SNS Topic Accessible For Publishing

01 Sign in to the AWS Management Console.

02 Navigate to Amazon SNS console at https://console.aws.amazon.com/sns/v2/.

03 In the main navigation panel, under Amazon SNS, choose Topics.

04 Click on the name (link) of the SNS topic that you want to examine.

05 Select the Access policy tab from the console bottom panel to access the permissions configured for the selected topic.

06 Check the policy document listed in the Access policy section for statements with the following combination of elements: "Effect" set to "Allow", "Principal" set to "*" or {"AWS": "*"}, "Action" set to "SNS:Publish". If one or more policy statements contain the specified combination of elements, and the policy is not using "Condition" clauses to filter the access, as shown in the policy example listed below, the selected Amazon Simple Notification Service (SNS) topic is publicly accessible for publishing:

{
	"Version": "2008-10-17",
	"Statement": [
		{
			"Effect": "Allow",
			"Principal": {
				"AWS": "*"
			},
			"Action": "SNS:Publish",
			"Resource": "arn:aws:sns:us-east-1:123456789012:cc-prod-sns-topic"
		}
	]
}

07 Repeat steps no. 4 – 6 for each Amazon SNS topic available within the current AWS region.

08 Change the AWS cloud region from the console navigation bar and repeat the Audit process for other regions.

01 Run list-topics command (OSX/Linux/UNIX) to list the Amazon Resource Name (ARN) of each Amazon SNS topic available in the selected AWS cloud region:

aws sns list-topics
  --region us-east-1
  --output table
  --query 'Topics[]'

02 The command output should return a table with the requested SNS topic ARNs:

-----------------------------------------------------------
|                       ListTopics                        |
+---------------------------------------------------------+
|                        TopicArn                         |
+---------------------------------------------------------+
|  arn:aws:sns:us-east-1:123456789012:cc-prod-sns-topic   |
|  arn:aws:sns:us-east-1:123456789012:cc-trail-sns-topic  |
|  arn:aws:sns:us-east-1:123456789012:cc-cloud-sns-topic  |
+---------------------------------------------------------+

03 Run get-topic-attributes command (OSX/Linux/UNIX) using the ARN of the Amazon SNS topic that you want to examine as the identifier parameter to describe the access policy configured for the selected SNS topic:

aws sns get-topic-attributes
  --region us-east-1
  --topic-arn arn:aws:sns:us-east-1:123456789012:cc-prod-sns-topic
  --query 'Attributes.Policy'

04 The command output should return the topic policy document in JSON format:

"{
	"Version": "2008-10-17",
	"Statement": [
	{
		"Effect": "Allow",
		"Principal": {
		"AWS": "*"
		},
		"Action": "SNS:Publish",
		"Resource": "arn:aws:sns:us-east-1:123456789012:cc-prod-sns-topic"
	}
	]
}"

05 Repeat steps no. 3 and 4 for each Amazon SNS topic available in the selected AWS region.

06 Change the AWS cloud region by updating the --region command parameter value and repeat steps no. 1 – 5 to perform the Audit process for other regions.

01 CloudFormation template (JSON):

{
	"AWSTemplateFormatVersion": "2010-09-09",
	"Description": "Restrict Anonymous Publishing for SNS Topics (Allow Access from Trusted IAM Users Only)",
	"Parameters": {
		"SNSTopicName": {
			"Type": "String",
			"Description": "Topic Name",
			"Default": "cc-sns-topic"
		}
	},
	"Resources": {
		"AWSSNSTopic": {
			"Type": "AWS::SNS::Topic",
			"Properties": {
				"TopicName": {
					"Ref": "SNSTopicName"
				},
				"Subscription": [
					{
						"Endpoint": "user@domain.com",
						"Protocol": "email"
					}
				]
			}
		},
		"AWSSNSTopicPolicy": {
			"Type": "AWS::SNS::TopicPolicy",
			"Properties": {
				"PolicyDocument": {
					"Id": "SecureAccessPolicy",
					"Version": "2008-10-17",
					"Statement": [
						{
							"Effect": "Allow",
							"Principal": {
							"AWS": "arn:aws:iam::123456789012:user/sns_publisher"
							},
							"Action": [
							"SNS:Publish"    
							],
							"Resource": "arn:aws:sns:us-east-1:123456789012:cc-sns-topic"
						}
					]
				},
				"Topics": [
					{
						"Ref": "AWSSNSTopic"
					}
				]
			}
		}
	}
}

02 CloudFormation template (YAML):

AWSTemplateFormatVersion: '2010-09-09'
	Description: Restrict Anonymous Publishing for SNS Topics (Allow Access from Trusted
		IAM Users Only)
	Parameters:
		SNSTopicName:
		Type: String
		Description: Topic Name
		Default: cc-sns-topic
	Resources:
		AWSSNSTopic:
		Type: AWS::SNS::Topic
		Properties:
			TopicName: !Ref 'SNSTopicName'
			Subscription:
			- Endpoint: user@domain.com
				Protocol: email
		AWSSNSTopicPolicy:
		Type: AWS::SNS::TopicPolicy
		Properties:
			PolicyDocument:
			Id: SecureAccessPolicy
			Version: '2008-10-17'
			Statement:
				- Effect: Allow
				Principal:
					AWS: arn:aws:iam::123456789012:user/sns_publisher
				Action:
					- SNS:Publish
				Resource: arn:aws:sns:us-east-1:123456789012:cc-sns-topic
			Topics:
			- !Ref 'AWSSNSTopic'

01 Terraform configuration file (.tf):

terraform {
	required_providers {
		aws = {
			source  = "hashicorp/aws"
			version = "~> 4.0"
		}
	}

	required_version = ">= 0.14.9"
}

provider "aws" {
	region  = "us-east-1"
}

# Restrict Anonymous Publishing for SNS Topics (Allow Access from Trusted IAM Users Only)
resource "aws_sns_topic_policy" "cc-sns-topic-policy" {
	arn = aws_sns_topic.cc-sns-topic.arn
	policy = data.aws_iam_policy_document.sns-topic-policy-document.json
}

data "aws_iam_policy_document" "sns-topic-policy-document" {
	statement {
		actions = [
			"SNS:Publish"
		]

		effect = "Allow"

		principals {
			type        = "AWS"
			identifiers = [
				"arn:aws:iam::123456789012:user/sns_publisher"
			]
		}

		resources = [
			aws_sns_topic.cc-sns-topic.arn
		]
	}
}

resource "aws_sns_topic" "cc-sns-topic" {
	name = "cc-trail-sns-topic"
}

resource "aws_sns_topic_subscription" "cc-sns-topic-target" {
	topic_arn = aws_sns_topic.cc-sns-topic.arn
	protocol  = "email"
	endpoint  = "user@domain.com"
}

01 Sign in to the AWS Management Console.

02 Navigate to Amazon SNS console at https://console.aws.amazon.com/sns/v3.

03 In the main navigation panel, under Amazon SNS, choose Topics.

04 Click on the name (link) of the SNS topic that you want to reconfigure.

05 Choose Edit from the console top menu to access the topic configuration settings.

06 Select the Access policy – optional tab and within the JSON editor section perform one of the following actions based on your requirements:

1. To limit SNS publishing to a specific AWS account or IAM user, replace the "Principal" element value with the Amazon Resource Name (ARN) of the trusted AWS account, i.e. { "AWS": "arn:aws:iam::<aws-account-id>:root" } or the IAM user, i.e. { "AWS": "arn:aws:iam::<aws-account-id>:user/<user-name>" } that should have access to the selected Amazon SNS topic. Choose Save changes to apply the permission changes.
2. To limit the publishing to a specific AWS service, replace the "Principal" element value with the name of the AWS cloud service that is allowed to publish messages to the selected SNS topic, e.g. { "Service": "s3.amazonaws.com" }. Choose Save changes to apply the permission changes.
3. To limit SNS publishing to the topic owner only, add a "Condition" clause to the policy statement, i.e. "Condition": { "StringEquals": { "AWS:SourceOwner": "<aws-account-id>"} }, where <aws-account-id> is the AWS account ID of the SNS topic owner. Choose Save changes to apply the permission changes.

07 Repeat steps no. 4 – 6 for each Amazon SNS topic that you want to reconfigure, available within the current AWS region.

08 Change the AWS cloud region from the navigation bar and repeat the Remediation process for other AWS regions.

01 Modify the access policy associated with your Amazon SNS topic and replace the "Principal" element value (i.e. "*") with the ARN of the trusted AWS account, i.e. { "AWS": "arn:aws:iam::<aws-account-id>:root" }, the trusted IAM user, i.e. { "AWS": "arn:aws:iam::<aws-account-id>:user/<user-name>" }, or the AWS service, e.g. { "Service": "s3.amazonaws.com" }, that should have permission to publish messages to the selected SNS topic. Save the policy document to a JSON file named sns-publishing-access-policy.json. You can also add a "Condition" clause to the policy statement in order to limit the SNS publishing to the topic owner only. As an example, the following policy allows publishing access to an IAM user identified by the ARN "arn:aws:iam::123456789012:user/sns_publisher" (highlighted):

{
	"Version": "2008-10-17",
	"Statement": [
		{
			"Effect": "Allow",
			"Principal": {
				"AWS": "arn:aws:iam::123456789012:user/sns_publisher"
			},
			"Action": "SNS:Publish",
			"Resource": "arn:aws:sns:us-east-1:123456789012:cc-prod-sns-topic"
		}
	]
}

02 Run set-topic-attributes command (OSX/Linux/UNIX) using the ARN of the Amazon SNS topic that you want to reconfigure as the identifier parameter to replace the existing access policy with the one modified at the previous step (i.e. sns-publishing-access-policy.json) in order to secure the publishing access to the selected topic (the command does not produce an output):

aws sns set-topic-attributes
  --region us-east-1
  --topic-arn arn:aws:sns:us-east-1:123456789012:cc-prod-sns-topic
  --attribute-name Policy
  --attribute-value file://sns-trusted-access-policy.json

03 Repeat steps no. 1 and 2 for each Amazon SNS topic that you want to reconfigure, available in the selected AWS region.

04 Change the AWS cloud region by updating the --region command parameter value and repeat steps no. 1 – 3 to perform the Remediation process for other regions.