• October 21, 2026
• 14 min read

Amazon SNS — Core Concepts¶

The Model¶

flowchart LR
  P["Publisher<br/>Publish / PublishBatch"] --> T{{"Topic"}}
  T -->|"filter policy<br/>accepts?"| S1["Subscription A"]
  T -->|"filter policy<br/>rejects"| X["not delivered<br/>(counted as filtered out)"]
  T --> S2["Subscription B"]
  S1 -->|"deliver"| E1["Endpoint A"]
  S1 -. "retries exhausted<br/>or client error" .-> DLQ["SQS DLQ of<br/>subscription A"]
  S2 --> E2["Endpoint B"]

• A topic is a named channel with an access policy and a few settings. It holds no messages for later.
• A subscription binds one endpoint to one topic and carries its own attributes: filter policy, raw delivery, retry policy, DLQ.
• A publish is evaluated per subscription: filter, then deliver with retries, then DLQ or discard. Failure on one subscription does not affect the others.
• Messages are at-least-once on standard topics. Duplicates and out-of-order delivery are normal; see Queues vs Streams for idempotency patterns.

Topics¶

• create_topic is idempotent: calling it again with an existing name returns the same ARN.
• Do not put PII or secrets into topic names; the docs state names are visible to other AWS services such as CloudWatch Logs.
• Tags: up to 50 per topic (TagLimitExceeded otherwise), set at creation or with tag_resource.

FIFO Specifics¶

When high throughput is enabled, the docs recommend enabling high-throughput mode on the subscribed SQS FIFO queues too.

Subscriptions and Confirmation¶

Message Anatomy¶

Message Attributes¶

• Name: letters, digits, _, -, .; up to 256 characters; case-sensitive; no leading or trailing dot, no consecutive dots; must not start with AWS. or Amazon. in any casing.
• Filter-friendly values must be valid JSON strings.
• For SQS subscriptions with raw delivery, at most 10 message attributes can be delivered. A message with more is discarded as a client-side error. Disable raw delivery to send more.
• Attributes are sent only when the message structure is a plain string, not json.
• Attributes are not delivered to HTTP/S and Firehose subscriptions when raw delivery is on, and are used only to build mobile push payloads.

Envelope vs Raw Delivery¶

For sqs, http, https and firehose, SNS can deliver the body as published (raw) or wrapped in a JSON envelope. The attribute is RawMessageDelivery on the subscription (set with subscribe or set_subscription_attributes).

{
  "Type": "Notification",
  "MessageId": "63a3f6b6-d533-4a47-aef9-fcf5cf758c76",
  "TopicArn": "arn:aws:sns:us-east-1:123456789012:order-events",
  "Subject": "order created",
  "Message": "{\"order_id\": \"o-1\"}",
  "Timestamp": "2026-10-21T12:40:11.265Z",
  "SignatureVersion": "1",
  "Signature": "EXAMPLE...",
  "SigningCertURL": "https://sns.us-east-1.amazonaws.com/SimpleNotificationService-....pem",
  "UnsubscribeURL": "https://sns.us-east-1.amazonaws.com/?Action=Unsubscribe&SubscriptionArn=...",
  "MessageAttributes": {
    "event_type": {"Type": "String", "Value": "created"}
  }
}

On moto, with raw delivery the SQS message carries the published body plus event_type, n (Number) and arr (String.Array) as SQS attributes; without it the same queue receives the envelope with MessageAttributes inside. The envelope fields that matter to code (Type, Message, MessageAttributes) are the same in moto and AWS; the signature values in moto are not real.

Delivery Retries¶

SNS retries server-side failures (the endpoint is down or returns an error) and does not retry client-side failures (endpoint deleted, permission removed).

All policies use jitter. When the policy is exhausted SNS discards the message unless the subscription has a DLQ.

HTTP/S treats every 5xx and 429 as retryable; other status codes are permanent failures. A custom policy is a JSON object set as the DeliveryPolicy attribute:

{
  "healthyRetryPolicy": {
    "minDelayTarget": 1, "maxDelayTarget": 60,
    "numRetries": 50, "numNoDelayRetries": 3, "numMinDelayRetries": 2, "numMaxDelayRetries": 35,
    "backoffFunction": "exponential"
  },
  "throttlePolicy": {"maxReceivesPerSecond": 10},
  "requestPolicy": {"headerContentType": "application/json"}
}

At topic level the same JSON is wrapped in {"http": {"defaultHealthyRetryPolicy": ..., "defaultThrottlePolicy": ..., "defaultRequestPolicy": ..., "disableSubscriptionOverrides": false}}.

Subscription DLQ (Redrive Policy)¶

A DLQ is an ordinary SQS queue attached to a subscription (not to the topic) through the RedrivePolicy attribute:

{"deadLetterTargetArn": "arn:aws:sqs:us-east-1:123456789012:billing-sns-dlq"}

Access Control¶

Two policy types decide who can do what: identity policies on callers (IAM) and resource policies on topics and queues. By default only the topic owner can publish or subscribe. The topic policy is the Policy attribute; add_permission and remove_permission edit it for you.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowOtherAccountToPublish",
      "Effect": "Allow",
      "Principal": {"AWS": "111122223333"},
      "Action": "sns:Publish",
      "Resource": "arn:aws:sns:us-east-1:123456789012:order-events"
    },
    {
      "Sid": "AllowS3EventsFromOneAccount",
      "Effect": "Allow",
      "Principal": {"Service": "s3.amazonaws.com"},
      "Action": "sns:Publish",
      "Resource": "arn:aws:sns:us-east-1:123456789012:order-events",
      "Condition": {"StringEquals": {"AWS:SourceAccount": "111122223333"}}
    }
  ]
}

Identity policies for publishers follow least privilege: sns:Publish on the topic ARN, plus kms:GenerateDataKey* and kms:Decrypt if the topic is encrypted. Concepts such as principals, Sid and condition keys are in AWS Foundations: IAM.

Encryption (SSE-KMS)¶

Key policies and IAM are not enforced by moto, so encryption setup is a real-account check (see 05 moto Limits, Pitfalls & CI).

Topic and Subscription Attributes¶

Limits and Quotas¶

Values from the AWS General Reference (October 2026). Many are soft limits that can be raised in Service Quotas.

Publish limits combine Publish and PublishBatch message counts per account and Region. Exceeding them returns a throttling error (Throttled, HTTP 429). botocore's default legacy mode retries it; standard and adaptive modes did not in our test, so add your own retry (see 02 boto3 in Python).

Pricing Dimensions¶

No prices here (they vary by Region and change); the dimensions are what you plan around.

Body-scope filtering is billed per scanned byte, which makes attributes the cheaper default when the publisher can set them.

Quick Rules¶

1. Remember that topic type and name are permanent; choose FIFO only when you need order or dedup, and set FifoThroughputScope at creation.
2. Write the queue policy before subscribing a queue; scope it with aws:SourceArn.
3. Prefer raw delivery for queues, and keep attributes at 10 or fewer when you do.
4. Know your failure modes: SQS and Lambda subscribers are retried for 23 days, e-mail and push for 6 hours, and anything not retried is lost without a DLQ.
5. Put a DLQ on each important subscription, with its own queue policy and 14-day retention, and alarm on it.
6. Encrypt with a customer managed key when AWS services publish into the topic.
7. Never rely on Subject for logic; it is optional, short and absent from raw deliveries.
8. Check quotas for your Region before load tests: a default account in most Regions publishes 300 (standard) messages per second.

See also¶

• Amazon SNS — Overview
• Amazon SNS — boto3 in Python
• Amazon SNS — Filtering & Fan-out Patterns
• Amazon SQS
• AWS Foundations — Credentials, IAM & Local Testing
• Queues vs Streams: Message Delivery, Ordering & Reliability