<  Back to rules search

SNS Topic has restrictions set for subscription

sns

Classification:

compliance

このページは日本語には対応しておりません。随時翻訳に取り組んでいます。翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。

Description

Update your Amazon Simple Notification Service (SNS) topic subscription permissions.

Rationale

Anonymous users can subscribe and receive messages that you publish, leaving the security of your application or service at risk.

Remediation

Console

Follow the Preventative best practices docs to learn how to implement least-privilege access or use IAM roles for your applications and AWS services.

CLI

  1. Update your access control policy with the IAM user ARN. Configure action to SNS:Publish and include your AWS IAM ARN. Save the file.

    access-control-policy-sub.sh

        {
          ...
          "Statement": [
            ...
            {
              "Sid": "console_sub",
              "Effect": "Allow",
              "Principal": {
                "AWS": "arn:aws:iam::123456789012:root"
              },
              "Action": [
                "SNS:Subscribe",
                "SNS:Receive"
              ],
              ...
            }
          ]
        }
        
  2. Run set-topic-attributes with the ARN of the SNS topic.

    set-topic-attributes.sh

        aws sns set-topic-attributes
        --topic-arn arn:aws:sns:region:123456789012:YourTopic
        --attribute-name DisplayName
        --attribute-value YourTopicDisplayName