Why Your AWS SNS HTTP Subscriptions Fail to Confirm (and How to Fix Them)

If you’ve ever tried to hook up an AWS Simple Notification Service topic to an HTTP or HTTPS endpoint, you probably know the dance: SNS sends a SubscriptionConfirmation request, your endpoint is supposed to respond with a 200 OK, and then everything is happy.

Except sometimes… it isn’t. The subscription just sits in “PendingConfirmation”, retries keep happening, and nothing works.

Let’s unpack why that happens and how to fix it.

How Amazon SNS Subscription Confirmation Works

Here’s what happens under the hood:

1. You tell Simple Notification Service to subscribe an endpoint (HTTP or HTTPS).
2. SNS sends a POST request with a JSON message that includes:

• Type: SubscriptionConfirmation
• MessageId
• SubscribeURL (this is the key)

3. Your endpoint has to:

• Respond with HTTP 200 OK
• (Optionally) validate the signature
• And you (or your app) must call the SubscribeURL to confirm

If step 3 fails in any way, the subscription won’t confirm.

Why Confirmation Fails

Here are the most common gotchas:

• Your endpoint doesn’t return 200 OK
  Maybe it returns 302, 403, or times out. Amazon SNS needs a clean 200.
• Firewall or security group blocks SNS
  If your service runs in a private Virtual Private Cloud (VPC) and SNS can’t reach it, the request never lands.
• HTTPS certificate issues
  If you’re using HTTPS,  Amazon SNS requires a valid, trusted certificate. Self-signed certs usually break it.
• The app doesn’t handle POST
  If your endpoint only listens for GET and ignores POSTs, it’ll fail. SNS always sends a POST.
• Confirmation URL never clicked
  AWS SNS includes a SubscribeURL in the message. If you don’t hit that URL (either manually or in code), the subscription won’t move past “PendingConfirmation.”

How to Debug

When things fail, here’s where to look:

• Check your server logs: Did it even receive the POST? What status code did it send back?
• Look at the raw SNS message: Is your handler parsing JSON correctly? Did you miss SubscribeURL?
• Test with curl : Simulate the SNS POST yourself to verify your endpoint handles it.
• Use VPC Flow Logs or ALB Logs : See if SNS traffic is even making it to your service.

How to Fix

• Make sure your endpoint accepts POST and responds with HTTP 200 OK.
• If using HTTPS, ensure the cert is valid and trusted by AWS.
• Open up security groups/firewalls to allow SNS IP ranges.
• Actually, call the SubscribeURL once you get the message, and automate this in code if possible.
• For production: verify the SNS message signature to ensure it’s legit.

A Better Flow: Automating Confirmation

In practice, you don’t want to rely on a human clicking SubscribeURL. 

1. Receive the SubscriptionConfirmation message.
2. Parse out the SubscribeURL.
3. Make an HTTP GET request to that URL in code.
4. Log the result.

That way, every new subscription confirms automatically.

Wrapping It Up

AWS SNS subscription confirmation failures almost always boil down to one of two things:

1. AWS SNS can’t reach your endpoint.
2. Your endpoint doesn’t handle the request correctly.

The fix is usually straightforward once you know where to look. The hard part is realizing that it’s not SNS being flaky, it’s usually networking, HTTPS, or your handler.

Get those pieces right, and Amazon SNS subscriptions just work.