Sns topic update functionality #12777

michalisfot · 2025-06-19T20:11:16Z

Related PR: #12768

Motivation

This PR implements basic update support for the AWS::SNS::Topic CloudFormation resource, addressing the core requirement to enable updates for DisplayName, TopicName, and Tags properties. The implementation follows AWS CloudFormation's update semantics, including resource replacement when immutable properties change.

Changes

Enhanced Resource Provider (`aws_sns_topic.py`)

Implemented complete update() method with support for:
- In-place updates: DisplayName attribute changes
- Resource replacement: TopicName changes (recreates topic with new name)
- Tag management: Add/remove/update tags with proper diffing
- State preservation: Maintains subscriptions and existing tags during topic replacement
Key features:
- Proper ARN handling and validation
- Graceful error handling for subscription/tag preservation
- Follows AWS update semantics (replacement vs. in-place)
- Resource cleanup (deletes old topic after successful replacement)

Comprehensive Test Coverage (`test_sns.py`)

Created test_sns_topic_update_attributes() with in-place updates (no resource replacement):
- DisplayName updates: Verifies DisplayName attribute changes are applied correctly
- Tag updates: Tests adding, modifying, and removing tags
- Same topic preservation: Ensures TopicArn remains unchanged during in-place updates
- Snapshot validation: Captures before/after state for attribute and tag changes
Created test_sns_topic_update_name() with resource replacement:
- Tag preservation validation: Verifies existing tags are preserved during replacement
- Subscription preservation validation: Ensures subscriptions are migrated to new topic
- ARN format validation: Builds and validates new ARN using proper AWS format
- Resource replacement verification: Confirms old topic deletion and new topic creation
- Comprehensive snapshots: Captures before/after state for all operations

Added new entries to the Snapshot File (`test_sns.snapshot.json`)

Testing

On AWS and ocally both test pass.

TODO

~~Test against AWS and find out why test_sns_topic_update_name test fails on AWS but not locally.~~
Find a proper way to validate the snapshot against the tags rather than manually checking each tag

Proposed Next Steps

1: Complete Core Properties

Archive Policy Support
Access Policy Support
KMS Key Management
FIFO Topic Properties
ContentBasedDeduplication

2: Advanced Update Capabilities

Subscription Management
Data Protection Policy
Delivery Policy Configuration

3: Robustness & Edge Cases

Error Handling Enhancement - Improve rollback scenarios for failed updates
Performance Optimizations

4: Testing

Multi account and region testing
Other types of testing as mentioned in the docs

localstack-bot · 2025-06-19T20:11:29Z

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

michalisfot · 2025-06-21T11:16:11Z

recheck

michalisfot · 2025-06-21T11:31:07Z

recheck

michalisfot · 2025-06-21T11:38:29Z

I have read the CLA Document and I hereby sign the CLA.

alexrashed · 2025-06-23T06:41:25Z

recheck

simonrw

Thanks for posting the updates to this PR. I have left some follow ups on the previous PR and added some comments here. In general I am ok with this PR. I think we have captured a good part of the update implementation for SNS topics, including using CFn to manage the subscriptions.

I would be interested to capture the behaviour you had previously in a follow up where the subscriptions are created outside of CFn, however I think this use case is less common and therefore not as high a priority as the changes you've added here.

Thanks very much!

(I have requested changes again as I still have a couple of outstanding comments that have not been addressed. These are only minor though, I just would like your take on them before I approve).

localstack-core/localstack/services/sns/resource_providers/aws_sns_topic.py

simonrw · 2025-06-24T11:34:16Z

tests/aws/services/cloudformation/resources/test_sns.py

+        "$..Attributes.Policy.Statement..Action",  # SNS:Receive is added by moto but not returned in AWS
+    ]
+)
+def test_sns_topic_update_attributes(deploy_cfn_template, aws_client, snapshot):


In general the shape of this test looks fine.

suggestion: perhaps consider validating the subscriptions as you do in the other test? Changing these attributes (that don't require replacement) should mean a subscription remains "attached", right?

nit: if a Python object (e.g. dictionary) is compared with snapshot.match you don't need to assert the individual fields of that object

simonrw · 2025-06-24T12:03:34Z

tests/aws/services/cloudformation/resources/test_sns.py

+    tag_dict = {tag["Key"]: tag["Value"] for tag in initial_tags["Tags"]}
+    assert tag_dict["Environment"] == "test"
+    assert tag_dict["Project"] == "localstack"


Suggested change

tag_dict = {tag["Key"]: tag["Value"] for tag in initial_tags["Tags"]}

assert tag_dict["Environment"] == "test"

assert tag_dict["Project"] == "localstack"

snapshot.match("initial-tags", initial_tags)

We may need to add specific non-supported tags to the skip_snapshot_verify decorator at the top of the test function, as CFn adds its own tags to resources and we don't support that yet.

That was my initial plan. I couldn't make it work though because of how the Tags are formatted. I couldn't find a way to skip the verification based on the Key. Also, AWS creates the tags in a random order and this also affects the validation. My idea was to temporarily check the tags manually until we find a proper solution (which might be already there but I missed it). I checked other examples but the tags there were formatted differently e.g. in Lambda snapshots tags are all in a single dictionary (not a list of dicts like bellow).

E.g.:

"Tags": [ { "Key": "Project", "Value": "localstack" }, { "Key": "aws:cloudformation:stack-name", "Value": "replaced-value" }, { "Key": "Environment", "Value": "test" }, { "Key": "aws:cloudformation:logical-id", "Value": "TestTopic" }, { "Key": "aws:cloudformation:stack-id", "Value": "replaced-value" } ],

I think that's fair enough for now. Thanks for explaining.

simonrw · 2025-06-24T12:04:31Z

tests/aws/services/cloudformation/resources/test_sns.py

+    updated_tag_dict = {tag["Key"]: tag["Value"] for tag in updated_tags["Tags"]}
+    assert updated_tag_dict["Environment"] == "production"
+    assert updated_tag_dict["Project"] == "backend"


Suggested change

updated_tag_dict = {tag["Key"]: tag["Value"] for tag in updated_tags["Tags"]}

assert updated_tag_dict["Environment"] == "production"

assert updated_tag_dict["Project"] == "backend"

snapshot.match("updated-tags", updated_tags)

#12777 (comment)

simonrw · 2025-06-24T12:05:26Z

tests/aws/services/cloudformation/resources/test_sns.py

+    assert updated_tag_dict["Project"] == "backend"
+
+    # Subscriptions should be preserved
+    snapshot.match("new-subscriptions", initial_subscriptions)


issue: you are not refetching the subscriptions here, you are asserting the contents of the old subscriptions response. Can you update this snapshot to fetch the new subscriptions?

Suggested change

snapshot.match("new-subscriptions", initial_subscriptions)

snapshot.match("new-subscriptions", initial_subscriptions)

This was done on purpose. I though that if the initial_subscriptions match the new subscriptions on the snapshot it means they are preserved. Do you mean we should do something like this?

new_subscriptions = aws_client.sns.list_subscriptions_by_topic(TopicArn=topic_arn) snapshot.match("new-subscriptions", new_subscriptions)

Yes this is what's required. You have already snapshotted the initial subscriptions, and the value of the variable does not change between your two snapshot.match calls. Therefore you are snapshotting the exact same information twice.

The snapshot library takes care of what the expected value should be. Provided you have captured the snapshot against AWS and the tests pass on LocalStack, we have confidence that the responses and behaviour match.

So you first get the subscriptions for the topic on create, then update the topic and re-fetch the subscriptions after the update. Whether they match is irrelevant, the fact that the snapshots are the same means that LocalStack does the same as what AWS does.

tests/aws/services/cloudformation/resources/test_sns.py

simonrw · 2025-06-24T12:09:36Z

tests/aws/services/cloudformation/resources/test_sns.snapshot.json

+          "HTTPStatusCode": 200
+        }
+      },
+      "initial-topic-tags": {


These keys are not in the test anywhere, perhaps you need to regenerate your snapshots (after addressing my comments above).

simonrw · 2025-06-24T12:09:59Z

tests/aws/services/cloudformation/resources/test_lambda.validation.json

issue: this change is unrelated to this PR, can we undo this change?

Ah yes, it got away while testing. I'll roll it back.

michalisfot added 2 commits June 17, 2025 22:02

Added update functionality for AWS::SNS::Topic CFn Resource Provider

40259b2

Tested on AWS and addressed PR comments

2f9f149

michalisfot requested review from bentsku, baermat, dominikschubert, pinzon and simonrw as code owners June 19, 2025 20:11

simonrw added the semver: patch Non-breaking changes which can be included in patch releases label Jun 19, 2025

localstack-bot added a commit that referenced this pull request Jun 23, 2025

@alexrashed has signed the CLA in #12777

57f83cd

simonrw requested changes Jun 24, 2025

View reviewed changes

	snapshot.match("new-subscriptions", initial_subscriptions)
	snapshot.match("new-subscriptions", initial_subscriptions)

Uh oh!

Sns topic update functionality #12777

Are you sure you want to change the base?

Sns topic update functionality #12777

Uh oh!

Conversation

michalisfot commented Jun 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Motivation

Changes

Enhanced Resource Provider (aws_sns_topic.py)

Comprehensive Test Coverage (test_sns.py)

Added new entries to the Snapshot File (test_sns.snapshot.json)

Testing

TODO

Proposed Next Steps

1: Complete Core Properties

2: Advanced Update Capabilities

3: Robustness & Edge Cases

4: Testing

Uh oh!

localstack-bot commented Jun 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

michalisfot commented Jun 21, 2025

Uh oh!

michalisfot commented Jun 21, 2025

Uh oh!

michalisfot commented Jun 21, 2025

Uh oh!

alexrashed commented Jun 23, 2025

Uh oh!

simonrw left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

michalisfot commented Jun 19, 2025 •

edited

Loading

Enhanced Resource Provider (`aws_sns_topic.py`)

Comprehensive Test Coverage (`test_sns.py`)

Added new entries to the Snapshot File (`test_sns.snapshot.json`)

localstack-bot commented Jun 19, 2025 •

edited

Loading