This check verifies that Amazon SNS topic policies do not allow public access by having wildcard principals in their IAM policies. When an SNS topic policy includes a principal with wildcard (*) or allows anonymous access, it makes the topic publicly accessible to any AWS account, potentially exposing sensitive information or allowing unauthorized message publishing/consumption.
Secure configuration requires specifying explicit IAM principals rather than using wildcards. For example, instead of using "AWS": "*" which grants access to anyone, use a specific account ARN like "AWS": "arn:aws:iam::account_number:root" to limit access to authorized entities only. This prevents unauthorized access to your SNS topics and their messages.
Exception: statements that combine a wildcard principal with a Condition that genuinely scopes the caller — such as aws:SourceArn (restricting to a specific AWS resource like an S3 bucket), aws:SourceAccount, or aws:PrincipalOrgID — are not flagged, because the condition effectively limits who can invoke the action. Conditions that restrict how (e.g. aws:SecureTransport) or check key presence (e.g. Null) rather than binding the caller’s identity are not considered scoping and the statement is still flagged.
