How do I configure aws_sns_topic_arn_allowlist?

Since updating to 2026.1.5, I now see this site advice:

The server is configured to send emails via Amazon SES but you haven’t allowlisted any SNS topic ARNs. Bounce notifications will be rejected until you add the legitimate ARN to aws_sns_topic_arn_allowlist.

I can’t find any information about this setting though.

I found this in the 2026.1.5 changelog, but it doesn’t really explain what to do: SECURITY: Prevent any signed AWS SNS TopicARN from being accepted via… · discourse/discourse@3a3d315 · GitHub

I saw that too.

On the Amazon SNS console I already had two “Topics” set up. I have only hazy memories of setting up SES. It must have been in the relevant Discourse instructions. It’s also mentioned in this recent topic: How do I properly configure the AWS SNS topic ARN allowlist?.

One was for bounces and one for complaints, and there were ARNs for each in the format arn:aws:sns:eu-west-1:111111111111:DiscourseBounces. I put both of these ARNs into the aws_sns_topic_arn_allowlist Discourse setting and the warning doesn’t appear any more. I hope that means I did the right thing…