Subscribe SQS to a SNS topic in another AWS account with CloudFormation, and gotchas!

Too Long; Didn't Read

A use case arrived recently, where we need to subscribe a SQS queue to a SNS topic running in another AWS account. On the surface this seems like something many people would need to do, and indeed I was able to find an <a href="https://docs.aws.amazon.com/sns/latest/dg/SendMessageToSQS.cross.account.html#SendMessageToSQS.cross.account.queueowner" target="_blank">official tutorial</a> pretty quickly. But the tutorial is all “click this in the SQS console, and do that in the SNS console”. We are strong believers in Infrastructure as Code and having someone do the subscription steps manually is not going to work, especially given that we’ll be repeating this process in many places.