> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/data-security-posture-management/prisma-cloud-dspm-integrations/integrate-an-amazon-sns-topic-with-dig-security.md).

# Integrate an Amazon SNS Topic with Prisma Cloud DSPM

SNS (Simple Notification Service) is a commonly used AWS tool for building cloud applications and automating processes. When organizations wish to tailor notifications for their internal systems, manage the criteria for distributing notifications, or document the lifecycle of risk within their internal systems, they need the capability to generate risk and alert notifications from Prisma Cloud DSPM to SNS.

This article describes how integrating an Amazon SNS topic with Prisma Cloud DSPM empowers data security teams to leverage SNS/SQS for automating workflows within AWS based on notifications from Prisma Cloud DSPM.

The integration workflow is a three-step process:

1. User creates an SNS Topic in AWS.
2. User configures the ARN topic in Prisma Cloud DSPM.
3. User grants access to Prisma Cloud DSPM to publish to the topic.

### Create an SNS Topic in AWS

1. Sign in to the Amazon SNS console, and create an AWS SNS topic.
2. Copy the topic ARN. The topic ARN typically looks like the example below:\
   \&#xNAN;*arnsns123456789012:MyTopic*

### Configure the ARN for Your Topic in Prisma Cloud DSPM

Configure when to generate risk and alert notifications from Prisma Cloud DSPM to SNS and/or SQS.

1. In Prisma Cloud DSPM click Preferences.
2. In the Integration tab, scroll down to the Notifications area, and in the SNS thumbnail click Connect.\
   ![](/files/zec9Crzy6RNQQtntZ1Y5)
3. In the SNS window do the following:
   1. In the SNS topic ARN field, enter the SNS topic ARN.
   2. In the Notified On drop down, select All, Alerts, or Risk Findings.
   3. In the Severity Threshold drop down, select the severity threshold.
   4. Optional: To filter alerts, use the Filter by Tags dropdown menu, and select the required tags. By configuring tags, you will receive alerts only for assets that match the selected tags.
   5. Click Create. The SNS is created and appears in the SNS list.\
      ![](/files/XyB6NIwJdWrdsUGNPXoX)
   6. Grant access to Prisma Cloud DSPM to publish to the topic.
   7. Follow the instructions in this [link](https://docs.aws.amazon.com/sns/latest/dg/sns-access-policy-use-cases.html), and use the following policy:

      **Note:** Replace *\<Your SNS topic ARN goes here>*  with the ARN of your SNS topic.\
      ActionScriptActionScript

      ```
      {
        "Sid": "DigSecuritySNSPolicy",
        "Effect": "Allow",
        "Principal": {
          "AWS": [
            "092708045729"
          ]
        },
        "Action": "SNS:Publish",
        "Resource": "<Your SNS topic ARN goes here>"
      }
      ```

The Amazon SNS topic is integrated into Prisma Cloud DSPM.

### If Encryption is Enabled

If encryption is enabled for your SNS topic, add the policy below into your KMS to grant Prisma Cloud DSPM permission to publish to the topic:

1. In aws >kms (key management service), select your kms key under key policy > edit.
2. Add the following beneath the statement:

   Make sure to replace \<Your kms ARN goes here> with your kms ARN.

```
{
            "Sid": "Allow access for Key User (SNS IAM User)",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::092708045729:root"
            },
            "Action": [
                "kms:GenerateDataKey*",
                "kms:Decrypt"
            ],
            "Resource": "<Your kms ARN goes here>"
        },
        {
            "Sid": "Allow access for Key User (SNS Service Principal)",
            "Effect": "Allow",
            "Principal": {
                "Service": "sns.amazonaws.com"
            },
            "Action": [
                "kms:GenerateDataKey*",
                "kms:Decrypt"
            ],
            "Resource": "<Your kms ARN goes here>"
        }
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.prismacloud.io/content-collections/data-security-posture-management/prisma-cloud-dspm-integrations/integrate-an-amazon-sns-topic-with-dig-security.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.