How can I subscribe an AWS Lambda function to a push-based event source in AWS CloudFormation?

Last updated: 2019-04-19

I can't subscribe my AWS Lambda function to an Amazon Simple Storage Service (Amazon S3) event notification or Amazon Simple Notification Service (Amazon SNS) topic in my AWS CloudFormation stack. If I use the AWS::Lambda::EventSourceMapping resource, I receive the following error: "Unrecognized event source, must be kinesis or dynamodb stream."

Short Description

The AWS::Lambda::EventSourceMapping resource is designed for pull-based event sources, such as Amazon DynamoDB event streams and Amazon Kinesis. With push-based event sources, such as Amazon S3 event notifications or Amazon SNS messages, the event source is responsible for invoking the Lambda function. For a push event source to invoke a Lambda function, the function’s resource policy must authorize a supported event source.


In your AWS CloudFormation template, add a resource-based policy using the AWS::Lambda::Permission resource. For example, the resource-based policy in the following code sample allows an Amazon SNS topic to invoke a Lambda function:

"LambdaResourcePolicy": {
  "Type": "AWS::Lambda::Permission",
  "Properties": {
    "FunctionName" : { "Ref" : "MyFunction" },
    "Principal": "",
    "Action": "lambda:InvokeFunction",
    "SourceArn" : { "Ref" : "MySNSTopic" }

For the preceding example, you must have a notification configuration statement that subscribes the Lambda function to the Amazon S3 bucket. For an Amazon SNS topic event source, you must define a topic policy with the required permissions.

Did this article help you?

Anything we could improve?

Need more help?