cost anomaly subscription emails never arrive - the SNS subscriber is still stuck in PendingConfirmation

TL;DR

Anomaly detection is probably firing fine; the email leg is broken. The most common cause is an SNS email subscription stuck in PendingConfirmation because nobody clicked the confirmation link. Confirm it, then trace the rest of the path from SNS topic to inbox.

Use this when

• The anomaly dashboard shows alerts but no email arrives.
• A new subscriber was added recently and never got mail.
• Alerts reach some subscribers but not others.

Not for this skill when

• No alerts appear in the dashboard either. That is a monitor or threshold problem.
• You need SMS or Slack delivery. The SNS mechanics differ.

Steps

1. Check the subscription state: open SNS, find the topic the anomaly subscription uses, and look at the subscriber list. Verify: every email endpoint shows Confirmed, not PendingConfirmation.
2. If it is pending, re-request the confirmation and click the link in the confirmation email within 3 days. Verify: the endpoint flips to Confirmed.
3. Send a test publish to the topic from the SNS console. Verify: the test email arrives within a minute.
4. Check spam, corporate quarantine, and inbox rules for mail from the SNS sender address. Verify: a deliberate send is found or confirmed absent.
5. Check the topic policy allows sns:Publish from the cost anomaly detection service principal. Verify: the policy statement exists and matches the topic ARN.

Bulk subscriber variant

When adding several addresses at once, each one confirms independently. Verify: the Confirmed count equals the number of addresses you added.

Corporate email gateway variant

Some gateways strip or quarantine AWS confirmation links. Verify: the gateway logs show the confirmation email delivered, then click from a device that can reach the link.

Compatibility: AWS Cost Anomaly Detection with SNS email subscriptions.

Why it happens

SNS requires an explicit opt-in click per email endpoint. The anomaly subscription setup flow creates the SNS subscription but cannot complete the opt-in for you, so the whole chain sits silent until someone clicks.

Edge cases / pitfalls

• Confirmation links expire. Re-request a fresh one instead of clicking an old one.
• One unconfirmed subscriber does not block the others; check each endpoint individually.
• If the topic was recreated, subscriptions do not carry over.
• Corporate mail policies that rewrite links can break the confirmation token. Confirm from an unmanaged address to isolate it.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_5wT6PRW8VL4wO0kG0aNcTA