@reventlessdev/reventless-aws 3.0.0-alpha.222 → 3.0.0-alpha.224

package/CHANGELOG.md

@@ -3,6 +3,29 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.224 (2026-07-22)
+
+### Bug Fixes
+
+* **aws:** register the QueuePolicy -> Queue dependency so destroys order correctly ([81cf2b3](https://github.com/ReventlessDev/reventless-core/commit/81cf2b3198fea7ad280817d2414102089ba0f13d))
+* **aws:** scope the CommandTopic queue policy's EventBridge send grant ([2f5f148](https://github.com/ReventlessDev/reventless-core/commit/2f5f148f4d73b2997633207f071c8d055960cc75))
+
+
+# 3.0.0-alpha.223 (2026-07-22)
+
+* refactor!: retire the stale "Admin" vocabulary for platform-owned resources ([2770bd9](https://github.com/ReventlessDev/reventless-core/commit/2770bd96f309142bdfc65b9f36bd1a3ef60641bd))
+
+### BREAKING CHANGES
+
+* platform-owned resources are renamed Admin* -> Platform*
+(PlatformDcbEventLog, PlatformDcbCmdTopic, PlatformEventColl). This replaces
+a DynamoDB table, an SQS queue and an SNS topic — wipe and redeploy rather
+than migrate. Both alpha AdminDcbEventLog tables held 0 items at the time of
+the rename. MCP resource URI templates change from Admin/<field>/{id} to
+Platform/<field>/{id}; MCP tool names are unaffected.
+
+
+
 # 3.0.0-alpha.222 (2026-07-22)
 
 * refactor!: retire the stale "core" vocabulary for platform things ([34e7480](https://github.com/ReventlessDev/reventless-core/commit/34e7480992bd58906a250b0a1ce6ff2c5ba45260))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.222",
+  "version": "3.0.0-alpha.224",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "dependencies": {
@@ -9,16 +9,16 @@
     "sury": "11.0.0-alpha.4",
     "uuid": "^13.0.0",
     "@reventlessdev/rescript-aws-sdk": "2.2.0-alpha.24",
-    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.57",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.30",
     "@reventlessdev/rescript-jest": "1.0.0-alpha.9",
+    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.57",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.17",
     "@reventlessdev/rescript-uuid": "1.1.0-alpha.17",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.176",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.40",
-    "@reventlessdev/reventless-interop": "3.0.0-alpha.29",
     "@reventlessdev/reventless-infra": "3.0.0-alpha.104",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.80"
+    "@reventlessdev/reventless-core": "3.0.0-alpha.177",
+    "@reventlessdev/reventless-interop": "3.0.0-alpha.29",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.80",
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.41"
   },
   "devDependencies": {
     "rescript": "12.3.0",

package/src/Platform.res

@@ -154,7 +154,7 @@ module MakeWithConfig = (
   let adminSourceSdl = (): string =>
     assembleCanonicalSourceSdl(
       ~baseFragment=AppSync_Adapter.injectAwsAuthAll(
-        ReventlessCore.AdminApi.baseFragment(~cloner=Config.cloner),
+        ReventlessCore.Platform_AdminApi.baseFragment(~cloner=Config.cloner),
         ~group="Admin",
       ),
     )
@@ -850,7 +850,7 @@ module MakeWithConfig = (
   // admin-prefixed `Platform_Plugin` / `Platform_Plugins` SDL fields declared by
   // PluginBaseFragment.queryEntries. Field-name alignment is handled by the
   // queryFieldNamesRegistry entries that Platform_Admin.construct populates
-  // from AdminApi.queryEntries before this builder runs.
+  // from Platform_AdminApi.queryEntries before this builder runs.
   module PluginReadModel = ReadModel_Builder_Single_Stream.Make(
     ReventlessCore.PluginsReadModelSpec,
     PluginReadModelMappings,
@@ -1124,7 +1124,7 @@ module MakeWithConfig = (
 
     module PluginExtensionPoint = Plugin_ExtensionPoint_Builder.MakeWithConfig({
       // Cross-plugin SNS subscription management runs in the bundled
-      // AdminEventCollector Lambda (AdminEventCollectorEntryPoint.mjs), not in
+      // AdminEventCollector Lambda (EventCollectorEntryPoint.mjs), not in
       // this deploy-time EP Lambda — which only handles incoming commands
       // (Heartbeat, ForwardCommand). None here keeps the deploy-time path
       // unchanged; the .mjs entry point supplies a real implementation.

package/src/Platform.res.mjs

@@ -15,7 +15,6 @@ import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js
 import * as Plugin$ReventlessAws from "./components/Plugin.res.mjs";
 import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/Logger.res.mjs";
 import * as Message$ReventlessCore from "@reventlessdev/reventless-core/src/Message.res.mjs";
-import * as AdminApi$ReventlessCore from "@reventlessdev/reventless-core/src/admin/AdminApi.res.mjs";
 import * as Scheduler$ReventlessAws from "./components/Scheduler.res.mjs";
 import * as Aggregate$ReventlessCore from "@reventlessdev/reventless-core/src/components/Aggregate/Aggregate.res.mjs";
 import * as Component$ReventlessCore from "@reventlessdev/reventless-core/src/components/Component.res.mjs";
@@ -44,6 +43,7 @@ import * as NoEventMappings$ReventlessInfra from "@reventlessdev/reventless-infr
 import * as Util_HostUiDomain$ReventlessAws from "./util/Util_HostUiDomain.res.mjs";
 import * as DcbEventLogStorage$ReventlessAws from "./adapter/DcbEventLog/DcbEventLogStorage.res.mjs";
 import * as ExtensionMapping$ReventlessInfra from "@reventlessdev/reventless-infra/src/types/ExtensionMapping.res.mjs";
+import * as Platform_AdminApi$ReventlessCore from "@reventlessdev/reventless-core/src/admin/Platform_AdminApi.res.mjs";
 import * as PluginsProjection$ReventlessCore from "@reventlessdev/reventless-core/src/plugin/lifecycle/PluginsProjection.res.mjs";
 import * as StateTopic_AppSync$ReventlessAws from "./adapter/StateTopic/StateTopic_AppSync.res.mjs";
 import * as AppSync_SdlDecorate$ReventlessAws from "./components/Api/AppSync_SdlDecorate.res.mjs";
@@ -148,7 +148,7 @@ function MakeWithConfig(Config) {
     subscriptionSources: []
   });
   let adminSourceSdl = () => {
-    let baseFragment = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(AdminApi$ReventlessCore.baseFragment(Config.cloner), "Admin", undefined);
+    let baseFragment = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(Platform_AdminApi$ReventlessCore.baseFragment(Config.cloner), "Admin", undefined);
     return AppSync_SdlDecorate$ReventlessAws.stampCanonicalTypes(AppSync_Adapter$ReventlessAws.stitchStandaloneWithAwsDirectives(baseFragment));
   };
   let match;
@@ -1123,7 +1123,7 @@ function Make($star) {
     subscriptionSources: []
   });
   let adminSourceSdl = () => {
-    let baseFragment = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(AdminApi$ReventlessCore.baseFragment(false), "Admin", undefined);
+    let baseFragment = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(Platform_AdminApi$ReventlessCore.baseFragment(false), "Admin", undefined);
     return AppSync_SdlDecorate$ReventlessAws.stampCanonicalTypes(AppSync_Adapter$ReventlessAws.stitchStandaloneWithAwsDirectives(baseFragment));
   };
   let match;

package/src/adapter/Adapter_Helpers.res

@@ -1,3 +1,9 @@
+// SQS queue ARN is `arn:aws:sqs:<region>:<accountId>:<name>` — segment index 4
+// (0-based). Used to scope queue-policy service principals to this account via
+// the aws:SourceAccount condition key.
+let accountIdOfQueueArn = (queueArn: string) =>
+  queueArn->String.split(":")->Array.get(4)->Option.getOr("")
+
 let dynamoDbStreamResources = eventTopicResources =>
   eventTopicResources->ReventlessCore.Util.Adapter.filterSupportedResolvedResources([
     AWS.DynamoDbStream.service,

package/src/adapter/Adapter_Helpers.res.mjs

@@ -1,8 +1,13 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as AWS$ReventlessAws from "./AWS.res.mjs";
 import * as Util_Adapter$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util_Adapter.res.mjs";
 
+function accountIdOfQueueArn(queueArn) {
+  return Stdlib_Option.getOr(queueArn.split(":")[4], "");
+}
+
 function dynamoDbStreamResources(eventTopicResources) {
   return Util_Adapter$ReventlessCore.filterSupportedResolvedResources(eventTopicResources, [AWS$ReventlessAws.DynamoDbStream.service]);
 }
@@ -29,6 +34,7 @@ function dynamoDbResources(resources) {
 }
 
 export {
+  accountIdOfQueueArn,
   dynamoDbStreamResources,
   snsResources,
   sqsResources,

package/src/adapter/CommandGenerator/CommandGeneratorResolvers_AppSync.res

@@ -190,7 +190,7 @@ let makeDcb = (
   ~fieldNames: array<string>,
   ~tags: array<string>,
   // Admin (onAdminApi) DCB slices expose ONLY their mutation fields (declared in the
-  // static AdminApi.baseFragment). The static base does NOT declare their `on<Field>`
+  // static Platform_AdminApi.baseFragment). The static base does NOT declare their `on<Field>`
   // subscription counterparts, so creating Source-C subscription resolvers would fail
   // with CreateResolver NotFound. Suppress subscriptions for admin; plugins keep them
   // (their generated fragment declares the matching subscription fields).

package/src/adapter/CommandTopic/CommandTopicChannel_Helpers.res

@@ -1,55 +1,73 @@
 open PulumiAws.PolicyDocument
 open Adapter_Helpers
 
+let createQueuePolicyDocument = (~name, ~queueArn: string, ~lambdaArn: string) => {
+  let accountId = queueArn->accountIdOfQueueArn
+  PulumiAws.PolicyDocument.make(
+    ~id=name ++ "QueuePolicy",
+    ~statements=[
+      {
+        sid: "AllowLambdaToAccessQueue",
+        effect: Allow,
+        principal: Principals({
+          service: PrincipalId(AWS.Lambda.principal),
+        }),
+        actions: Actions(["sqs:ReceiveMessage", "sqs:DeleteMessage", "sqs:GetQueueAttributes"]),
+        resources: Resource(queueArn),
+        conditions: {
+          arnEquals: [("AWS:SourceArn", ConditionValue(lambdaArn))]->Dict.fromArray,
+        },
+      },
+      {
+        // ScheduledPublisher creates EventBridge rules at runtime
+        // (PutRule/PutTargets) targeting this queue directly, and EventBridge
+        // authorises SQS targets against the queue's resource policy — so the
+        // grant cannot name a single rule ARN. Scope it to rules in this
+        // account instead: SourceAccount closes the cross-account hole,
+        // ArnLike narrows the in-account surface to Events rules.
+        sid: "AllowCloudWatchEventsToSendToQueue",
+        effect: Allow,
+        principal: Principals({
+          service: PrincipalId(AWS.CloudwatchEventRule.principal),
+        }),
+        actions: Actions(["sqs:SendMessage"]),
+        resources: Resource(queueArn),
+        conditions: {
+          stringEquals: [("aws:SourceAccount", ConditionValue(accountId))]->Dict.fromArray,
+          arnLike: [
+            ("aws:SourceArn", ConditionValue(`arn:aws:events:*:${accountId}:rule/*`)),
+          ]->Dict.fromArray,
+        },
+      },
+    ],
+  )->toJsonString
+}
+
 let createQueuePolicy = (
   queue: PulumiAws.SQS.Queue.t,
   name,
   lambda: Pulumi.Output.t<PulumiAws.Lambda.Function.t>,
   opts,
 ) => {
-  let _ =
-    (queue.arn, queue.id, lambda->Pulumi.Output.flatMap(lambda => lambda.arn))
-    ->Pulumi.Output.all3
-    ->Pulumi.Output.apply(((queueArn, queueId, lambdaArn)) => {
-      let queuePolicyDocument =
-        PulumiAws.PolicyDocument.make(
-          ~id=name ++ "QueuePolicy",
-          ~statements=[
-            {
-              sid: "AllowLambdaToAccessQueue",
-              effect: Allow,
-              principal: Principals({
-                service: PrincipalId("lambda.amazonaws.com"),
-              }),
-              actions: Actions([
-                "sqs:ReceiveMessage",
-                "sqs:DeleteMessage",
-                "sqs:GetQueueAttributes",
-              ]),
-              resources: Resource(queueArn),
-              conditions: {
-                arnEquals: [("AWS:SourceArn", ConditionValue(lambdaArn))]->Dict.fromArray,
-              },
-            },
-            {
-              sid: "AllowCloudWatchEventsToSendToQueue",
-              effect: Allow,
-              principal: Principals({
-                service: PrincipalId("events.amazonaws.com"),
-              }),
-              actions: Actions(["sqs:SendMessage"]),
-              resources: Resource(queueArn),
-            },
-          ],
-        )
-        ->toJsonString
-        ->Pulumi.Input.make
-      let _queuePolicy = PulumiAws.SQS.QueuePolicy.make(
-        ~name,
-        ~args={queueUrl: queueId->Pulumi.Input.make, policy: queuePolicyDocument},
-        ~opts=Some(opts),
-      )
-    })
+  // The document is a *value* derived from resolved ARNs, so it is built in an
+  // apply. The QueuePolicy itself stays outside: passing `queue.id` as an Output
+  // is what registers the policy -> queue dependency, without which Pulumi has
+  // no ordering constraint and can delete the queue first on a replacement,
+  // leaving the policy's delete polling a queue that no longer exists.
+  let queuePolicyDocument =
+    (queue.arn, lambda->Pulumi.Output.flatMap(lambda => lambda.arn))
+    ->Pulumi.Output.all2
+    ->Pulumi.Output.apply(((queueArn, lambdaArn)) =>
+      createQueuePolicyDocument(~name, ~queueArn, ~lambdaArn)
+    )
+  let _queuePolicy = PulumiAws.SQS.QueuePolicy.make(
+    ~name,
+    ~args={
+      queueUrl: queue.id->Pulumi.Output.asInput,
+      policy: queuePolicyDocument->Pulumi.Output.asInput,
+    },
+    ~opts=Some(opts),
+  )
 }
 
 let createLambdaPolicy = (
@@ -100,10 +118,10 @@ let createLambdaPolicy = (
                       "dynamodb:UpdateItem",
                       "dynamodb:DeleteItem",
                       "dynamodb:BatchWriteItem",
-                      // Phase 7 cross-partition fences emit read-only
-                      // `ConditionCheck` entries inside `TransactWriteItems`
-                      // when a write doesn't touch the cross-partition tag's
-                      // partition itself; this needs its own IAM action.
+                      // Cross-partition fences emit read-only `ConditionCheck`
+                      // entries inside `TransactWriteItems` when a write
+                      // doesn't touch the cross-partition tag's partition
+                      // itself; this needs its own IAM action.
                       "dynamodb:ConditionCheckItem",
                     ]),
                     resources: Resources(

package/src/adapter/CommandTopic/CommandTopicChannel_Helpers.res.mjs

@@ -5,53 +5,65 @@ import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
 import * as Output$Pulumi from "@reventlessdev/rescript-pulumi-pulumi/src/Output.res.mjs";
 import * as Pulumi from "@pulumi/pulumi";
 import * as Lambda$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/Lambda/Lambda.res.mjs";
+import * as AWS$ReventlessAws from "../AWS.res.mjs";
 import * as Adapter$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/Adapter.res.mjs";
 import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
 import * as Adapter_Helpers$ReventlessAws from "../Adapter_Helpers.res.mjs";
 import * as Util_EventSourceMapping$ReventlessAws from "../../util/Util_EventSourceMapping.res.mjs";
 
+function createQueuePolicyDocument(name, queueArn, lambdaArn) {
+  let accountId = Adapter_Helpers$ReventlessAws.accountIdOfQueueArn(queueArn);
+  return PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + "QueuePolicy", [
+    {
+      Sid: "AllowLambdaToAccessQueue",
+      Principal: {
+        Service: AWS$ReventlessAws.Lambda.principal
+      },
+      Effect: "Allow",
+      Action: [
+        "sqs:ReceiveMessage",
+        "sqs:DeleteMessage",
+        "sqs:GetQueueAttributes"
+      ],
+      Resource: queueArn,
+      Condition: {
+        ArnEquals: Object.fromEntries([[
+            "AWS:SourceArn",
+            lambdaArn
+          ]])
+      }
+    },
+    {
+      Sid: "AllowCloudWatchEventsToSendToQueue",
+      Principal: {
+        Service: AWS$ReventlessAws.CloudwatchEventRule.principal
+      },
+      Effect: "Allow",
+      Action: ["sqs:SendMessage"],
+      Resource: queueArn,
+      Condition: {
+        StringEquals: Object.fromEntries([[
+            "aws:SourceAccount",
+            accountId
+          ]]),
+        ArnLike: Object.fromEntries([[
+            "aws:SourceArn",
+            `arn:aws:events:*:` + accountId + `:rule/*`
+          ]])
+      }
+    }
+  ]));
+}
+
 function createQueuePolicy(queue, name, lambda, opts) {
-  Pulumi.all([
+  let queuePolicyDocument = Pulumi.all([
     queue.arn,
-    queue.id,
     Output$Pulumi.flatMap(lambda, lambda => lambda.arn)
-  ]).apply(param => {
-    let queueArn = param[0];
-    let queuePolicyDocument = PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + "QueuePolicy", [
-      {
-        Sid: "AllowLambdaToAccessQueue",
-        Principal: {
-          Service: "lambda.amazonaws.com"
-        },
-        Effect: "Allow",
-        Action: [
-          "sqs:ReceiveMessage",
-          "sqs:DeleteMessage",
-          "sqs:GetQueueAttributes"
-        ],
-        Resource: queueArn,
-        Condition: {
-          ArnEquals: Object.fromEntries([[
-              "AWS:SourceArn",
-              param[2]
-            ]])
-        }
-      },
-      {
-        Sid: "AllowCloudWatchEventsToSendToQueue",
-        Principal: {
-          Service: "events.amazonaws.com"
-        },
-        Effect: "Allow",
-        Action: ["sqs:SendMessage"],
-        Resource: queueArn
-      }
-    ]));
-    new (Aws.sqs.QueuePolicy)(name, {
-      policy: queuePolicyDocument,
-      queueUrl: param[1]
-    }, opts);
-  });
+  ]).apply(param => createQueuePolicyDocument(name, param[0], param[1]));
+  new (Aws.sqs.QueuePolicy)(name, {
+    policy: queuePolicyDocument,
+    queueUrl: queue.id
+  }, opts);
 }
 
 function createLambdaPolicy(lambdaRole, name, queue, resources, opts) {
@@ -138,6 +150,7 @@ function subscribeLambda2SqsTopic(batchSize, lambda, name, queue, opts) {
 }
 
 export {
+  createQueuePolicyDocument,
   createQueuePolicy,
   createLambdaPolicy,
   subscribeLambda2SqsTopic,

package/src/adapter/EventCollector/EventCollectorChannel_Helpers.res

@@ -10,64 +10,62 @@ let toResources = (eventTopics: ReventlessCore.EventTopic.allOutputs) =>
   ->Array.flatMap(outputs => outputs.resources)
   ->ReventlessCore.Adapter.resourcesToResolvedOutput
 
-let createQueuePolicy = (queue: PulumiAws.SQS.Queue.t, name, _resources, opts) => {
-  let _ =
-    (queue.arn, queue.id)
-    ->Pulumi.Output.all2
-    ->Pulumi.Output.apply(((queueArn, queueId)) => {
-      // SQS queue ARN is `arn:aws:sqs:<region>:<accountId>:<name>` — segment
-      // index 4 (0-based). Used to scope cross-plugin SNS sources to this
-      // account (aws:SourceAccount) and to topic names following the
-      // Reventless EventTopic naming convention (aws:SourceArn arnLike).
-      let accountId = queueArn->String.split(":")->Array.get(4)->Option.getOr("")
-      let queuePolicyDocument =
-        PulumiAws.PolicyDocument.make(
-          ~id=name ++ "QueuePolicy",
-          ~statements=[
-            // Single statement allows SendMessage from any SNS topic owned by
-            // this AWS account whose name matches the Reventless EventTopic
-            // naming convention. Replaces the previous per-topic arnEquals
-            // list so cross-plugin SNS subscriptions created at runtime by the
-            // admin's manageSubscriptions hook (Phase 3 Step 1) are accepted
-            // without requiring a redeploy of the receiving plugin. Security
-            // boundary: SourceAccount condition keeps third-party-account
-            // topics out; ArnLike + SNS service principal further narrows
-            // accepted senders to in-account EventTopic resources.
-            {
-              sid: "AllowReceiveSnsEvents",
-              principal: Principals({
-                service: PrincipalIds([AWS.SNS.principal]),
-              }),
-              effect: Allow,
-              actions: Actions(["sqs:SendMessage"]),
-              resources: Resource(queueArn),
-              conditions: {
-                stringEquals: [
-                  ("aws:SourceAccount", ConditionValue(accountId)),
-                ]->Dict.fromArray,
-                arnLike: [
-                  ("aws:SourceArn", ConditionValue(`arn:aws:sns:*:${accountId}:*EventTopic-*`)),
-                ]->Dict.fromArray,
-              },
-            },
-          ],
-        )
-        ->toJsonString
-        ->Pulumi.Input.make
-      let _queuePolicy = {
-        PulumiAws.SQS.QueuePolicy.make(
-          ~name,
-          ~args={
-            queueUrl: queueId->Pulumi.Input.make,
-            policy: queuePolicyDocument,
+let createQueuePolicy = (queue: PulumiAws.SQS.Queue.t, name, opts) => {
+  // The document is a *value* derived from the resolved ARN, so it is built in
+  // an apply. The QueuePolicy itself stays outside: passing `queue.id` as an
+  // Output is what registers the policy -> queue dependency, without which
+  // Pulumi has no ordering constraint and can delete the queue first on a
+  // replacement, leaving the policy's delete polling a queue that is gone.
+  let queuePolicyDocument = queue.arn->Pulumi.Output.apply(queueArn => {
+    // Scopes cross-plugin SNS sources to this account (aws:SourceAccount) and
+    // to topic names following the Reventless EventTopic naming convention
+    // (aws:SourceArn arnLike).
+    let accountId = queueArn->accountIdOfQueueArn
+    PulumiAws.PolicyDocument.make(
+      ~id=name ++ "QueuePolicy",
+      ~statements=[
+        // Single statement allows SendMessage from any SNS topic owned by
+        // this AWS account whose name matches the Reventless EventTopic
+        // naming convention. A per-topic arnEquals list would require a
+        // redeploy of the receiving plugin whenever the platform's
+        // manageSubscriptions hook creates a cross-plugin SNS subscription at
+        // runtime. Security boundary: SourceAccount keeps third-party-account
+        // topics out; ArnLike + SNS service principal further narrows accepted
+        // senders to in-account EventTopic resources.
+        {
+          sid: "AllowReceiveSnsEvents",
+          principal: Principals({
+            service: PrincipalIds([AWS.SNS.principal]),
+          }),
+          effect: Allow,
+          actions: Actions(["sqs:SendMessage"]),
+          resources: Resource(queueArn),
+          conditions: {
+            stringEquals: [("aws:SourceAccount", ConditionValue(accountId))]->Dict.fromArray,
+            arnLike: [
+              ("aws:SourceArn", ConditionValue(`arn:aws:sns:*:${accountId}:*EventTopic-*`)),
+            ]->Dict.fromArray,
           },
-          ~opts=Some(opts),
-        )
-      }
-    })
+        },
+      ],
+    )->toJsonString
+  })
+  let _queuePolicy = PulumiAws.SQS.QueuePolicy.make(
+    ~name,
+    ~args={
+      queueUrl: queue.id->Pulumi.Output.asInput,
+      policy: queuePolicyDocument->Pulumi.Output.asInput,
+    },
+    ~opts=Some(opts),
+  )
 }
 
-let subscribeQueue2SnsTopic = (queue, name, resources: array<ReventlessInfra.Adapter.resolvedResource>, opts) => {
+let subscribeQueue2SnsTopic = (
+  queue,
+  name,
+  resources: array<ReventlessInfra.Adapter.resolvedResource>,
+  opts,
+) => {
   let _snsTopicSubscriptions = resources->Array.map(resource => {
     log.debug(~comp="EventCollector", `subscribeToSnsTopic: ${name} -> ${resource.name}`)
     let subscription = Util_SQS.subscribeToSnsTopic(
@@ -82,17 +80,21 @@ let subscribeQueue2SnsTopic = (queue, name, resources: array<ReventlessInfra.Ada
 }
 
 let connectSqsQueue2SnsTopics = (queue: PulumiAws.SQS.Queue.t, name, eventTopics, opts) => {
+  // The policy grants SendMessage to any in-account EventTopic by naming
+  // convention, so it does not depend on the resolved topic resources and is
+  // created outside the apply. Only the SNS subscriptions need them.
+  queue->createQueuePolicy(name, opts)
   let _ =
     (eventTopics->toResources, queue.id)
     ->Pulumi.Output.all2
     ->Pulumi.Output.apply(((eventTopicResources, queueId)) => {
       log.debug(
         ~comp="EventCollector",
-        `connectSqsQueue2SnsTopics ${queueId}: ${eventTopicResources->Array.length->Int.toString} topic resource(s)`,
+        `connectSqsQueue2SnsTopics ${queueId}: ${eventTopicResources
+          ->Array.length
+          ->Int.toString} topic resource(s)`,
       )
-      let snsResources = eventTopicResources->snsResources
-      queue->createQueuePolicy(name, snsResources, opts)
-      queue->subscribeQueue2SnsTopic(name, snsResources, opts)
+      queue->subscribeQueue2SnsTopic(name, eventTopicResources->snsResources, opts)
     })
 }
 

package/src/adapter/EventCollector/EventCollectorChannel_Helpers.res.mjs

@@ -2,7 +2,6 @@
 
 import * as Aws from "@pulumi/aws";
 import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
-import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Pulumi from "@pulumi/pulumi";
 import * as Lambda$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/Lambda/Lambda.res.mjs";
 import * as AWS$ReventlessAws from "../AWS.res.mjs";
@@ -20,14 +19,10 @@ function toResources(eventTopics) {
   return Adapter$ReventlessCore.resourcesToResolvedOutput(Object.values(eventTopics).flatMap(outputs => outputs.resources));
 }
 
-function createQueuePolicy(queue, name, _resources, opts) {
-  Pulumi.all([
-    queue.arn,
-    queue.id
-  ]).apply(param => {
-    let queueArn = param[0];
-    let accountId = Stdlib_Option.getOr(queueArn.split(":")[4], "");
-    let queuePolicyDocument = PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + "QueuePolicy", [{
+function createQueuePolicy(queue, name, opts) {
+  let queuePolicyDocument = queue.arn.apply(queueArn => {
+    let accountId = Adapter_Helpers$ReventlessAws.accountIdOfQueueArn(queueArn);
+    return PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + "QueuePolicy", [{
         Sid: "AllowReceiveSnsEvents",
         Principal: {
           Service: [AWS$ReventlessAws.SNS.principal]
@@ -46,11 +41,11 @@ function createQueuePolicy(queue, name, _resources, opts) {
             ]])
         }
       }]));
-    new (Aws.sqs.QueuePolicy)(name, {
-      policy: queuePolicyDocument,
-      queueUrl: param[1]
-    }, opts);
   });
+  new (Aws.sqs.QueuePolicy)(name, {
+    policy: queuePolicyDocument,
+    queueUrl: queue.id
+  }, opts);
 }
 
 function subscribeQueue2SnsTopic(queue, name, resources, opts) {
@@ -62,15 +57,14 @@ function subscribeQueue2SnsTopic(queue, name, resources, opts) {
 }
 
 function connectSqsQueue2SnsTopics(queue, name, eventTopics, opts) {
+  createQueuePolicy(queue, name, opts);
   Pulumi.all([
     toResources(eventTopics),
     queue.id
   ]).apply(param => {
     let eventTopicResources = param[0];
     log.debug("EventCollector", undefined, `connectSqsQueue2SnsTopics ` + param[1] + `: ` + eventTopicResources.length.toString() + ` topic resource(s)`);
-    let snsResources = Adapter_Helpers$ReventlessAws.snsResources(eventTopicResources);
-    createQueuePolicy(queue, name, snsResources, opts);
-    subscribeQueue2SnsTopic(queue, name, snsResources, opts);
+    subscribeQueue2SnsTopic(queue, name, Adapter_Helpers$ReventlessAws.snsResources(eventTopicResources), opts);
   });
 }