This content originally appeared on DEV Community and was authored by Atsushi Suzuki
While migrating an existing service to a new AWS account, I ran into a strange error when trying to set up an SNS topic for SES feedback notifications (Bounce, Complaint, Delivery):
An invalid or out-of-range value was supplied for the input parameter.
I had created the SNS topic as a "Standard" type, in the same region as SES, and configured the access policy to allow ses.amazonaws.com with sns:Publish. Everything seemed correct, so I couldn’t figure out what was wrong.
Root Cause
The problem turned out to be insufficient KMS key policy permissions on the encryption key used for the SNS topic.
When publishing to an encrypted SNS topic, the publishing service (in this case, SES) needs permissions for both kms:GenerateDataKey and kms:Decrypt. The actual encryption/decryption is handled by SNS, but SES must be able to trigger the KMS API calls required for that process.
However, in this case I had used the AWS managed key alias/aws/sns for SNS topic encryption—which cannot be edited to adjust the key policy.
Solution
The workaround was to create a customer managed key (CMK) named sns-ses-dev-1, attach the following key policy, and configure it for the SNS topic:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowSESToUseKMSKey",
"Effect": "Allow",
"Principal": {
"Service": "ses.amazonaws.com"
},
"Action": [
"kms:GenerateDataKey",
"kms:Decrypt"
],
"Resource": "*"
}
]
}
After applying this, I was finally able to configure the SNS topic for SES feedback notifications successfully.
Final Thoughts
Since CMKs incur additional cost, it might not be worth enabling SNS topic encryption in development environments at all. Using encryption only in production could be a more balanced approach.
References
This content originally appeared on DEV Community and was authored by Atsushi Suzuki
Atsushi Suzuki | Sciencx (2025-09-11T01:11:44+00:00) Fixing the “Invalid Parameter” Error When Registering an SNS Topic for SES Feedback Notifications. Retrieved from https://www.scien.cx/2025/09/11/fixing-the-invalid-parameter-error-when-registering-an-sns-topic-for-ses-feedback-notifications/
Please log in to upload a file.
There are no updates yet.
Click the Upload button above to add an update.