AWS SNS Destination¶

Stream Keycloak events to Amazon Simple Notification Service (SNS).

Property	Value
`destination.kind`	`aws-sns`
Protocol	AWS SNS API (SDK)

Compatible Systems¶

System	Notes
Amazon SNS	Fully managed pub/sub messaging service
LocalStack	Local development and testing

Example Configurations¶

AWS CloudLocalStack EmulatorFIFO Topic

kete.routes.sns.destination.kind=aws-sns
kete.routes.sns.destination.topic=keycloak-events
kete.routes.sns.destination.region=us-east-1
kete.routes.sns.destination.account-id=123456789012
kete.routes.sns.destination.authentication-type=access-key
kete.routes.sns.destination.access-key-id=AKIAIOSFODNN7EXAMPLE
kete.routes.sns.destination.secret-access-key=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY

kete.routes.sns.destination.kind=aws-sns
kete.routes.sns.destination.topic=keycloak-events
kete.routes.sns.destination.region=us-east-1
kete.routes.sns.destination.endpoint-url=http://localstack:4566

kete.routes.sns.destination.kind=aws-sns
kete.routes.sns.destination.topic=keycloak-events.fifo
kete.routes.sns.destination.region=us-east-1
kete.routes.sns.destination.account-id=123456789012
kete.routes.sns.destination.message-group-id=keycloak

Features¶

AWS SNS SDK integration with automatic credential resolution
Standard and FIFO topic support
Topic name templating with variables
Custom message attributes
Optional message subject
Message group ID and deduplication ID for FIFO topics
LocalStack emulator support for local development
Multiple authentication modes (access key, instance metadata, credentials file, environment variables, default chain, web identity token)
TLS/mTLS support

Configuration Properties¶

Required Properties¶

Property	Description	Example
`destination.kind`	Must be `aws-sns`	`aws-sns`
`destination.topic`	Topic name (supports templating)	`keycloak-events`

Optional Properties¶

Property	Default	Description	Example
`destination.region`	(from env)	AWS region (falls back to `AWS_REGION` / `AWS_DEFAULT_REGION`)	`us-east-1`
`destination.account-id`	(required for real AWS; `000000000000` when `endpoint-url` is set)	AWS account ID used to build the topic ARN	`123456789012`
`destination.endpoint-url`	(empty)	Custom endpoint URL (for LocalStack or VPC endpoints)	`http://localstack:4566`
`destination.authentication-type`	(empty)	Authentication type (see EventBridge Authentication)	`access-key`
`destination.access-key-id`	(empty)	AWS access key ID (required when `authentication-type=access-key`)	`AKIAIOSFODNN7EXAMPLE`
`destination.secret-access-key`	(empty)	AWS secret access key (required when `authentication-type=access-key`)	`wJalrXUtn...`
`destination.credentials-file-path`	(empty)	Path to AWS credentials file	`/path/to/credentials`
`destination.credentials-file-text`	(empty)	AWS credentials file content inline	`[default]\naws_access_key_id=...`
`destination.credentials-file-base64`	(empty)	Base64-encoded AWS credentials file	`W2RlZmF1bHRd...`
`destination.credentials-profile`	(`AWS_PROFILE` env var, else the SDK default profile)	Profile name within credentials file	`production`
`destination.timeout-seconds`	`10`	HTTP connect and request timeout in seconds	`30`
`destination.content-encoding`	(empty)	Compress the event payload (`gzip`, `deflate`) — see Content Encodings	`gzip`
`destination.content-transfer-encoding`	(empty)	Encode the event payload (`base64`) — see Content Transfer Encodings	`base64`
`destination.subject`	(empty)	SNS message subject (supports templating)	`KeycloakEvent`
`destination.message-group-id`	(empty)	Message group ID (supports templating; required for `.fifo` topics, rejected for non-FIFO topics)	`keycloak`
`destination.message-deduplication-id`	(empty)	Message deduplication ID for `.fifo` topics (supports templating)	`${eventTypeLowerCase}`

Dynamic Topic Name (Templating)¶

The topic property supports template variables:

kete.routes.sns.destination.topic=keycloak-events-${realmLowerCase}

Available variables: ${realmLowerCase}, ${realmUpperCase}, ${realmKebabCase}, ${realmPascalCase}, ${realmCamelCase}, ${eventTypeLowerCase}, ${eventTypeUpperCase}, ${eventTypeKebabCase}, ${eventTypePascalCase}, ${eventTypeCamelCase}, ${kindLowerCase}, ${kindUpperCase}, ${kindKebabCase}, ${kindPascalCase}, ${kindCamelCase}, ${resourceTypeLowerCase}, ${resourceTypeUpperCase}, ${resourceTypeKebabCase}, ${resourceTypePascalCase}, ${resourceTypeCamelCase}, ${operationTypeLowerCase}, ${operationTypeUpperCase}, ${operationTypeKebabCase}, ${operationTypePascalCase}, ${operationTypeCamelCase}, ${resultLowerCase}, ${resultUpperCase}, ${resultKebabCase}, ${resultPascalCase}, ${resultCamelCase}

Custom Attributes¶

Custom message attributes can be added:

kete.routes.sns.destination.attributes.Source=keycloak
kete.routes.sns.destination.attributes.Environment=production

Custom Headers¶

Custom headers are also included as SNS message attributes:

kete.routes.sns.destination.headers.X-Source=keycloak
kete.routes.sns.destination.headers.X-Environment=production

Both attributes.* and headers.* entries are sent as SNS message attributes. On key conflict, headers.* values take precedence. The standard eventkind, eventtype and contenttype attributes are always added and override any custom attribute with the same name.

Authentication¶

AWS SNS uses the AWS SDK credential provider chain. See AWS EventBridge Authentication for the full list of authentication methods — they are identical across all AWS destinations.

TLS Properties¶

See TLS & mTLS for full details on TLS options.

Property	Default	Description
`destination.tls.enabled`	`false`	Enable TLS
`destination.tls.key-store.*`	-	Client certificate for mTLS
`destination.tls.trust-store.*`	-	CA certificates

Configuration Examples¶

Example 1: Production Setup¶

kete.routes.prod.destination.kind=aws-sns
kete.routes.prod.realm-matchers.realm=list:master
kete.routes.prod.event-matchers.filter=glob:*
kete.routes.prod.destination.topic=keycloak-events
kete.routes.prod.destination.region=us-east-1
kete.routes.prod.destination.account-id=123456789012
kete.routes.prod.destination.authentication-type=access-key
kete.routes.prod.destination.access-key-id=AKIAIOSFODNN7EXAMPLE
kete.routes.prod.destination.secret-access-key=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY

Example 2: FIFO Topic with Subject¶

kete.routes.fifo.destination.kind=aws-sns
kete.routes.fifo.destination.topic=keycloak-events.fifo
kete.routes.fifo.destination.region=us-east-1
kete.routes.fifo.destination.account-id=123456789012
kete.routes.fifo.destination.subject=KeycloakEvent
kete.routes.fifo.destination.message-group-id=keycloak

Example 3: Local Development with LocalStack¶

kete.routes.local.destination.kind=aws-sns
kete.routes.local.realm-matchers.realm=list:master
kete.routes.local.destination.topic=keycloak-events
kete.routes.local.destination.region=us-east-1
kete.routes.local.destination.endpoint-url=http://localstack:4566

Quick Starts¶

Quick Start	Description
aws-sns-emulator	LocalStack Emulator (local)
aws-sns	Real AWS SNS