This gist contains code from sns.tf, which is part of the blog-amazon-macie-custom-eventbridge-events repository.

blog-amazon-macie-custom-eventbridge-eventbridge_sns.tf

# SNS Topic for Macie job status notifications
resource "aws_sns_topic" "macie_notifications" {
  name         = local.sns.topic_name
  display_name = local.sns.display_name
}

# SNS Topic Policy to allow EventBridge to publish to the topic
resource "aws_sns_topic_policy" "macie_notifications" {
  arn = aws_sns_topic.macie_notifications.arn

  policy = jsonencode({
    Version = "2012-10-17"
    Id      = "MacieJobStatusSNSPolicy"
    Statement = [
      {
        Sid    = "AllowEventBridgePublish"
        Effect = "Allow"
        Principal = {
          Service = "events.amazonaws.com"
        }
        Action   = "SNS:Publish"
        Resource = aws_sns_topic.macie_notifications.arn
        Condition = {
          ArnEquals = {
            "aws:SourceArn" = aws_cloudwatch_event_rule.macie_job_status.arn
          }
        }
      }
    ]
  })
}

# SNS Topic Subscription - Email notification
resource "aws_sns_topic_subscription" "email" {
  topic_arn = aws_sns_topic.macie_notifications.arn
  protocol  = "email"
  endpoint  = var.email_for_notifications
}