Ravindra BagaleCourses & study guides मराठी Track your progress

AWS CLI SNS Commands: Create Topic, Subscribe and Publish

By , trainer LinkedIn Last updated:

We send one message to many receivers: create a topic, subscribe email and SQS, publish, filter and clean up.

What you'll learn in this chapter

  • Create a topic
  • Subscribe email and SQS
  • Publish messages
  • Use filter policies
  • Send SMS and clean up

1. The big picture: a WhatsApp group

Why do we need this?

You post once in a society WhatsApp group and every member gets it. SNS is that group: you publish once to a topic and every subscriber gets a copy.

What is it?

Commands are in aws sns: create-topic, subscribe, publish, set-subscription-attributes, delete-topic.

How to do it (step by step)

Pub/sub workflowcreate-topicsubscribe email / sqs / lambdaconfirm the emailpublishevery subscriber gets a copy
Email subscriptions stay pending until confirmed.

2. Create a topic

Why do we need this?

Many systems need the same news, like "order placed".

What is it?

A topic is a named channel with an ARN. Standard topics are fast; FIFO topics keep order.

How to do it (step by step)

  1. Create it.
T=$(aws sns create-topic --name cli-alerts --query TopicArn --output text)
echo $T

Expected output:

arn:aws:sns:ap-south-1:111122223333:cli-alerts
  1. List topics.
aws sns list-topics --query "Topics[].TopicArn" --output text

Expected output:

arn:aws:sns:ap-south-1:111122223333:cli-alerts

3. Subscribe

Why do we need this?

People want email and programs want a queue.

What is it?

subscribe takes a protocol (email, sqs, lambda, https, sms) and an endpoint. Email needs a click to confirm.

How to do it (step by step)

  1. Subscribe an email.
aws sns subscribe --topic-arn $T --protocol email --notification-endpoint you@example.com

Expected output:

{"SubscriptionArn": "pending confirmation"}
  1. Subscribe an SQS queue.
Q=arn:aws:sqs:ap-south-1:111122223333:cli-q
aws sns subscribe --topic-arn $T --protocol sqs --notification-endpoint $Q --attributes RawMessageDelivery=true --query SubscriptionArn --output text

Expected output:

arn:aws:sns:ap-south-1:111122223333:cli-alerts:5e6f...
  1. List subscriptions.
aws sns list-subscriptions-by-topic --topic-arn $T --query "Subscriptions[].[Protocol,SubscriptionArn]" --output text

Expected output:

email  PendingConfirmation
sqs    arn:aws:sns:...:5e6f...

4. Publish

Why do we need this?

Your app must announce an event once without knowing who listens.

What is it?

publish sends a message with an optional subject and message attributes. It returns a MessageId.

How to do it (step by step)

  1. Publish a message.
aws sns publish --topic-arn $T --subject "Order" --message "Order 101 placed" --message-attributes '{"type":{"DataType":"String","StringValue":"order"}}' --query MessageId --output text

Expected output:

b7c8d9e0-1234-5678-9abc-def012345678
  1. Send one SMS.
aws sns publish --phone-number +919800000000 --message "OTP 4321" --query MessageId --output text

Expected output:

f1e2d3c4-...

5. Filter policies

Why do we need this?

The billing queue wants only payment events, not every message.

What is it?

A FilterPolicy on a subscription lets through only messages whose attributes match.

How to do it (step by step)

  1. Set a filter.
S=$(aws sns list-subscriptions-by-topic --topic-arn $T --query "Subscriptions[?Protocol=='sqs'].SubscriptionArn" --output text)
aws sns set-subscription-attributes --subscription-arn $S --attribute-name FilterPolicy --attribute-value '{"type":["payment"]}'

Expected output:

(no output means success)
  1. Verify.
aws sns get-subscription-attributes --subscription-arn $S --query Attributes.FilterPolicy --output text

Expected output:

{"type":["payment"]}

6. Same action in Python, Node.js, Java, Go, .NET and PHP

Why do we need this?

Scripts start in the CLI. Apps call the same API through an SDK. Knowing both helps you move a tested command into real code.

What is it?

Each CLI command maps to one API call. For example aws sns publish --topic-arn $T --message "hi" maps to the Publish API.

How to do it (step by step)

Same action (Publish) from code. Every SDK reads the same profile, region and credentials as the CLI.

StackCode
Python (boto3)boto3.client("sns").publish(TopicArn=T,Message="hi")
Node.js (v3)await sns.send(new PublishCommand({TopicArn:T,Message:"hi"}));
Java (v2)sns.publish(r -> r.topicArn(t).message("hi"));
Go (v2)c.Publish(ctx, &sns.PublishInput{TopicArn: aws.String(t), Message: aws.String("hi")})
.NETawait sns.PublishAsync(new PublishRequest{TopicArn=t,Message="hi"});
PHP$sns->publish(["TopicArn"=>$t,"Message"=>"hi"]);

7. Clean up so nothing keeps costing

Why do we need this?

Lab resources left running cost money and can be a security risk.

What is it?

Delete in reverse order: children first, then parents.

How to do it (step by step)

  1. Delete the topic (subscriptions go too).
aws sns delete-topic --topic-arn $T

Expected output:

(no output means success)
  1. Verify.
aws sns list-topics --query "Topics[?contains(TopicArn,'cli-alerts')]"

Expected output:

[]

Ravindra Bagale's Tip

For SNS to SQS, the queue policy must allow sns.amazonaws.com to SendMessage with your topic as the source, or messages silently never arrive.

8. Interview questions and answers

Q. SNS vs SQS?

SNS pushes to many subscribers. SQS stores messages until one consumer pulls them.

Q. What is fan-out?

One SNS topic delivering to many SQS queues.

Q. Why pending confirmation?

Email endpoints must confirm to prevent spam.

Q. What does a filter policy do?

Drops messages whose attributes do not match for that subscription.

Q. What is RawMessageDelivery?

Sends only the message body, without the SNS JSON wrapper.

Try at home

  1. Fan out one topic to two queues and publish once.
  2. Add a filter so one queue gets only type=payment.

In short

  1. create-topic.
  2. subscribe protocol + endpoint.
  3. Confirm email.
  4. publish once.
  5. FilterPolicy.

Practice Tasks

About this scenario

Stockholm Games is a gaming business in Stockholm. Erik Lindqvist looks after its IT and cloud work. They count money in SEK and run their AWS resources in the eu-north-1 Region. In the tasks below you do real jobs for them using what this lesson teaches. All names, account IDs, IP addresses and numbers are made up for practice.

0 / 11

Easy Publish to one topic

Why: An alerting app only needs to publish.

What to do: Allow sns:Publish on arn:aws:sns:eu-north-1:124495484726:sthlmgames-alerts only.

How:
  1. Start with { "Version": "2012-10-17", "Statement": [ ... ] }.
  2. In each statement write Effect, Action and Resource.
  3. Give only what the task needs (least privilege).
  4. Use double quotes and commas correctly. Click Check answer.

Easy Publish a message

Why: One publish reaches email, SMS, SQS and Lambda subscribers together.

What to do: Publish the message "Stock low in Stockholm" with subject "Stock alert" to arn:aws:sns:eu-north-1:124495484726:sthlmgames-alerts.

How:
  1. Read the task and decide which AWS service it is about.
  2. Write aws, then the service name, then the operation (the action word).
  3. Add each needed flag (--name) followed by its value from the task.
  4. Flags can be in any order. Click Check answer.

Easy Create an SNS topic

Why: A topic is a channel: publish once, every subscriber gets it.

What to do: Create topic sthlmgames-alerts.

How:
  1. Read the task and decide which AWS service it is about.
  2. Write aws, then the service name, then the operation (the action word).
  3. Add each needed flag (--name) followed by its value from the task.
  4. Flags can be in any order. Click Check answer.

Easy Create a queue

Why: A queue holds work safely until a worker is ready.

What to do: Create queue sthlmgames-orders.

How:
  1. Read the task and decide which AWS service it is about.
  2. Write aws, then the service name, then the operation (the action word).
  3. Add each needed flag (--name) followed by its value from the task.
  4. Flags can be in any order. Click Check answer.

Medium Send an SMS directly

Why: SNS can send a one-off SMS to a phone number without a topic.

What to do: Send the SMS "Your OTP is 482913" to +919800000001.

How:
  1. Read the task and decide which AWS service it is about.
  2. Write aws, then the service name, then the operation (the action word).
  3. Add each needed flag (--name) followed by its value from the task.
  4. Flags can be in any order. Click Check answer.

Medium Producer may only send

Why: The web app should add jobs but never read or delete them.

What to do: Allow sqs:SendMessage on arn:aws:sqs:eu-north-1:124495484726:sthlmgames-orders only.

How:
  1. Start with { "Version": "2012-10-17", "Statement": [ ... ] }.
  2. In each statement write Effect, Action and Resource.
  3. Give only what the task needs (least privilege).
  4. Use double quotes and commas correctly. Click Check answer.

Medium Subscribe an email

Why: Email subscribers must click the confirm link before they receive messages.

What to do: Subscribe ops@sthlmgames.se by email to arn:aws:sns:eu-north-1:124495484726:sthlmgames-alerts.

How:
  1. Read the task and decide which AWS service it is about.
  2. Write aws, then the service name, then the operation (the action word).
  3. Add each needed flag (--name) followed by its value from the task.
  4. Flags can be in any order. Click Check answer.

Medium Delete a processed message

Why: If you do not delete it, the message comes back after the visibility timeout.

What to do: Delete the message with receipt handle stored in $RH from https://sqs.eu-north-1.amazonaws.com/124495484726/sthlmgames-orders.

How:
  1. Read the task and decide which AWS service it is about.
  2. Write aws, then the service name, then the operation (the action word).
  3. Add each needed flag (--name) followed by its value from the task.
  4. Flags can be in any order. Click Check answer.

Hard Add a subscription filter policy

Why: A filter policy sends a subscriber only the messages it cares about.

What to do: Set the FilterPolicy of subscription arn:aws:sns:eu-north-1:124495484726:sthlmgames-alerts:4b1c-77 to {"type":["refund"]}.

How:
  1. Read the task and decide which AWS service it is about.
  2. Write aws, then the service name, then the operation (the action word).
  3. Add each needed flag (--name) followed by its value from the task.
  4. Flags can be in any order. Click Check answer.

Hard Subscribe a queue to a topic

Why: Fan-out: one SNS message is copied to many SQS queues for different workers.

What to do: Subscribe queue arn:aws:sqs:eu-north-1:124495484726:sthlmgames-billing to arn:aws:sns:eu-north-1:124495484726:sthlmgames-alerts.

How:
  1. Read the task and decide which AWS service it is about.
  2. Write aws, then the service name, then the operation (the action word).
  3. Add each needed flag (--name) followed by its value from the task.
  4. Flags can be in any order. Click Check answer.

Hard Attach a dead-letter queue

Why: After a few failed tries, bad messages move to a DLQ instead of blocking the queue.

What to do: Set the attributes in attrs.json (a RedrivePolicy) on https://sqs.eu-north-1.amazonaws.com/124495484726/sthlmgames-orders.

How:
  1. Read the task and decide which AWS service it is about.
  2. Write aws, then the service name, then the operation (the action word).
  3. Add each needed flag (--name) followed by its value from the task.
  4. Flags can be in any order. Click Check answer.

See all practice tasks in the Task Hub →

Revision, comparison and interview cards

Revise this lesson in a few minutes. Save the cards on your phone or download them as PNG files. The QR code on each card opens this lesson.

SNS publish. Post once, everyone in the group gets it. create-topic, then subscribe endpoints. Email stays pending until clicked. publish returns a MessageId.
Revision card: SNS publish · Download PNG · Open card page
SNS filter policy. Billing wants only payment events. Publish with message attributes. Set FilterPolicy on the subscription. Non-matching messages are skipped.
Revision card: SNS filter policy · Download PNG · Open card page
SNS vs SQS. Push to many subscribers. / Pull by one consumer.
Comparison: SNS vs SQS · Download PNG · Open card page
SNS to SQS not arriving?. Queue policy must allow sns.amazonaws.com. Condition aws:SourceArn = topic ARN. Check FilterPolicy is not dropping it.
Interview card: SNS to SQS not arriving? · Download PNG · Open card page

More cards: Ravi Sir's Cards.