SNS Topic Exposed

01 Sign in to the AWS Management Console.

02 Navigate to SNS dashboard at https://console.aws.amazon.com/sns/v2/.

03 In the left navigation panel, select Topics.

04 Select the SNS topic that you want to examine.

05 Click the Actions button from the dashboard top menu and select Edit topic policy:

06 In the Edit topic policy dialog box, perform the following:

1. Select the Basic View tab to examine the topic policy implemented with the basic editor. If the user (grantee) allowed to publish messages to the topic and/or the user allowed to subscribe to the topic is set to “Everyone”: , the selected topic is exposed to unauthorized access.
2. Select the Advanced View tab to examine the topic policy document implemented with the advanced editor. If the custom policy document contains Principal elements that do not promote any specific users: e.g. “Principal”: {“AWS”: “*”} and these elements are not using Condition clauses to filter the user access: e.g. , the selected topic is exposed to unauthorized access.

07 Repeat step no. 4 – 6 for each SNS topic available in the current AWS region. Change the AWS region from the navigation bar to repeat the process for the other regions.

01 Run list-topics command (OSX/Linux/UNIX) to retrieve the list with all the SNS topics available in the selected region and their ARNs (Amazon Resource Name):

aws sns list-topics
	--region us-east-1

02 The command output should return each SNS topic ARN:

{
    "Topics": [
        {
            "TopicArn": "arn:aws:sns:us-east-1:123456789012:MobileSNSTopic"
        },
        {
            "TopicArn": "arn:aws:sns:us-east-1:123456789012:MySNSTopic"
        }
    ]
}

03 Run get-topic-attributes command (OSX/Linux/UNIX) to return the selected SNS topic policy using its ARN for identification:

aws sns get-topic-attributes
	--topic-arn "arn:aws:sns:us-east-1:123456789012:MobileSNSTopic"
	--region us-east-1
	--query 'Attributes.Policy'

04 The command output should return the topic policy document:

{
  "Version": "2008-10-17",
  "Id": "mobile_custom_policy_ID",
  "Statement": [
    {
      "Sid": "mobile_custom_statement_ID",
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": [
        "SNS:ListSubscriptionsByTopic",
        "SNS:Subscribe",
        "SNS:DeleteTopic",
        "SNS:GetTopicAttributes",
        "SNS:Publish",
        "SNS:RemovePermission",
        "SNS:AddPermission",
        "SNS:Receive",
        "SNS:SetTopicAttributes"
      ],
      "Resource": "arn:aws:sns:us-east-1:123456789012:MobileSNSTopic",
    },
    {
      "Sid": "__console_pub_0",
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": "SNS:Publish",
      "Resource": "arn:aws:sns:us-east-1:123456789012:MobileSNSTopic"
    },
    {
      "Sid": "__console_sub_0",
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": [
        "SNS:Subscribe",
        "SNS:Receive"
      ],
      "Resource": "arn:aws:sns:us-east-1:123456789012:MobileSNSTopic"
    }
  ]
}

01 Sign in to the AWS Management Console.

02 Navigate to SNS dashboard at https://console.aws.amazon.com/sns/v2/.

03 Select the S3 bucket that you want to examine and click the Properties tab from the S3 dashboard top right menu:

04 In the left navigation panel, select Topics.

05 Select the SNS topic that you want to update.

06 In the Edit topic policy dialog box, perform the following:

1. Select the Basic View tab to update the topic policy with the basic editor:
   • Select Only me (topic owner) to limit publishing messages or subscribing requests to the topic owner only.
   • Select Only these AWS users and enter valid AWS account IDs to limit publishing messages or subscribing requests to those specified AWS accounts only.
   • Select Only users with endpoints that match and enter valid endpoints (email address, application URL, etc) to limit subscribing only to the specified endpoints.
   • Under Using these delivery protocols section select any protocols required for subscription requests or notifications.
2. Select the Advanced View tab and paste your custom policy document to update the topic permissions based on your requirements. Make sure you use Principal elements together with Condition clauses: to filter user access based on your needs. You can also create custom SNS policies with the AWS Policy Generator: https://awspolicygen.s3.amazonaws.com/policygen.html

07 Click Update policy to apply the new permissions.

08 Repeat step no. 4 – 7 for each SNS topic available in the current AWS region. Change the AWS region from the navigation bar to repeat the process for the other regions.

01 Run list-topics command (OSX/Linux/UNIX) to retrieve the list with all the SNS topics available in the selected region and their ARNs:

aws sns list-topics
	--region us-east-1

02 The command output should return each SNS topic ARN:

{
    "Topics": [
        {
            "TopicArn": "arn:aws:sns:us-east-1:123456789012:MobileSNSTopic"
        },
        {
            "TopicArn": "arn:aws:sns:us-east-1:123456789012:MySNSTopic"
        }
    ]
}

03 Run get-topic-attributes command (OSX/Linux/UNIX) to return the selected SNS topic policy for examining it, in order to implement any updates:

aws sns set-topic-attributes
	--topic-arn "arn:aws:sns:us-east-1:123456789012:MobileSNSTopic"
	--region us-east-1
	--attribute-name Policy

04 The command output should return the topic policy document:

{
  "Version": "2008-10-17",
  "Id": "mobile_custom_policy_ID",
  "Statement": [
    {
      "Sid": "mobile_statement_01",
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": [
        "SNS:ListSubscriptionsByTopic",
        "SNS:Subscribe",
        "SNS:DeleteTopic",
        "SNS:Publish",
        "SNS:RemovePermission",
        "SNS:AddPermission",
        "SNS:Receive",
      ],
      "Resource": "arn:aws:sns:us-east-1:123456789012:MobileSNSTopic",
      "Condition": {
        "StringEquals": {
          "AWS:SourceOwner": "123456789012"
        }
      }
    },
    {
      "Sid": "mobile_statement_02",
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": "SNS:Publish",
      "Resource": "arn:aws:sns:us-east-1:123456789012:MobileSNSTopic"
    },
    {
      "Sid": "mobile_statement_03",
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": [
        "SNS:Subscribe",
        "SNS:Receive"
      ],
      "Resource": "arn:aws:sns:us-east-1:123456789012:MobileSNSTopic"
    }
  ]
}

05 Run remove-permission command (OSX/Linux/UNIX) to remove a certain statement from the selected SNS topic policy. The following example removes the policy statement labeled mobile_statement_02 from the SNS topic with the ARN arn:aws:sns:us-east-1:123456789012:MobileSNSTopic (the command does not return any output):

aws sns remove-permission
	--region us-east-1
	--topic-arn arn:aws:sns:us-east-1:123456789012:MobileSNSTopic
	--label mobile_statement_02

06 add-permission command (OSX/Linux/UNIX) to add a new valid statement to the selected topic policy. The following example add a policy statement labeled mobile_statement_02-1 that grants permission to the user with the ID 123456789012 to publish messages to the SNS topic with the ARN arn:aws:sns:us-east-1:123456789012:MobileSNSTopic (the command does not return any output):

aws sns add-permission
	--region us-east-1
	--topic-arn arn:aws:sns:us-east-1:123456789012:MobileSNSTopic
	--label mobile_statement_02-1
	--action-name publish
	--aws-account-id 123456789012