docs(sns): expand grant* JSDoc with granted actions

[MukundaKatta]

Issue # (if applicable)

Closes #35736.

Reason for this change

The SNS Topic API reference is light on detail compared to SQS. In particular, grantPublish and grantSubscribe do not list the IAM and KMS actions they grant, so users have to read the source to confirm whether SSE-encrypted topics are handled correctly.

Description of changes

JSDoc-only update on ITopic and TopicBase in packages/aws-cdk-lib/aws-sns/lib/topic-base.ts:

• grantPublish: lists the granted IAM action (sns:Publish) and the KMS actions (kms:Decrypt, kms:GenerateDataKey*) added when the topic is encrypted with a customer-managed KMS key. Adds a @see link to the SNS server-side encryption docs.
• grantSubscribe: lists the granted IAM action (sns:Subscribe) and clarifies that this only grants permission to call the Subscribe API, not to receive messages on a particular delivery protocol. Notes that KMS permissions are not required for subscribing.

Follows the same JSDoc style already used by grantConsumeMessages / grantSendMessages in packages/aws-cdk-lib/aws-sqs/lib/queue-base.ts.

Describe any new or updated permissions being added

None. This PR is documentation only and does not change any granted permissions or generated CloudFormation output.

Description of how you validated changes

• Confirmed the listed actions against existing unit tests in packages/aws-cdk-lib/aws-sns/test/sns.test.ts:
  • give publishing permissions to CfnTopic asserts sns:Publish.
  • give service principal permissions to publish to CfnTopic with encryption key asserts kms:Decrypt and kms:GenerateDataKey* on the master key.
  • give subscribing permissions asserts sns:Subscribe.
• No runtime/behavior changes, so no new tests added.

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[aws-cdk-automation]

(This review is outdated)

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-07-31 09:48 UTC · Rule: default-squash · triggered by rule automatic merge
• ❌ Checks timed out · in-place
• 🚫 Left the queue — 2026-07-31 18:38 UTC · at 40a458865dee763c1a6656c8c1f68149913a20bf

This pull request spent 8 hours 49 minutes 47 seconds in the queue, with no time running CI.

Waiting for any of

• check-neutral = build
• check-skipped = build
• check-success = build

All conditions

• any of [🛡 GitHub branch protection]:
  • check-neutral = build
  • check-skipped = build
  • check-success = build
• github-review-approved [🛡 GitHub branch protection]
  • docs(sns): expand grant* JSDoc with granted actions #37991
• any of [🛡 GitHub branch protection]:
  • check-success = validate-pr
  • check-neutral = validate-pr
  • check-skipped = validate-pr

Reason

The merge conditions cannot be satisfied: the checks did not pass within the checks timeout of 8 hours 48 minutes 59 seconds

These checks never reported on this pull request:

• Deploy integration test snapshots (requires pr/needs-integration-tests-deployment label)
• Configuration changed

These checks were still running:

• build

Hint

A check that never reports can never satisfy its merge condition. Check that the check names in your merge conditions match what your CI publishes.

If you want to requeue this pull request, you can post a @mergifyio queue comment.

Tick the box to put this pull request back in the merge queue (same as @mergifyio queue).

• Requeue this pull request

Pull request has been modified.