/
AWS-SNS-SNS-Topic-Policies

AWS-SNS-SNS-Topic-Policies

Severity : Critical

Description: This controls ensures that SNS topics do not allow Everyone to subscribe. Allowing anonymous users to have access to SNS topics can lead to unauthorized actions. To avoid data leakage, limit access to SNS topics by implementing the necessary policies. SNS topic policy should not contain allow Everyone with Action: "SNS: Subscribe" and "SNS: Receive". When granting permissions only specific users must be given permissions by implementing least-privilege access.

Remediation Steps:

Perform following to modify the default security group for VPC:

  1. Login to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to SNS console.

  3. Select Topics in navigation and select the reported topic from the list.

  4. Navigate to the Access Policy section and , click Edit.

  5. Edit Action statement to replace wildcard(*) to specific actions required for role or users.

  6. Edit Resources statement to include specific SNS topics the action is allowed.

  7. Edit Principal from wildcard(*) to specific IAM Users or Role ARN allowed.

  8. Click Save Changes.

Important:

Reference:

  • set-topic-attributes — AWS CLI 1.37.21 Command Reference

  • { "Version":"2008-10-17", "Id":"__default_policy_ID", "Statement":[ { "Sid":"__default_statement_ID", "Effect":"Allow", "Principal":{ "AWS":"*" }, "Action":[ "SNS:GetTopicAttributes", "SNS:SetTopicAttributes", "SNS:AddPermission", "SNS:RemovePermission", "SNS:DeleteTopic", "SNS:Subscribe", "SNS:ListSubscriptionsByTopic", "SNS:Publish", "SNS:Receive" ], "Resource":"[SNS_TOPIC_ARN]", "Condition":{ "StringEquals":{ "AWS:SourceOwner":"[Account_ID]" } } } ] }

     

Related content

AWS-EC2-VPC-Endpoint-Exposed
AWS-EC2-VPC-Endpoint-Exposed
More like this
AWS-EC2-Default-Security-Group
AWS-EC2-Default-Security-Group
More like this
AWS-EC2-Unrestricted-Network-ACL-Outbound-Traffic
AWS-EC2-Unrestricted-Network-ACL-Outbound-Traffic
More like this
AWS-SNS-SNS-Topic-CMK-Encryption
AWS-SNS-SNS-Topic-CMK-Encryption
More like this
AWS-IAM-IAM-Role-Policies
AWS-IAM-IAM-Role-Policies
More like this
AWS-SNS-SNS-Topic-Encrypted
AWS-SNS-SNS-Topic-Encrypted
More like this

Blue Hexagon Proprietary