> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS CloudFormation Stack Should Have Notifications Enabled

### More Info:

All your AWS CloudFormation stacks should be using Simple Notification Service (AWS SNS) in order to receive notifications when an event occurs.

### Risk Level

Low

### Address

Operational Maturity

### Compliance Standards

* APRA CPS 234 (Australia)
* BSI C5 (Germany)
* Brazil LGPD
* CCPA / CPRA (California)
* CIS Critical Security Controls v8
* CMMC 2.0
* CSA Cloud Controls Matrix v4
* Cloudanix Best Practice
* DPDPA
* Digital Operational Resilience Act (EU)
* ISO/IEC 27017
* ISO/IEC 27018
* ISO/IEC 27701
* KSA PDPL
* MAS Technology Risk Management (Singapore)
* MITRE ATT\&CK (Cloud)
* NIS2 Directive
* NIST SP 800-171
* NYDFS 23 NYCRR 500
* SWIFT Customer Security Controls Framework
* Sarbanes-Oxley IT General Controls
* StateRAMP
* UK NCSC Cyber Assessment Framework

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration of "AWS CloudFormation Stack Should Have Notifications Enabled" in AWS using AWS console, follow the below steps:

        1. Login to the AWS Management Console.
        2. Go to the CloudFormation service.
        3. Select the stack for which you want to enable notifications.
        4. Click on the "Stack Settings" button located at the top of the page.
        5. In the "Advanced" section, click on "Edit".
        6. Scroll down to the "Notification Options" section.
        7. Enable the "Receive stack notifications" option.
        8. Enter the email addresses of the recipients in the "Email list" field.
        9. Choose the events for which you want to receive notifications.
        10. Click on "Save" to save the changes.

        Once you have completed the above steps, notifications will be enabled for the selected stack and you will receive email notifications for the selected events.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration "AWS CloudFormation Stack Should Have Notifications Enabled" for AWS using AWS CLI, follow these steps:

        1. Open the AWS CLI on your local machine.

        2. Run the following command to get a list of all the CloudFormation stacks in your AWS account:

        ```
        aws cloudformation list-stacks
        ```

        3. Identify the stack that needs to be remediated.

        4. Run the following command to update the stack with notification configuration:

        ```
        aws cloudformation update-stack --stack-name <stack-name> --notification-arns <notification-arn>
        ```

        Replace `<stack-name>` with the name of the stack that needs to be remediated and `<notification-arn>` with the Amazon Resource Name (ARN) of the SNS topic that will be used to receive notifications.

        5. Verify that the notification configuration has been updated by running the following command:

        ```
        aws cloudformation describe-stack-events --stack-name <stack-name>
        ```

        This command will display the events associated with the stack, including the notification configuration updates.

        6. Repeat steps 4 and 5 for each stack that needs to be remediated.

        By following these steps, you can remediate the misconfiguration "AWS CloudFormation Stack Should Have Notifications Enabled" for AWS using AWS CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration of AWS CloudFormation Stack not having notifications enabled, you can use the following steps in Python:

        1. Import the necessary AWS SDK modules, such as `boto3` and `botocore`.

        ```python theme={null}
        import boto3
        from botocore.exceptions import ClientError
        ```

        2. Create an AWS CloudFormation client object using the `boto3` module.

        ```python theme={null}
        cloudformation = boto3.client('cloudformation')
        ```

        3. Retrieve the list of existing CloudFormation stacks using the `describe_stacks()` method.

        ```python theme={null}
        stacks = cloudformation.describe_stacks()
        ```

        4. Iterate through the list of stacks and check if the `NotificationARNs` attribute is present. If not, add it using the `update_stack()` method.

        ```python theme={null}
        for stack in stacks['Stacks']:
            stack_name = stack['StackName']
            if 'NotificationARNs' not in stack:
                try:
                    cloudformation.update_stack(
                        StackName=stack_name,
                        NotificationARNs=['arn:aws:sns:us-east-1:123456789012:my-topic']
                    )
                    print(f"Stack {stack_name} updated with notifications.")
                except ClientError as e:
                    print(f"Error updating stack {stack_name}: {e}")
            else:
                print(f"Stack {stack_name} already has notifications enabled.")
        ```

        5. Replace the `arn:aws:sns:us-east-1:123456789012:my-topic` value with the ARN of the SNS topic you want to use for notifications.

        These steps will enable notifications for all AWS CloudFormation stacks that do not have them enabled.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "aws_sns_topic" "cloudformation_notifications" {
          name = "CLOUDFORMATION_NOTIFICATIONS_TOPIC_NAME" # replace with your SNS topic name
        }

        resource "aws_cloudformation_stack" "example" {
          name          = "CLOUDFORMATION_STACK_NAME"       # replace with your stack name
          template_body = file("PATH/TO/template.yaml")     # replace with your template path

          # Enable SNS notifications for this CloudFormation stack
          notification_arns = [
            aws_sns_topic.cloudformation_notifications.arn, # or replace with an existing SNS topic ARN
          ]
        }
        ```

        This change updates the stack to send event notifications to the specified SNS topic; it is an in-place update and does not force stack replacement (CloudFormation performs an UpdateStack using the existing template).

        `terraform plan` should show the `aws_cloudformation_stack` resource with a `~` update to `notification_arns` from `[]` (or its previous value) to the ARN list containing your SNS topic.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://docs.aws.amazon.com/config/latest/developerguide/cloudformation-stack-notification-check.html](https://docs.aws.amazon.com/config/latest/developerguide/cloudformation-stack-notification-check.html)