agent's anomaly notification went to a dead SNS topic, the subscription was never confirmed

TL;DR

An SNS subscription that was never confirmed is a black hole: publishes succeed, nothing delivers, and nothing errors. Check the subscription status for PendingConfirmation, re-request confirmation, and confirm it within 3 days. Then add a recurring health check so a dead topic cannot go quiet again.

agent's anomaly notification went to a dead SNS topic, the subscription was never confirmed

Use this when

• Cost anomaly alerts or budget alerts are configured but nobody receives them.
• The SNS topic shows subscriptions stuck in PendingConfirmation.
• An agent set up the alerting pipeline and nobody ever verified end-to-end delivery.

Not for this skill when

• Subscriptions are Confirmed and delivery works. The problem is routing or filtering downstream.
• You use email directly on the anomaly detection subscription rather than SNS. Confirmation is not the failure mode there.

Steps

1. List subscriptions: aws sns list-subscriptions-by-topic --topic-arn TOPIC_ARN. Verify: look for PendingConfirmation in the output.
2. Re-request confirmation for the stuck subscription: aws sns subscribe with the same endpoint, which resends the confirmation message.
3. Confirm within 3 days: click the link in the confirmation email or call aws sns confirm-subscription with the token from the message.
4. Re-list and verify every subscription shows Confirmed.
5. Send a test publish to the topic and confirm it arrives end to end.
6. Add a weekly check (a cron or a CloudWatch check on the subscription state) that pages when any subscription drops out of Confirmed.

Variant phrasings

sns subscription pending confirmation never received

The raw AWS symptom.

cost anomaly alert not sending notifications

How it surfaces to the FinOps team.

aws budget sns topic no email

Same failure shape via budgets.

Compatibility: Amazon SNS; email subscriptions expire unconfirmed after 3 days. SMS subscriptions confirm via reply.

Why it happens

SNS email subscriptions require an explicit confirmation click, and the confirmation email looks like spam, expires in 3 days, and gets resent by nobody. The anomaly detection side publishes happily to the topic either way, so there is no error anywhere to notice. Silence is the only symptom.

Edge cases / pitfalls

• The confirmation email may be landing in a shared mailbox's spam folder. Check there before re-requesting.
• Some organizations block the confirmation link domain at the mail gateway. If confirmations never arrive, use an SMS or HTTPS endpoint subscription instead.
• Re-requesting confirmation for an already-confirmed subscription is harmless; do not be shy about it during debugging.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_-A0pvj2bBia1FbaGfsMMSQ