SNS Topic should have restrictions set for publishing

sns
이 페이지는 아직 한국어로 제공되지 않으며 번역 작업 중입니다. 번역에 관한 질문이나 의견이 있으시면 언제든지 저희에게 연락해 주십시오.

Description

Update your Amazon Simple Notification Service (SNS) topic publishing permissions.

Rationale

A resource-based policy attached to an SNS topic with a Principal of * and an Action of sns:Publish allows anyone to publish to a topic. Unauthenticated users can publish arbitrary messages, potentially leading to an impact for downstream applications.

Remediation

From the console

Follow the Preventative best practices docs to learn how to implement least-privilege access or use IAM roles for your applications and AWS services.

From the command line

  1. Update your access control policy with an appropriate Principal ARN. Save the file as policy.json.
{
  ...
  "Statement": [
    ...
    {
      "Sid": "console_pub",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:root"
      },
      "Action": [
        "SNS:Publish"
      ],
      ...
    }
  ]
}
  1. Run set-topic-attributes with the ARN of the SNS topic.
aws sns set-topic-attributes
  --topic-arn arn:aws:sns:region:123456789012:YourTopic
  --attribute-name Policy
  --attribute-value file://policy.json