Notifications permissions

Publishing, subscription management, and signing-secret access use separate IAM actions. Email and webhook confirmation endpoints use their confirmation tokens instead of an IAM action.

Actions

The endpoint reference describes request fields and responses. This table maps each call to its IAM action.

Call	Required action
`GET /v1/topics`	`notifications:ListTopics`
`POST /v1/topics`	`notifications:CreateTopic`
`GET /v1/topics/{topic_id}`	`notifications:DescribeTopic`
`PATCH /v1/topics/{topic_id}`	`notifications:UpdateTopic`
`DELETE /v1/topics/{topic_id}`	`notifications:DeleteTopic`
`GET /v1/topics/{topic_id}/policy`	`notifications:GetTopicPolicy`
`PUT /v1/topics/{topic_id}/policy`	`notifications:PutTopicPolicy`
`DELETE /v1/topics/{topic_id}/policy`	`notifications:DeleteTopicPolicy`
`POST /v1/topics/{topic_id}/publish`	`notifications:Publish`
`POST /v1/topics/{topic_id}/publish-batch`	`notifications:Publish`
`GET /v1/topics/{topic_id}/subscriptions`	`notifications:ListSubscriptions`
`POST /v1/topics/{topic_id}/subscriptions`	`notifications:Subscribe`
`GET /v1/topics/{topic_id}/subscriptions/{subscription_id}`	`notifications:DescribeSubscription`
`PATCH /v1/topics/{topic_id}/subscriptions/{subscription_id}`	`notifications:UpdateSubscription`
`DELETE /v1/topics/{topic_id}/subscriptions/{subscription_id}`	`notifications:Unsubscribe`
`POST /v1/topics/{topic_id}/subscriptions/{subscription_id}/resend-confirmation`	`notifications:ResendConfirmation`
`GET /v1/topics/{topic_id}/subscriptions/{subscription_id}/signing-secret`	`notifications:GetSubscriptionSigningSecret`
`POST /v1/topics/{topic_id}/subscriptions/{subscription_id}/signing-secret/rotate`	`notifications:RotateSubscriptionSigningSecret`
`GET /v1/topics/{topic_id}/messages`	`notifications:ListMessages`
`GET /v1/topics/{topic_id}/messages/{message_id}`	`notifications:DescribeMessage`
`GET /v1/topics/{topic_id}/deliveries`	`notifications:ListDeliveries`

Message and delivery reads authorize against the parent topic and its tags. Metrics use telemetry:ReadMetrics in the selected account and region.

Cross-service permissions

Subscribing a queue requires notifications:Subscribe on the topic and queue:SendMessage on the destination queue. The queue must belong to the same account and region. A dead-letter queue also requires queue:SendMessage; updating a subscription to use a new dead-letter queue checks that grant again.

Signing secrets

notifications:DescribeSubscription returns subscription metadata. notifications:GetSubscriptionSigningSecret reads the webhook signing secret, and notifications:RotateSubscriptionSigningSecret rotates it. Grant these independently.

Example policy

This policy grants only the listed collection reads. It does not grant permission to send messages or manage resources.

{
  "version": "2024-01-01",
  "statements": [
    {
      "effect": "allow",
      "actions": [
        "notifications:ListTopics",
        "notifications:ListSubscriptions"
      ],
      "resources": [
        "*"
      ]
    }
  ]
}

See IAM policies for policy evaluation and Notifications for the service overview.

Get started

Products

Platform

Help

Notifications permissions

Actions

Cross-service permissions

Signing secrets

Example policy

​Actions

​Cross-service permissions

​Signing secrets

​Example policy

Actions

Cross-service permissions

Signing secrets

Example policy