MEDIUM
Source
CloudSploit
ID
sns-topic-policies

SNS Topic Policies

Ensures SNS topics do not allow global send or subscribe.

SNS policies should not be configured to allow any AWS user to subscribe or send messages. This could result in data leakage or financial DDoS.

Follow the appropriate remediation steps below to resolve the issue.

  1. Log in to the AWS Management Console.

  2. Select the “Services” option and search for SNS. Step

  3. In the left navigation panel, select Topics under SNS Dashboard. Step

  4. Select the Topic by clicking on the ID.Step

  5. In the Topic configuration page, scroll down and click on “Access policy” tab. Step

  6. Check the value of “Prinicipal” key. If it’s set to (*) everyone then this topic allows access to everyone.Step

  7. To change the access policy, click on the “Edit” button at the top of the page. Step

  8. On the “Edit topic” page, scroll down to “Access policy” and in the “JSON editor” change the “Principal” key with the correct IAM role ARN eg. arn:aws:iam::066531304300:user/dev27. Step

  9. Click on “Save changes” button at the bottom of the page.Step

  10. Repeat step 3-9 for all other SNS Topics across all regions.