sns: properties dropped between CDK and the emulator

[Neaox]

Part of the repo-wide sweep for properties that arrive from CDK/CloudFormation and are parsed into nothing.

Priority 1 — SNS implements it, CloudFormation never passes it

snsSubscriptionHandler.Create (internal/services/cloudformation/provisioner.go:2132) sends only TopicArn, Protocol, Endpoint to Subscribe. Every subscription attribute is dropped:

Property	Emulator support
FilterPolicy	Applied at publish time — handler_publish.go:337-342 evaluates it per subscription; messageMatchesFilterPolicy at handler_publish.go:719
FilterPolicyScope	Read alongside the policy
RawMessageDelivery	Honoured for SQS/HTTP delivery (handler_publish.go:67 documents the lambda exclusion, matching AWS)
RedrivePolicy	Drives the subscription dead-letter queue (capabilities_dev.go:22)
DeliveryPolicy, SubscriptionRoleArn	Stored by SetSubscriptionAttributes, which accepts any attribute

So topic.addSubscription(new SqsSubscription(queue, { rawMessageDelivery: true, filterPolicy: {...} })) deploys clean, and then every message is delivered to every subscriber in SNS envelope format. The filtering code is there and working; nothing ever populates the attribute it reads.

AWS::SNS::Topic

snsTopicHandler.Create (provisioner.go:2092) calls CreateTopic with Name only.

• DisplayName and KmsMasterKeyId are applied via SetTopicAttributes in Update only (provisioner.go:2079-2088). On the initial deploy they are silently lost; they appear only if the stack is later updated. That asymmetry is a bug on its own.
• Fully dropped: FifoTopic, ContentBasedDeduplication, Tags, Subscription (the inline subscription list — a template that declares subscriptions inline creates none), DeliveryPolicy, SignatureVersion, TracingConfig, ArchivePolicy, DataProtectionPolicy.
• FifoTopic has no emulation behind it either (no FIFO topic handling in internal/services/sns/), so that one is echo fidelity — but it should still round-trip rather than vanish.

Suggested order

1. Subscription attributes — dispatch SetSubscriptionAttributes after Subscribe for FilterPolicy, FilterPolicyScope, RawMessageDelivery, RedrivePolicy. This turns working code back on.
2. Move DisplayName/KmsMasterKeyId into Create as well as Update.
3. Inline Subscription list on AWS::SNS::Topic.
4. Round-trip the rest.

Definition of done

• Integration coverage in tests/integration/cloudformation/: provision a topic with a filtered, raw-delivery SQS subscription, publish a non-matching and a matching message, assert only the matching one arrives and that it is raw.
• GetSubscriptionAttributes after a stack deploy agrees with the template.

Related: #183, #185.

[Neaox]

Implemented on codex/issue-522-sns-cfn in 0bdfcd78. CloudFormation SNS topics/subscriptions now forward supported attributes through the SNS APIs; SNS applies FilterPolicyScope=MessageBody and RawMessageDelivery for SQS/HTTP delivery. Added Create/Update/in-line-subscription integration coverage, docs, and changelog. Verified scoped SNS/CloudFormation tests, repository go build/vet, scoped golangci-lint, docs generation/index, and changelog validation. Existing #183 (FIFO/destination/MessageStructure gaps) and #185 (remaining fan-out/filter fidelity) continue to track adjacent work.

[Neaox]

Follow-up: amended commit is now 65a09a18. CloudFormation serializes topic tags with the AWS CLI-verified SNS Query shape Tags.member.N.Key / Tags.member.N.Value, so a future TagResource implementation receives the template values. Cross-region AWS::SNS::Subscription Region is now fail-loud and tracked separately in #633.