## TL;DR
An SNS subscription that was never confirmed is a black hole: publishes succeed, nothing delivers, and nothing errors. Check the subscription status for PendingConfirmation, re-request confirmation, and confirm it within 3 days. Then add a recurring health check so a dead topic cannot go quiet again.

```text
agent's anomaly notification went to a dead SNS topic, the subscription was never confirmed
```

## Use this when
- Cost anomaly alerts or budget alerts are configured but nobody receives them.
- The SNS topic shows subscriptions stuck in PendingConfirmation.
- An agent set up the alerting pipeline and nobody ever verified end-to-end delivery.

## Not for this skill when
- Subscriptions are Confirmed and delivery works. The problem is routing or filtering downstream.
- You use email directly on the anomaly detection subscription rather than SNS. Confirmation is not the failure mode there.

## Steps
1. List subscriptions: `aws sns list-subscriptions-by-topic --topic-arn TOPIC_ARN`. Verify: look for `PendingConfirmation` in the output.
2. Re-request confirmation for the stuck subscription: `aws sns subscribe` with the same endpoint, which resends the confirmation message.
3. Confirm within 3 days: click the link in the confirmation email or call `aws sns confirm-subscription` with the token from the message.
4. Re-list and verify every subscription shows `Confirmed`.
5. Send a test publish to the topic and confirm it arrives end to end.
6. Add a weekly check (a cron or a CloudWatch check on the subscription state) that pages when any subscription drops out of Confirmed.

## Variant phrasings
### sns subscription pending confirmation never received
The raw AWS symptom.
### cost anomaly alert not sending notifications
How it surfaces to the FinOps team.
### aws budget sns topic no email
Same failure shape via budgets.

Compatibility: Amazon SNS; email subscriptions expire unconfirmed after 3 days. SMS subscriptions confirm via reply.

## Why it happens
SNS email subscriptions require an explicit confirmation click, and the confirmation email looks like spam, expires in 3 days, and gets resent by nobody. The anomaly detection side publishes happily to the topic either way, so there is no error anywhere to notice. Silence is the only symptom.

## Edge cases / pitfalls
- The confirmation email may be landing in a shared mailbox's spam folder. Check there before re-requesting.
- Some organizations block the confirmation link domain at the mail gateway. If confirmations never arrive, use an SMS or HTTPS endpoint subscription instead.
- Re-requesting confirmation for an already-confirmed subscription is harmless; do not be shy about it during debugging.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_-A0pvj2bBia1FbaGfsMMSQ