may only act on behalf of alarms in this account and region matchingalarmNamePattern.The KMS grant is required for CloudWatch to publish to a CMK-encrypted topic at all
logs.<region>.amazonaws.comgrant with itskms:EncryptionContext:aws:logs:arncondition. Callers that would rather not widen a shared key's policy can pass a dedicatedmasterKey.NOTE: unlike the EventBridge-to-encrypted-topic case, conditions here are both supported and correct. AWS documents that
aws:SourceAccount/aws:SourceArn/aws:SourceOrgIDare not supported in a KMS policy for EventBridge delivery, so do not copy this conditioning onto an EventBridge grant - the KMS request does not carry those keys and every notification would be dropped silently.Because the conditions match on an alarm name pattern rather than on full alarm ARNs, this can be called before the alarms are constructed. That ordering matters: the alarms take the topic ARN as their action, so granting after the fact would introduce a circular dependency.