Add a message and event destination to AWS End User Messaging Social

When you turn on message and event publishing, all of the events generated by your WhatsApp Business Account (WABA) are sent to the Amazon SNS topic. This includes events for each phone number associated to a WhatsApp Business Account. Your WABA can have one Amazon SNS topic associated with it.

Prerequisites

Before you begin, the following prerequisites must be met to use either an Amazon SNS topic or Amazon Connect instance as a message and event destination.

Add a message and event destination

Encrypted Amazon SNS topic policies

You can use Amazon SNS topics that are encrypted using AWS KMS keys for an additional level of security. This added security can be helpful if your application handles private or sensitive data. For more information about encrypting Amazon SNS topics using AWS KMS keys, see Enable compatibility between event sources from AWS services and encrypted topics in the Amazon Simple Notification Service Developer Guide.

The example statement uses the, optional but recommended, SourceAccount and SourceArn conditions to avoid the confused deputy problem and only the AWS End User Messaging Social owner account has access. For more information on the confused deputy problem, see The confused deputy problem in the IAM user guide.

The key that you use must be symmetric. Encrypted Amazon SNS topics don't support asymmetric AWS KMS keys.

The key policy must be modified to allow AWS End User Messaging Social to use the key. Follow the directions in Changing a key policy, in the AWS Key Management Service Developer Guide, to add the following permissions to the existing key policy:

{
    "Effect": "Allow",
    "Principal": {
        "Service": "social-messaging.amazonaws.com"
    },
    "Action": [
        "kms:GenerateDataKey*",
        "kms:Decrypt"
    ],
    "Resource": "*",
    "Condition": {
        "StringEquals": {
          "aws:SourceAccount": "{ACCOUNT_ID}"
        },
        "ArnLike": {
          "aws:SourceArn": "arn:{PARTITION}:social-messaging:{REGION}:{ACCOUNT_ID}:*"
        }
     }
}

IAM policies for Amazon SNS topics

To use an existing IAM role or to create a new role, attach the following policy to that role so that AWS End User Messaging Social can assume it. For information about how to modify the trust relationship of a role, see Modifying a Role in the IAM user guide.

The following is the permission policy for the IAM role. The permission policy allows for publishing to Amazon SNS topics.

In the following IAM permission policy, make the following changes:

{
    "Effect": "Allow",
    "Principal": {
        "Service": [
          "social-messaging.amazonaws.com"
        ]
       },
    "Action": "sns:Publish",
    "Resource": "arn:{PARTITION}:sns:{REGION}:{ACCOUNT}:{TOPIC_NAME}"
}

IAM policies for Amazon Connect

If you want AWS End User Messaging Social to use an existing IAM role or if you create a new role, attach the following policies to that role so that AWS End User Messaging Social can assume it. For information about how to modify an existing trust relationship of a role, see Modifying a Role in the IAM user guide. This role is used for both sending events and importing phone numbers from AWS End User Messaging Social into Amazon Connect.

To create new IAM polices, do the following:

Next steps

Once you have set up your Amazon SNS topic, you must subscribe an endpoint to the topic. The endpoint will start to receive messages published to the associated topic. For more information on subscribing to a topic, see Subscribing to an Amazon SNS topic in the Amazon SNS Developer Guide.