SNS topic is publicly accessible

Ce produit n'est pas pris en charge par le site Datadog que vous avez sélectionné. ().
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Metadata

Id: terraform-aws-sns-topic-is-publicly-accessible

Provider: AWS

Platform: Terraform

Severity: Critical

Category: Access Control

Learn More

Description

This check verifies that Amazon SNS topic policies do not allow public access by having wildcard principals in their IAM policies. When an SNS topic policy includes a principal with wildcard (*) or allows anonymous access, it makes the topic publicly accessible to any AWS account, potentially exposing sensitive information or allowing unauthorized message publishing/consumption.

Secure configuration requires specifying explicit IAM principals rather than using wildcards. For example, instead of using "AWS": "*" which grants access to anyone, use a specific account ARN like "AWS": "arn:aws:iam::account_number:root" to limit access to authorized entities only. This prevents unauthorized access to your SNS topics and their messages.

Exception: statements that combine a wildcard principal with a Condition that genuinely scopes the caller — such as aws:SourceArn (restricting to a specific AWS resource like an S3 bucket), aws:SourceAccount, or aws:PrincipalOrgID — are not flagged, because the condition effectively limits who can invoke the action. Conditions that restrict how (e.g. aws:SecureTransport) or check key presence (e.g. Null) rather than binding the caller’s identity are not considered scoping and the statement is still flagged.

Compliant Code Examples

resource "aws_sns_topic" "negative1" {
policy = <<EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Action": "*",
"Principal": {
  "AWS": "arn:aws:iam::##account_number##:root"
},
"Effect": "Allow",
"Sid": ""
}
]
}
EOF
}

resource "aws_sns_topic_policy" "negative2" {
  arn = aws_sns_topic.example.arn

  policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowSpecificAccount",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:root"
      },
      "Action": "SNS:Publish",
      "Resource": "arn:aws:sns:us-east-1:123456789012:example"
    }
  ]
}
EOF
}

resource "aws_sns_topic" "cloudtrail" {
  name = "cloudtrail-events"

  policy = <<POLICY
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": "SNS:Publish",
      "Resource": "arn:aws:sns:us-east-1:013910733512:cloudtrail-events",
      "Condition": {
        "ArnLike": {
          "aws:SourceArn": "arn:aws:s3:::xuxu-cloudtrail-aggregation"
        }
      }
    }
  ]
}
POLICY
}

Non-Compliant Code Examples

resource "aws_sns_topic" "positive1" {
policy = <<EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Action": "*",
"Principal": {
  "AWS": "*"
},
"Effect": "Allow",
"Sid": ""
}
]
}
EOF
}

resource "aws_sns_topic_policy" "positive2" {
  arn = aws_sns_topic.example.arn

  policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowPublicAccess",
      "Effect": "Allow",
      "Principal": "*",
      "Action": "SNS:Publish",
      "Resource": "arn:aws:sns:us-east-1:123456789012:example"
    }
  ]
}
EOF
}

resource "aws_sns_topic" "multi" {
  name = "multi-statement-topic"

  policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowSpecific",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:root"
      },
      "Action": "SNS:Publish",
      "Resource": "arn:aws:sns:us-east-1:123456789012:multi-statement-topic"
    },
    {
      "Sid": "AllowAnyone",
      "Effect": "Allow",
      "Principal": "*",
      "Action": "SNS:Publish",
      "Resource": "arn:aws:sns:us-east-1:123456789012:multi-statement-topic"
    }
  ]
}
EOF
}