> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # AWS SNS Subscription Should Not Use HTTP As Delivery Protocol ### More Info: None of the Amazon SNS subscriptions created within your AWS account should use HTTP instead of HTTPS as delivery protocol in order to enforce SSL encryption for all subscription requests. ### Risk Level Medium ### Address Security ### Compliance Standards * APRA CPS 234 (Australia) * AWS Startup Security Baseline * AWS Well Architected Framework * BSI C5 (Germany) * Brazil LGPD * CCPA / CPRA (California) * CIS Critical Security Controls v8 * CMMC 2.0 * CSA Cloud Controls Matrix v4 * DPDPA * Digital Operational Resilience Act (EU) * HIPAA * ISO 27001 * ISO/IEC 27017 * ISO/IEC 27018 * ISO/IEC 27701 * KSA PDPL * MAS Technology Risk Management (Singapore) * MITRE ATT\&CK (Cloud) * NIS2 Directive * NIST SP 800-171 * NYDFS 23 NYCRR 500 * Reserve Bank of India (RBI) Cyber Security Framework * SOC2 * SWIFT Customer Security Controls Framework * Sarbanes-Oxley IT General Controls ### Triage and Remediation ### Remediation Sure, here are the step-by-step instructions to remediate the issue of "AWS SNS Subscription Should Not Use HTTP As Delivery Protocol" for AWS using the AWS console: 1. Login to the AWS Management Console. 2. Navigate to the SNS service from the Services dropdown. 3. Click on the Subscriptions option from the left-hand menu. 4. Select the subscription that is using HTTP as the delivery protocol. 5. Click on the Edit button from the subscription details page. 6. From the Protocol dropdown, select HTTPS as the delivery protocol. 7. Enter the endpoint URL that supports HTTPS delivery. 8. Click on the Update button to save the changes. Once the above steps are completed, the SNS subscription will use HTTPS as the delivery protocol instead of HTTP, which will remediate the issue of "AWS SNS Subscription Should Not Use HTTP As Delivery Protocol". # To remediate the misconfiguration of AWS SNS Subscription using HTTP as delivery protocol, follow the below steps: 1. Open the AWS CLI on your local machine. 2. Run the following command to list all the SNS subscriptions in your AWS account: `aws sns list-subscriptions` 3. Identify the subscription that uses HTTP as the delivery protocol. 4. Run the following command to update the subscription to use HTTPS as the delivery protocol: `aws sns set-subscription-attributes --subscription-arn --attribute-name DeliveryPolicy --attribute-value '{"http":{"defaultHealthyRetryPolicy":{"minDelayTarget":20,"maxDelayTarget":20,"numRetries":3,"numMaxDelayRetries":0,"numNoDelayRetries":0,"numMinDelayRetries":0,"backoffFunction":"linear"}},"https":{"defaultHealthyRetryPolicy":{"minDelayTarget":20,"maxDelayTarget":20,"numRetries":3,"numMaxDelayRetries":0,"numNoDelayRetries":0,"numMinDelayRetries":0,"backoffFunction":"linear"}}}'` Replace `` with the ARN of the subscription that needs to be updated. 5. Verify that the subscription has been updated by running the following command: `aws sns get-subscription-attributes --subscription-arn ` This command will return the attributes of the subscription. Verify that the `DeliveryPolicy` attribute has been updated with the new value. 6. Repeat the above steps for all the SNS subscriptions that use HTTP as the delivery protocol. By following these steps, you can remediate the misconfiguration of AWS SNS Subscription using HTTP as delivery protocol and update it to use HTTPS instead. Sure, here are the step-by-step instructions to remediate the AWS SNS Subscription that uses HTTP as the delivery protocol using Python: 1. First, you need to import the necessary libraries: ``` import boto3 ``` 2. Next, create a new boto3 client for SNS: ``` sns_client = boto3.client('sns') ``` 3. Then, you need to get a list of all the subscriptions for your SNS topic: ``` response = sns_client.list_subscriptions_by_topic(TopicArn='your_topic_arn') ``` 4. Loop through the response and check if any of the subscriptions are using HTTP as the delivery protocol: ``` for subscription in response['Subscriptions']: if subscription['Protocol'] == 'http': subscription_arn = subscription['SubscriptionArn'] ``` 5. If you find a subscription using HTTP, you need to update it to use HTTPS instead. To do this, you can use the `set_subscription_attributes` method: ``` sns_client.set_subscription_attributes( SubscriptionArn=subscription_arn, AttributeName='DeliveryPolicy', AttributeValue='{"http": {"defaultHealthyRetryPolicy": {"numRetries": 3,"numNoDelayRetries": 0,"minDelayTarget": 20,"maxDelayTarget": 20,"numMinDelayRetries": 0,"numMaxDelayRetries": 0,"backoffFunction": "linear"},"disableSubscriptionOverrides": false,"defaultThrottlePolicy": {"numRetries": 0,"numNoDelayRetries": 0,"minDelayTarget": 0,"maxDelayTarget": 0,"numMinDelayRetries": 0,"numMaxDelayRetries": 0,"backoffFunction": "linear"}},"https": {"defaultHealthyRetryPolicy": {"numRetries": 3,"numNoDelayRetries": 0,"minDelayTarget": 20,"maxDelayTarget": 20,"numMinDelayRetries": 0,"numMaxDelayRetries": 0,"backoffFunction": "linear"},"disableSubscriptionOverrides": false,"defaultThrottlePolicy": {"numRetries": 0,"numNoDelayRetries": 0,"minDelayTarget": 0,"maxDelayTarget": 0,"numMinDelayRetries": 0,"numMaxDelayRetries": 0,"backoffFunction": "linear"}}}' ) ``` This will update the subscription to use HTTPS as the delivery protocol. That's it! You have successfully remediated the AWS SNS Subscription that uses HTTP as the delivery protocol using Python. ```hcl theme={null} # Existing SNS topic resource "aws_sns_topic" "example" { name = "EXAMPLE_TOPIC_NAME" # replace with your topic name } # 1) Fix existing HTTP subscription by using HTTPS instead # NOTE: Changing protocol from "http" to "https" forces replacement of the subscription. # This destroys the HTTP subscription and creates a new HTTPS one; traffic to the old # endpoint will stop. A confirmation will be sent to the HTTPS endpoint. resource "aws_sns_topic_subscription" "example" { topic_arn = aws_sns_topic.example.arn protocol = "https" # was "http" endpoint = "https://EXAMPLE_ENDPOINT" # replace with your HTTPS endpoint URL # add any other arguments you already use (filter_policy, raw_message_delivery, etc.) } # 2) Harden the topic by denying any future HTTP subscriptions via topic policy data "aws_iam_policy_document" "sns_topic" { # Merge this with your existing statements as needed statement { sid = "DenyHTTPProtocol" effect = "Deny" actions = ["sns:Subscribe"] principals { type = "*" identifiers = ["*"] } resources = [aws_sns_topic.example.arn] condition { test = "StringEquals" variable = "sns:Protocol" values = ["http"] } } } resource "aws_sns_topic_policy" "example" { arn = aws_sns_topic.example.arn policy = data.aws_iam_policy_document.sns_topic.json } ``` Changing the `aws_sns_topic_subscription` `protocol` from `http` to `https` will show in `terraform plan` as the subscription being destroyed and re-created with `protocol = "https"`, and the `aws_sns_topic_policy` being created/updated to include the `DenyHTTPProtocol` statement. ### Additional Reading: * [https://docs.aws.amazon.com/sns/latest/dg/sns-http-https-endpoint-as-subscriber.html](https://docs.aws.amazon.com/sns/latest/dg/sns-http-https-endpoint-as-subscriber.html)