A CloudWatch alarm publishes to an SNS topic. An on-call email address was subscribed an hour ago, a test alarm fired, and no mail arrived. The subscription shows PendingConfirmation. What should the operator do first?
Select an answer to reveal the explanation.
Short Explanation
SNS will not talk to an address that has not said yes yet. PendingConfirmation means the invite is still sitting there, so you confirm it. Building the alarm a second time does not answer an invite the inbox already has.
Full Explanation
An SNS email subscription does not receive messages until the address confirms. PendingConfirmation is that wait state, so the alarm can publish and the topic can still drop the message for that endpoint. Confirming the subscription is the first fix. Recreating the alarm resends nothing to an unconfirmed endpoint and throws away alarm history for no gain. Replacing email with SQS changes the paging design the team asked for; it is not how you finish an email subscription. Shield Advanced is a DDoS service and does not confirm SNS endpoints. Caveat: after confirmation, a filter policy on the subscription can still suppress the alarm message, so check for a filter if mail is still missing. Operational check: the subscription status should read Confirmed, and a new test notification should arrive at that address.