SNS Cross Account Access

Risk Level: High (not acceptable risk)

Rule ID: SNS-002

Ensure that all your Amazon SNS topics are configured to allow access only to trusted AWS accounts and users in order to protect against unauthorized cross-account access. Before running this rule by the Trend Cloud One™ – Conformity engine, the list with the trusted AWS identities must be configured in the rule settings, on your Conformity account console.

This rule can help you with the following compliance standards:

PCI
APRA
MAS
NIST4

For further details on compliance standards supported by Conformity, see here.

This rule can help you work with the AWS Well-Architected Framework.

This rule resolution is part of the Conformity Security & Compliance tool for AWS.

Security

Allowing unknown (unauthorized) AWS accounts and users to access your Amazon SNS topics can lead to unauthorized actions such as intercepting and publishing messages without permission. To prevent data leaks, data loss, and avoid unexpected costs on your AWS bill, limit queue access to trusted entities only by implementing the right permissions.

Audit

To determine if there are any Amazon SNS topics that allow unknown cross-account access in your AWS account, perform the following actions:

Using AWS Console

01 Sign in to the AWS Management Console.

02 Navigate to Amazon SNS console at https://console.aws.amazon.com/sns/v3.

03 In the main navigation panel, under Amazon SNS, choose Topics.

04 Click on the name (link) of the SNS topic that you want to examine.

05 Select the Access policy tab from the console bottom panel to access the permissions defined for the selected topic.

06 Within the Access policy box, identify the "Principal" element defined for each policy statement and check the element value (i.e. ARN).

07 Sign in to your Trend Cloud One™ – Conformity account, access the Unknown SNS Cross-Account Access conformity rule settings, and compare the ARN(s) identified at the previous step against each AWS account ARN defined in the rule configuration section. If one or more ARNs are not included in the list of trusted AWS identities specified in the conformity rule settings, the cross-account access configuration defined for the selected Amazon SNS topic is not secure.

08 Repeat steps no. 4 – 7 for each Amazon SNS topic available within the current AWS region.

09 Change the AWS cloud region from the console navigation bar and repeat the Audit process for other regions.

Using AWS CLI

01 Run list-topics command (OSX/Linux/UNIX) to list the Amazon Resource Name (ARN) of each Amazon SNS topic available in the selected AWS cloud region:

aws sns list-topics
  --region us-east-1
  --output table
  --query 'Topics[]'

02 The command output should return a table with the requested SNS topic ARNs:

-----------------------------------------------------------
|                       ListTopics                        |
+---------------------------------------------------------+
|                        TopicArn                         |
+---------------------------------------------------------+
|  arn:aws:sns:us-east-1:123456789012:cc-prod-sns-topic   |
|  arn:aws:sns:us-east-1:123456789012:cc-trail-sns-topic  |
+---------------------------------------------------------+

03 Run get-topic-attributes command (OSX/Linux/UNIX) using the ARN of the Amazon SNS topic that you want to examine as the identifier parameter to describe the access policy defined for the selected SNS topic:

aws sns get-topic-attributes
  --region us-east-1
  --topic-arn arn:aws:sns:us-east-1:123456789012:cc-prod-sns-topic
  --query 'Attributes.Policy'

04 The command output should return the topic policy document in JSON format:

"{
	"Version": "2008-10-17",
	"Statement": [
		{
			"Effect": "Allow",
			"Principal": {
				"AWS": "arn:aws:iam::111222333444:root"
			},
			"Action": [
				"SNS:GetTopicAttributes",
				"SNS:SetTopicAttributes",
				"SNS:DeleteTopic",
				"SNS:Subscribe",
				"SNS:ListSubscriptionsByTopic",
				"SNS:Publish"
			],
			"Resource": "arn:aws:sns:us-east-1:123456789012:cc-prod-sns-topic"
		}
	]
}"

Identify the "Principal" element defined for each policy statement and check the element value (ARN – highlighted).

05 Sign in to your Trend Cloud One™ – Conformity account, access the Unknown SNS Cross-Account Access conformity rule settings, and compare the ARN(s) identified at the previous step against each AWS account ARN defined in the rule configuration section. If one or more ARNs are not included in the list of trusted AWS identities specified in the conformity rule settings, the cross-account access to the selected Amazon SNS topic is not secured.

06 Repeat steps no. 3 and 4 for each Amazon SNS topic available in the selected AWS region.

07 Change the AWS cloud region by updating the --region command parameter value and repeat the Audit process for other regions.

Remediation / Resolution

To update your Amazon SNS topic permissions in order to allow cross-account access from trusted entities only, perform the following actions:

Using AWS CloudFormation

01 CloudFormation template (JSON):

{
	"AWSTemplateFormatVersion": "2010-09-09",
	"Description": "Allow Cross-Account Access from Trusted AWS Accounts Only",
	"Parameters": {
		"SNSTopicName": {
			"Type": "String",
			"Description": "Topic Name",
			"Default": "cc-sns-topic"
		}
	},
	"Resources": {
		"AWSSNSTopic": {
			"Type": "AWS::SNS::Topic",
			"Properties": {
				"TopicName": {
					"Ref": "SNSTopicName"
				},
				"Subscription": [
					{
						"Endpoint": "user@domain.com",
						"Protocol": "email"
					}
				]
			}
		},
		"AWSSNSTopicPolicy": {
			"Type": "AWS::SNS::TopicPolicy",
			"Properties": {
				"PolicyDocument": {
					"Id": "SecureAccessPolicy",
					"Version": "2008-10-17",
					"Statement": [
						{
							"Effect": "Allow",
							"Principal": {
							"AWS": "arn:aws:iam::123412341234:root"
							},
							"Action": [
							"SNS:GetTopicAttributes",
							"SNS:SetTopicAttributes",
							"SNS:DeleteTopic",
							"SNS:Subscribe",
							"SNS:ListSubscriptionsByTopic",
							"SNS:Publish"    
							],
							"Resource": "arn:aws:sns:us-east-1:123456789012:cc-sns-topic"
						}
					]
				},
				"Topics": [
					{
						"Ref": "AWSSNSTopic"
					}
				]
			}
		}
	}
}

02 CloudFormation template (YAML):

AWSTemplateFormatVersion: '2010-09-09'
	Description: Allow Cross-Account Access from Trusted AWS Accounts Only
	Parameters:
		SNSTopicName:
		Type: String
		Description: Topic Name
		Default: cc-sns-topic
	Resources:
		AWSSNSTopic:
		Type: AWS::SNS::Topic
		Properties:
			TopicName: !Ref 'SNSTopicName'
			Subscription:
			- Endpoint: user@domain.com
				Protocol: email
		AWSSNSTopicPolicy:
		Type: AWS::SNS::TopicPolicy
		Properties:
			PolicyDocument:
			Id: SecureAccessPolicy
			Version: '2008-10-17'
			Statement:
				- Effect: Allow
				Principal:
					AWS: arn:aws:iam::123412341234:root
				Action:
					- SNS:GetTopicAttributes
					- SNS:SetTopicAttributes
					- SNS:DeleteTopic
					- SNS:Subscribe
					- SNS:ListSubscriptionsByTopic
					- SNS:Publish
				Resource: arn:aws:sns:us-east-1:123456789012:cc-sns-topic
			Topics:
			- !Ref 'AWSSNSTopic'

Using Terraform (AWS Provider)

01 Terraform configuration file (.tf):

terraform {
	required_providers {
		aws = {
			source  = "hashicorp/aws"
			version = "~> 4.0"
		}
		}

	required_version = ">= 0.14.9"
}

provider "aws" {
	region  = "us-east-1"
}

# Allow Cross-Account Access from Trusted AWS Accounts Only
resource "aws_sns_topic_policy" "cc-sns-topic-policy" {
	arn = aws_sns_topic.cc-sns-topic.arn
	policy = data.aws_iam_policy_document.sns-topic-policy-document.json
}

data "aws_iam_policy_document" "sns-topic-policy-document" {
	statement {
		actions = [
			"SNS:GetTopicAttributes",
			"SNS:SetTopicAttributes",
			"SNS:DeleteTopic",
			"SNS:Subscribe",
			"SNS:ListSubscriptionsByTopic",
			"SNS:Publish"
		]

		effect = "Allow"

		principals {
			type        = "AWS"
			identifiers = [
				"arn:aws:iam::123412341234:root"
			]
		}

		resources = [
			aws_sns_topic.cc-sns-topic.arn
		]
	}
}

resource "aws_sns_topic" "cc-sns-topic" {
	name = "cc-trail-sns-topic"
}

resource "aws_sns_topic_subscription" "cc-sns-topic-target" {
	topic_arn = aws_sns_topic.cc-sns-topic.arn
	protocol  = "email"
	endpoint  = "user@domain.com"
}

Using AWS Console

01 Sign in to the AWS Management Console.

02 Navigate to Amazon SNS console at https://console.aws.amazon.com/sns/v3.

03 In the main navigation panel, under Amazon SNS, choose Topics.

04 Click on the name (link) of the SNS topic that you want to reconfigure.

05 Choose Edit from the console top menu to access the topic configuration settings.

06 Select the Access policy – optional tab and within the JSON editor section replace the ARN of the unauthorized principal, available as value of the "Principal" element, with the ARN of the trusted principal (AWS account) defined in the conformity rule settings. Choose Save changes to apply the permission changes.

07 Repeat steps no. 4 – 6 for each Amazon SNS topic that you want to reconfigure, available within the current AWS region.

08 Change the AWS cloud region from the navigation bar and repeat the Remediation process for other AWS regions.

Using AWS CLI

01 Modify the access policy defined for your Amazon SNS topic and replace the unknown (untrusted) AWS identities with the trusted ones (as specified in the conformity rule settings), then save the policy document to a JSON file named cross-account-access-policy.json. The following example contains an SNS topic access policy that allows cross-account access to another (trusted) AWS account identified by the ARN "arn:aws:iam::123412341234:root" (highlighted):

{
	"Version": "2008-10-17",
	"Statement": [
		{
			"Effect": "Allow",
			"Principal": {
				"AWS": "arn:aws:iam::123412341234:root"
			},
			"Action": [
				"SNS:GetTopicAttributes",
				"SNS:SetTopicAttributes",
				"SNS:DeleteTopic",
				"SNS:Subscribe",
				"SNS:ListSubscriptionsByTopic",
				"SNS:Publish"
			],
			"Resource": "arn:aws:sns:us-east-1:123456789012:cc-prod-sns-topic"
		}
	]
}

02 Run set-topic-attributes command (OSX/Linux/UNIX) using the ARN of the Amazon SNS topic that you want to reconfigure as the identifier parameter to replace the existing access policy with the one modified at the previous step (i.e. cross-account-access-policy.json) in order to secure the cross-account access to the selected SNS topic (the command does not produce an output):

aws sns set-topic-attributes
  --region us-east-1
  --topic-arn arn:aws:sns:us-east-1:123456789012:cc-prod-sns-topic
  --attribute-name Policy
  --attribute-value file://cross-account-access-policy.json

03 Repeat steps no. 1 and 2 for each Amazon SNS topic that you want to reconfigure, available in the selected AWS region.

04 Change the AWS cloud region by updating the --region command parameter value and repeat steps no. 1 – 3 to perform the Remediation process for other regions.

References

AWS Command Line Interface (CLI) Documentation
sns
list-topics
get-topic-attributes
set-topic-attributes

CloudFormation Documentation
Amazon Simple Notification Service resource type reference

Terraform Documentation
AWS Provider

Publication date Dec 23, 2016

Audit

Using AWS Console

Using AWS CLI

Remediation / Resolution

Using AWS CloudFormation

Using Terraform (AWS Provider)

Using AWS Console

Using AWS CLI

References

Related SNS rules