Skip to content

Resolve SNS topic ARNs via STS + SNS.GetTopicAttributes before using SNS.CreateTopic#2077

Merged
kalaspuff merged 14 commits into
masterfrom
feature/sns-publish-without-sns-create-topic
Mar 25, 2026
Merged

Resolve SNS topic ARNs via STS + SNS.GetTopicAttributes before using SNS.CreateTopic#2077
kalaspuff merged 14 commits into
masterfrom
feature/sns-publish-without-sns-create-topic

Conversation

@kalaspuff
Copy link
Copy Markdown
Owner

@kalaspuff kalaspuff commented Mar 25, 2026

Summary

Publishing through the AWS SNS+SQS transport no longer assumes sns:CreateTopic is available. The transport first tries to resolve the topic ARN by calling sts:GetCallerIdentity (for the account ID) and sns:GetTopicAttributes on the constructed ARN, caches the result, and only then falls back to the existing sns:CreateTopic path (including topic attributes) when lookup does not find a topic.

Why

Deployments that cannot grant sns:CreateTopic but can publish to an already-provisioned topic (with typical STS identity and SNS read permissions) should be able to publish without failing on create topic.

Added Option

Options now include aws_endpoint_urls.sts for configuring the AWS STS endpoint (for example with Localstack).

If a custom endpoint is set for aws_endpoint_urls.sns but not for aws_endpoint_urls.sts, the STS client falls back to the SNS endpoint URL for backward compatibility with existing configurations.

Implementation notes

  • New helpers: get_topic_arn, _lookup_topic_arn_via_sts_and_sns, and _sns_client_error_indicates_missing_topic (handles missing-topic ClientError shapes).
  • Lookup uses the same SNS topic create condition/lock pattern as create_topic so concurrent callers stay consistent with cached cls.topics.
  • Retries (up to 3) for transient STS/SNS/network/timeout issues; missing topic returns None so publish can still attempt create_topic when permitted.
  • create_client("sts", …) is wired in the SNS+SQS transport and in ClientConnector overloads for typed STS usage.
  • Dev typing: types-aiobotocore extras include sts; lockfile picks up types-aiobotocore-sts and related resolution changes.

Python 3.9 deprecation

Dropped support for Python 3.9.

@codecov
Copy link
Copy Markdown

codecov Bot commented Mar 25, 2026

Codecov Report

❌ Patch coverage is 68.46847% with 35 lines in your changes missing coverage. Please review.
✅ Project coverage is 73.77%. Comparing base (3aa881b) to head (bc3758c).
⚠️ Report is 15 commits behind head on master.

Files with missing lines Patch % Lines
tomodachi/transport/aws_sns_sqs.py 66.33% 34 Missing ⚠️
tomodachi/helpers/aiobotocore_connector.py 87.50% 1 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##           master    #2077      +/-   ##
==========================================
- Coverage   73.91%   73.77%   -0.14%     
==========================================
  Files          53       53              
  Lines        8112     8222     +110     
==========================================
+ Hits         5996     6066      +70     
- Misses       2116     2156      +40     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@kalaspuff kalaspuff merged commit 8ae1401 into master Mar 25, 2026
10 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant