Skip to main content

Connect to Amazon SNS

Connect Amazon SNS to Retool and publish and manage notifications.

Amazon SNS is a managed pub/sub messaging service for sending notifications between distributed systems.

What you can do with Amazon SNS in Retool​

After you create an Amazon SNS resource in Retool, you can:

  • Publish messages to a topic.
  • List and manage topics and subscriptions.
  • Subscribe and unsubscribe endpoints from a topic.
  • Build admin panels and dashboards on top of notification data.

Before you begin​

To connect Amazon SNS to Retool, you need the following:

  • AWS IAM credentials: An access key ID and secret access key with SNS permissions, or an IAM role to assume.
  • Retool permissions: Ability to create and manage resources in your organization.

Create an Amazon SNS resource​

Follow these steps, in order, to create an Amazon SNS resource in Retool.

Create a new resource​

In your Retool organization, navigate to Resources in the main navigation and click Create new → Resource. Search for SNS and click the Amazon SNS tile to begin configuration.

Amazon SNS resource configuration form.

Configure general settings​

Specify a name and description for the resource that indicates which AWS account or topic set it connects to. The description provides more context to users and Assist about how to use the resource.

Example nameExample description
SNS (Order notifications)Publishes order status notifications to downstream systems.
SNS (Alerts)Publishes operational alerts for the analytics pipeline.

Configure resource credentials​

AWS region​

Select the AWS region of the SNS topics you want to connect to.

Example
us-east-1

Configure authentication​

Choose a primary authentication method based on your deployment type. All methods support an optional Role to assume (ARN) field. If provided, Retool uses your primary credentials to call sts:AssumeRole on the specified role before accessing SNS.

Authentication methodUse cases
Access key + secret keyStandard authentication with IAM user credentials. Available for all deployment types. Most common for initial setup and when running outside of AWS.
Default credential provider chain (self-hosted only)Automatic credential discovery from your environment. Recommended when Retool runs on AWS infrastructure with an EC2 instance profile, ECS task role, or EKS service account.

Cloud organizations authenticate using Access key + secret key.

Create an IAM user or service account in the AWS IAM console and attach a policy that grants the necessary SNS permissions, then create an access key ID and secret key for it. Paste them into the AWS access key ID and AWS secret key ID fields.

Example IAM policy for SNS access
IAM policy with SNS permissions
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "sns:Publish",
        "sns:Subscribe",
        "sns:Unsubscribe"
      ],
      "Resource": "arn:aws:sns:us-east-1:123456789012:my-topic"
    },
    {
      "Effect": "Allow",
      "Action": "sns:ListTopics",
      "Resource": "*"
    }
  ]
}

sns:ListTopics doesn't support resource-level permissions, so it must use a wildcard Resource in its own statement.

If you entered a role ARN above, configure the role's trust policy to allow your IAM user to assume it.

Test the connection​

Click Test connection to verify Retool can connect to Amazon SNS. If the test succeeds, you see a success message. If it fails, check the following:

  • AWS region: Confirm the region matches where your SNS topics are located.
  • IAM credentials: Verify the access key and secret key are correct and have not expired.
  • IAM permissions: Confirm the IAM user or role has the necessary SNS permissions.
  • Role ARN: If assuming a role, confirm the role's trust policy allows your credentials to assume it.

Save the resource​

Click Create resource to save your Amazon SNS resource. You can now use it in queries across your Retool apps and automations.

Interact with Amazon SNS data​

Once you've created an Amazon SNS resource, you can interact with Amazon SNS data using Retool.

Caution

Amazon SNS isn't yet supported in the new app builder. Use a classic app, workflow, or agent instead.

For classic apps, workflows, and agents, refer to the resource query documentation to learn how to write a query.

Best practices​

Follow these best practices to maintain the security of your Amazon SNS resource.

  • Apply least privilege: Scope the IAM policy to only the SNS actions and topics the resource needs, rather than granting broad SNS access.
  • Use role assumption for cross-account access: When accessing topics in another AWS account, use the Role to assume (ARN) field rather than sharing long-lived credentials across accounts.
  • Rotate credentials regularly: Rotate access keys on a regular schedule, and immediately if a key is ever exposed.
  • Use resource environments: Organizations on an Enterprise plan can configure multiple resource environments to maintain separate AWS credentials for production, staging, and development.