Troubleshooting Tip: Lacework FortiCNAPP Control Tower integration failure due to AWSControlTowerExecution is not authorized to perform: SNS:Subscribe

When using the Lacework FortiCNAPP AWS Control Tower Cloudformation template, it is possible to get an error that 

AWSControlTowerExecution is not authorized to perform:

SNS:Subscribe on resource: arn:aws:sns:region:account_id:lacework-controltower-sns-topic because no resource-based policy allows the SNS:Subscribe action.

The reason this happens is when using a non-default SNS topic for Cloudtrail which isn't called aws-controltower-BaselineCloudTrail. The error is because no resource-based policy allows the SNS:Subscribe action for the SNS topic. The resource based policy has to specifically allow this. While the IAM (identity) policy does allow SNS:Subscribe, there also need to be a resource policy that allow SNS:Subscribe.

Refer to the AWS documentation on resource based policies:

Troubleshoot access denied error messages - AWS Identity and Access Management.

Access denied due to resource-based policies – implicit denial
Check for a missing Allow statement for the action in your resource-based policy.

Update the policy by adding the Allow statement. For more information, see Resource-based policies in Troubleshoot access denied error messages - AWS Identity and Access Management.

To resolve this issue, add a policy for the SNS topic with the following:

{

   "Sid": "AllowControlTowerSubscription",
   "Effect": "Allow",
   "Principal": {
       "AWS": "arn:aws:iam::account_id:role/AWSControlTowerExecution"
   },
   "Action": "SNS:Subscribe",
   "Resource": "arn:aws:sns:us-west-2:account_id:lacework-controltower-sns-topic"
}

Replace the ARNs with the AWSControlTowerExecution role and the SNS topic ARNs.