SNS Topic Accessible For Subscription

01 Sign in to the AWS Management Console.

02 Navigate to Amazon SNS console at https://console.aws.amazon.com/sns/v3

03 In the main navigation panel, under Amazon SNS, choose Topics.

04 Click on the name (link) of the SNS topic that you want to examine.

05 Select the Access policy tab from the console bottom panel to access the permissions configured for the selected topic.

06 Check the policy document listed in the Access policy section for statements with the following combination of elements: "Effect" set to "Allow", "Principal" set to "*" or {"AWS": "*"}, and "Action" set to "SNS:Subscribe" and "SNS:Receive". If one or more policy statements contain the specified combination of elements, and the policy is not using "Condition" clauses to filter the access, as shown in the policy example listed below, the selected Amazon Simple Notification Service (SNS) topic is publicly accessible for subscription:

{
	"Version": "2008-10-17",
	"Statement": [
		{
			"Effect": "Allow",
			"Principal": {
				"AWS": "*"
			},
			"Action": [
				"SNS:ListSubscriptionsByTopic",
				"SNS:Subscribe",
				"SNS:Receive"
			],
			"Resource": "arn:aws:sns:us-east-1:123456789012:cc-trail-sns-topic"
		}
	]
}

07 Repeat steps no. 4 – 6 for each Amazon SNS topic available within the current AWS region.

08 Change the AWS cloud region from the console navigation bar and repeat the Audit process for other regions.

01 Run list-topics command (OSX/Linux/UNIX) to list the Amazon Resource Name (ARN) of each Amazon SNS topic available in the selected AWS cloud region:

aws sns list-topics
  --region us-east-1
  --output table
  --query 'Topics[]'

02 The command output should return a table with the requested SNS topic ARNs:

-----------------------------------------------------------
|                       ListTopics                        |
+---------------------------------------------------------+
|                        TopicArn                         |
+---------------------------------------------------------+
|  arn:aws:sns:us-east-1:123456789012:cc-trail-sns-topic  |
|  arn:aws:sns:us-east-1:123456789012:cc-prod-sns-topic   |
+---------------------------------------------------------+

03 Run get-topic-attributes command (OSX/Linux/UNIX) using the ARN of the Amazon SNS topic that you want to examine as the identifier parameter to describe the access policy configured for the selected SNS topic:

aws sns get-topic-attributes
  --region us-east-1
  --topic-arn arn:aws:sns:us-east-1:123456789012:cc-trail-sns-topic
  --query 'Attributes.Policy'

04 The command output should return the topic policy document in JSON format:

"{
  "Version": "2008-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": [
        "SNS:ListSubscriptionsByTopic",
        "SNS:Subscribe",
        "SNS:Receive"
        ],
      "Resource": "arn:aws:sns:us-east-1:123456789012:cc-trail-sns-topic"
    }
  ]
}"

05 Repeat steps no. 3 and 4 for each Amazon SNS topic available in the selected AWS region.

06 Change the AWS cloud region by updating the --region command parameter value and repeat steps no. 1 – 5 to perform the Audit process for other regions.

01 CloudFormation template (JSON):

{
	"AWSTemplateFormatVersion": "2010-09-09",
	"Description": "Restrict Anonymous Subscriptions for SNS Topics (Allow Access from Trusted IAM Users Only)",
	"Parameters": {
		"SNSTopicName": {
			"Type": "String",
			"Description": "Topic Name",
			"Default": "cc-sns-topic"
		}
	},
	"Resources": {
		"AWSSNSTopic": {
			"Type": "AWS::SNS::Topic",
			"Properties": {
				"TopicName": {
					"Ref": "SNSTopicName"
				},
				"Subscription": [
					{
						"Endpoint": "user@domain.com",
						"Protocol": "email"
					}
				]
			}
		},
		"AWSSNSTopicPolicy": {
			"Type": "AWS::SNS::TopicPolicy",
			"Properties": {
				"PolicyDocument": {
					"Id": "SecureAccessPolicy",
					"Version": "2008-10-17",
					"Statement": [
						{
							"Effect": "Allow",
							"Principal": {
							"AWS": "arn:aws:iam::123456789012:user/sns_subscriber"
							},
							"Action": [
							"SNS:ListSubscriptionsByTopic",
							"SNS:Subscribe",
							"SNS:Receive"
							],
							"Resource": "arn:aws:sns:us-east-1:123456789012:cc-sns-topic"
						}
					]
				},
				"Topics": [
					{
						"Ref": "AWSSNSTopic"
					}
				]
			}
		}
	}
}

02 CloudFormation template (YAML):

AWSTemplateFormatVersion: '2010-09-09'
	Description: Restrict Anonymous Subscriptions for SNS Topics (Allow Access from Trusted
		IAM Users Only)
	Parameters:
		SNSTopicName:
		Type: String
		Description: Topic Name
		Default: cc-sns-topic
	Resources:
		AWSSNSTopic:
		Type: AWS::SNS::Topic
		Properties:
			TopicName: !Ref 'SNSTopicName'
			Subscription:
			- Endpoint: user@domain.com
				Protocol: email
		AWSSNSTopicPolicy:
		Type: AWS::SNS::TopicPolicy
		Properties:
			PolicyDocument:
			Id: SecureAccessPolicy
			Version: '2008-10-17'
			Statement:
				- Effect: Allow
				Principal:
					AWS: arn:aws:iam::123456789012:user/sns_subscriber
				Action:
					- SNS:ListSubscriptionsByTopic
					- SNS:Subscribe
					- SNS:Receive
				Resource: arn:aws:sns:us-east-1:123456789012:cc-sns-topic
			Topics:
			- !Ref 'AWSSNSTopic'

01 Terraform configuration file (.tf):

terraform {
	required_providers {
		aws = {
			source  = "hashicorp/aws"
			version = "~> 4.0"
		}
	}

	required_version = ">= 0.14.9"
}

provider "aws" {
	region  = "us-east-1"
}

# Restrict Anonymous Subscriptions for SNS Topics (Allow Access from Trusted IAM Users Only)
resource "aws_sns_topic_policy" "cc-sns-topic-policy" {
	arn = aws_sns_topic.cc-sns-topic.arn
	policy = data.aws_iam_policy_document.sns-topic-policy-document.json
}

data "aws_iam_policy_document" "sns-topic-policy-document" {
	statement {
		actions = [
			"SNS:ListSubscriptionsByTopic",
			"SNS:Subscribe",
			"SNS:Receive"
		]

		effect = "Allow"

		principals {
			type        = "AWS"
			identifiers = [
				"arn:aws:iam::123456789012:user/sns_subscriber"
			]
		}

		resources = [
			aws_sns_topic.cc-sns-topic.arn
		]
	}
}

resource "aws_sns_topic" "cc-sns-topic" {
	name = "cc-trail-sns-topic"
}

resource "aws_sns_topic_subscription" "cc-sns-topic-target" {
	topic_arn = aws_sns_topic.cc-sns-topic.arn
	protocol  = "email"
	endpoint  = "user@domain.com"
}

01 Sign in to the AWS Management Console.

02 Navigate to Amazon SNS console at https://console.aws.amazon.com/sns/v3.

03 In the main navigation panel, under Amazon SNS, choose Topics.

04 Click on the name (link) of the SNS topic that you want to reconfigure.

05 Choose Edit from the console top menu to access the topic configuration settings.

06 Select the Access policy – optional tab and within the JSON editor section perform one of the following actions based on your requirements:

1. To allow a specific AWS account or IAM user to subscribe, replace the "Principal" element value with the Amazon Resource Name (ARN) of the trusted AWS account, i.e. { "AWS": "arn:aws:iam::<aws-account-id>:root" } or the IAM user, i.e. { "AWS": "arn:aws:iam::<aws-account-id>:user/<user-name>" } that should have access to the selected Amazon SNS topic. Choose Save changes to apply the permission changes.
2. To grant subscription access to users with endpoints that match specific endpoints and/or delivery protocols, add a "Condition" clause that defines the allowed endpoints and/or protocols, e.g. "Condition": { "StringLike": { "SNS:Endpoint": "user@domain.com" }, "StringEquals": { "sns:Protocol": "email" } }. Choose Save changes to apply the permission changes.
3. To grant the topic owner the permission to subscribe, add a "Condition" clause to the policy statement, i.e. "Condition": { "StringEquals": { "AWS:SourceOwner": "<aws-account-id>"} }, where <aws-account-id> is the AWS account ID of the SNS topic owner. Choose Save changes to apply the permission changes.

07 Repeat steps no. 4 – 6 for each Amazon SNS topic that you want to reconfigure, available within the current AWS region.

08 Change the AWS cloud region from the navigation bar and repeat the Remediation process for other AWS regions.

01 Modify the access policy associated with your Amazon SNS topic and replace the "Principal" element value (i.e. "*") with the ARN of the trusted AWS account, i.e. { "AWS": "arn:aws:iam::<aws-account-id>:root" } or the trusted IAM user, i.e. { "AWS": "arn:aws:iam::<aws-account-id>:user/<user-name>" }, that should have permission to subscribe to the selected SNS topic. Save the policy document to a JSON file named sns-subscription-access-policy.json. You can also add a "Condition" clause to the policy statement in order to limit the subscription access to users with endpoints that match specific endpoints and/or delivery protocols or to limit the access to the topic owner only. As an example, the following policy allows a trusted IAM user, identified by the ARN "arn:aws:iam::123456789012:user/sns_subscriber", to subscribe to the selected SNS topic:

{
	"Version": "2008-10-17",
	"Statement": [
	{
		"Effect": "Allow",
		"Principal": {
			"AWS": "arn:aws:iam::123456789012:user/sns_subscriber"
		},
		"Action": [
			"SNS:ListSubscriptionsByTopic",
			"SNS:Subscribe",
			"SNS:Receive"
		],
		"Resource": "arn:aws:sns:us-east-1:123456789012:cc-trail-sns-topic"
	}
	]
}

02 Run set-topic-attributes command (OSX/Linux/UNIX) using the ARN of the Amazon SNS topic that you want to reconfigure as the identifier parameter to replace the existing access policy with the one modified at the previous step (i.e. sns-subscription-access-policy.json) in order to secure the subscription access to the selected topic (the command does not produce an output):

aws sns set-topic-attributes
  --region us-east-1
  --topic-arn arn:aws:sns:us-east-1:123456789012:cc-trail-sns-topic
  --attribute-name Policy
  --attribute-value file://sns-subscription-access-policy.json

03 Repeat steps no. 1 and 2 for each Amazon SNS topic that you want to reconfigure, available in the selected AWS region.

04 Change the AWS cloud region by updating the --region command parameter value and repeat steps no. 1 – 3 to perform the Remediation process for other regions.