[tiwari91]

Issue

Closes #35736

Reason for this change

The existing docstrings on grantPublish(), grantSubscribe(), and addSubscription() were too brief — they didn't mention which IAM actions are actually granted or what resources are created. Users had to dig into the source or look up the CloudFormation docs to figure out what these methods do under the hood.

Description of changes

Enhanced JSDoc on both the ITopic interface and the TopicBase implementation:

• grantPublish(): Now documents that it grants sns:Publish, and when the topic uses a customer-managed KMS key, also grants kms:Decrypt and kms:GenerateDataKey*.
• grantSubscribe(): Now documents that it grants sns:Subscribe.
• addSubscription(): Now mentions it creates an AWS::SNS::Subscription resource and that the endpoint/protocol come from the ITopicSubscription implementation.

Description of how you validated changes

All existing SNS tests pass (143 tests, 5 suites). This is a docs-only change with no behavior changes.

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[mergify]

🚫 Left the queue

2 h 41 min in the queue, with no time running CI.

So far

• ✅ Entered the queue Wed 28 Oct, 15:57 · rule default-squash · triggered by rule automatic merge
• 🚫 Left the queue 18:38 · 3d8db1f

Reason

The pull request can't be updated

GitHub response: refusing to allow a GitHub App to create or update workflow .github/workflows/README.md without workflows permission
GitHub only lets Mergify write to .github/workflows/ with the workflows permission. An organization owner can accept Mergify's pending permissions at https://dashboard.mergify.com/orgs/aws/repositories.

Hint

You should update or rebase your pull request manually. If you do, this pull request will automatically be requeued once the queue conditions match again.
If you think this was a flaky issue, you can requeue the pull request, without updating it, by posting a @mergifyio queue comment.

Tick the box to put this pull request back in the merge queue (same as @mergifyio queue).

• Requeue this pull request

_{Times in UTC · dashboard · how the merge queue works}

[mergify]

Queued — the merge queue status continues in this comment ↓.

[mergify]

🚫 Left the queue

2 h 41 min in the queue, with no time running CI.

So far

• ✅ Entered the queue Wed 28 Oct, 15:57 · rule default-squash · triggered by rule automatic merge
• 🚫 Left the queue 18:38 · 3d8db1f

Reason

The pull request can't be updated

GitHub response: refusing to allow a GitHub App to create or update workflow .github/workflows/README.md without workflows permission
GitHub only lets Mergify write to .github/workflows/ with the workflows permission. An organization owner can accept Mergify's pending permissions at https://dashboard.mergify.com/orgs/aws/repositories.

Hint

You should update or rebase your pull request manually. If you do, this pull request will automatically be requeued once the queue conditions match again.
If you think this was a flaky issue, you can requeue the pull request, without updating it, by posting a @mergifyio queue comment.

Tick the box to put this pull request back in the merge queue (same as @mergifyio queue).

• Requeue this pull request

_{Times in UTC · dashboard · how the merge queue works}

Pull request has been modified.

[maintainer-for-aws]

Automated review

A maintainer will still review this — treat the notes below as a starting point.

📌 Commit 602eba1

This PR enriches the JSDoc on three SNS topic methods — addSubscription, grantPublish, and grantSubscribe — in packages/aws-cdk-lib/aws-sns/lib/topic-base.ts, documenting the IAM actions each grant produces (sns:Publish plus conditional kms:Decrypt/kms:GenerateDataKey*, and sns:Subscribe) and the AWS::SNS::Subscription resource created. The change is comment text only: no signatures, types, exports, logic paths, or synthesized output are altered. The documented actions and the KMS caveat match the actual grant behavior, and no new regression, breaking change, or security exposure is introduced. No issues found on this change.

🔴 0 blocking · 🟡 0 recommended · ⚪ 0 optional

---

Generated automatically. React 👍 or 👎 to tell us whether this review helped, so we can improve these reviews.