<  Back to rules search

SNS Topic has restrictions set for publishing

sns
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Description

Update your Amazon Simple Notification Service (SNS) topic publishing permissions.

Rationale

Setting the topic publishing permission to Everyone gives anyone access to publish on a topic. Unauthenticated users can publish malicious messages.

Remediation

From the console

Follow the Preventative best practices docs to learn how to implement least-privilege access or use IAM roles for your applications and AWS services.

From the command line

  1. Update your access control policy with the IAM user ARN. Configure action to SNS:Publish and include your AWS IAM ARN. Save the file.

    access-control-policy-pub.json

        {
          ...
          "Statement": [
            ...
            {
              "Sid": "console_pub",
              "Effect": "Allow",
              "Principal": {
                "AWS": "arn:aws:iam::123456789012:root"
              },
              "Action": [
                "SNS:Publish"
              ],
              ...
            }
          ]
        }
        
  2. Run set-topic-attributes with the ARN of the SNS topic.

    set-topic-attributes.sh

        aws sns set-topic-attributes
          --topic-arn arn:aws:sns:region:123456789012:YourTopic
          --attribute-name DisplayName
          --attribute-value YourTopicDisplayName