SNS topic is publicly accessible

Este producto no es compatible con el sitio Datadog seleccionado. ().
Esta página aún no está disponible en español. Estamos trabajando en su traducción.
Si tienes alguna pregunta o comentario sobre nuestro actual proyecto de traducción, no dudes en ponerte en contacto con nosotros.

Metadata

Id: cloudformation-aws-sns-topic-is-publicly-accessible

Provider: AWS

Platform: CloudFormation

Severity: Critical

Category: Access Control

Learn More

Description

SNS topic policies must not grant Allow permissions to all principals because that effectively makes the topic public. This can allow unauthenticated users or arbitrary AWS accounts to publish to or subscribe from the topic, risking data exposure, spam, and abuse.

Check AWS::SNS::TopicPolicy resources’ Properties.PolicyDocument.Statement entries. Any statement with Effect: "Allow" and Principal: "*", or Principal.AWS: "*", will be flagged unless it includes a Condition that genuinely scopes the caller — such as aws:SourceArn (restricting to a specific AWS resource like an S3 bucket triggering an event notification), aws:SourceAccount, or aws:PrincipalOrgID. Conditions that only restrict how a call is made (e.g. aws:SecureTransport) or check key presence (e.g. Null) are not considered scoping.

To remediate, require explicit principals such as AWS account ARNs or service principals, or use scoped conditions for cross-account access rather than wildcard principals. Statements that list wildcard principals, or omit principal restrictions, should be corrected.

Secure configuration example (CloudFormation YAML):

MyTopicPolicy:
  Type: AWS::SNS::TopicPolicy
  Properties:
    Topics:
      - !Ref MyTopic
    PolicyDocument:
      Version: '2012-10-17'
      Statement:
        - Effect: Allow
          Principal:
            AWS: arn:aws:iam::123456789012:root
          Action:
            - sns:Publish
          Resource: !Ref MyTopic

Compliant Code Examples

AWSTemplateFormatVersion: '2010-09-09'
Description: ''
Resources:
  snsPolicy:
      Type: AWS::SNS::TopicPolicy
      Properties:
        PolicyDocument:
          Statement: [
            {
              "Sid": "MyTopicPolicy",
              "Effect": "Allow",
              "Principal": "otherPrincipal",
              "Action": ["sns:Publish"],
              "Resource": "arn:aws:sns:MyTopic"
            }]

AWSTemplateFormatVersion: '2010-09-09'
Description: 'SNS topic policy that allows S3 to publish events; the wildcard principal is scoped down by aws:SourceArn.'
Resources:
  snsPolicy:
      Type: AWS::SNS::TopicPolicy
      Properties:
        PolicyDocument:
          Statement: [
            {
              "Sid": "AllowS3Publish",
              "Effect": "Allow",
              "Principal": "*",
              "Action": ["sns:Publish"],
              "Resource": "arn:aws:sns:us-east-1:013910733512:cloudtrail-events",
              "Condition": {
                "ArnLike": {
                  "aws:SourceArn": "arn:aws:s3:::xuxu-cloudtrail-aggregation"
                }
              }
            }]

Non-Compliant Code Examples

AWSTemplateFormatVersion: '2010-09-09'
Description: ''
Resources:
  snsPolicy:
      Type: AWS::SNS::TopicPolicy
      Properties:
        PolicyDocument:
          Statement: [
            {
              "Sid": "MyTopicPolicy",
              "Effect": "Allow",
              "Principal": "*",
              "Action": ["sns:Publish"],
              "Resource": "arn:aws:sns:MyTopic"
            }]

AWSTemplateFormatVersion: '2010-09-09'
Description: 'SNS topic policies whose Condition does not restrict the wildcard principal — all three should be flagged.'
Resources:
  snsPolicySecureTransport:
    Type: AWS::SNS::TopicPolicy
    Properties:
      PolicyDocument:
        Statement:
          - Sid: "SecureTransportOnly"
            Effect: Allow
            Principal: "*"
            Action: sns:Publish
            Resource: "arn:aws:sns:us-east-1:123456789012:my-topic"
            Condition:
              Bool:
                aws:SecureTransport: "true"
  snsPolicyNegating:
    Type: AWS::SNS::TopicPolicy
    Properties:
      PolicyDocument:
        Statement:
          - Sid: "NegatingCondition"
            Effect: Allow
            Principal: "*"
            Action: sns:Publish
            Resource: "arn:aws:sns:us-east-1:123456789012:my-topic"
            Condition:
              StringNotEquals:
                aws:SourceAccount: "123456789012"
  snsPolicyWildcardArn:
    Type: AWS::SNS::TopicPolicy
    Properties:
      PolicyDocument:
        Statement:
          - Sid: "WildcardSourceArn"
            Effect: Allow
            Principal: "*"
            Action: sns:Publish
            Resource: "arn:aws:sns:us-east-1:123456789012:my-topic"
            Condition:
              ArnLike:
                aws:SourceArn: "*"