> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # SNS Topics Should Not Be Exposed ### More Info: There should not be any publicly accessible SNS topics in order to protect them against attackers or unauthorized personnel. ### Risk Level Medium ### Address Security ### Compliance Standards * APRA CPS 234 (Australia) * AWS Well Architected Framework * BSI C5 (Germany) * Brazil LGPD * CCPA / CPRA (California) * CIS Critical Security Controls v8 * CMMC 2.0 * CSA Cloud Controls Matrix v4 * DPDPA * Digital Operational Resilience Act (EU) * Essential 8 * HITRUST CSF * ISO/IEC 27017 * ISO/IEC 27018 * ISO/IEC 27701 * KSA PDPL * MAS Technology Risk Management (Singapore) * MITRE ATT\&CK (Cloud) * NIS2 Directive * NIST CSF * NIST SP 800-171 * NYDFS 23 NYCRR 500 * PCI * SOC2 * SWIFT Customer Security Controls Framework * Sarbanes-Oxley IT General Controls * UK NCSC Cyber Assessment Framework ### Triage and Remediation ### Remediation Sure, here are the step-by-step instructions to remediate the SNS Topics Should Not Be Exposed issue in AWS using the AWS console: 1. Log in to your AWS console. 2. Open the SNS service. 3. Click on the topic that you want to remediate. 4. Click on the "Access policy" tab. 5. Review the policy to ensure that it only allows access to the necessary users and roles. 6. If the policy allows public access, click on the "Edit" button. 7. Update the policy to restrict access to only the necessary users and roles. 8. Click on the "Save changes" button to save the updated policy. By following these steps, you will be able to remediate the SNS Topics Should Not Be Exposed issue in AWS using the AWS console. # To remediate the misconfiguration "SNS Topics Should Not Be Exposed" in AWS using AWS CLI, you can follow these steps: 1. Identify the exposed SNS topics in your AWS account using the following AWS CLI command: ``` aws sns list-topics ``` 2. Once you have identified the exposed SNS topics, you can remove the public access policy from them using the following AWS CLI command: ``` aws sns set-topic-attributes --topic-arn arn:aws:sns:us-east-1:123456789012:MyTopic --attribute-name Policy --attribute-value "" ``` Note: Replace the topic ARN with the ARN of the exposed SNS topic in your AWS account. 3. You can also restrict access to the SNS topic by updating the access policy to allow only authorized AWS accounts or IAM users to access it. You can use the following AWS CLI command to update the access policy: ``` aws sns set-topic-attributes --topic-arn arn:aws:sns:us-east-1:123456789012:MyTopic --attribute-name Policy --attribute-value '{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::123456789012:user/MyUser" }, "Action": "sns:Publish", "Resource": "arn:aws:sns:us-east-1:123456789012:MyTopic" } ] }' ``` Note: Replace the topic ARN and IAM user ARN with the ARNs of the exposed SNS topic and authorized IAM user in your AWS account. 4. Finally, you can also enable SNS encryption using AWS KMS to ensure that the data in the SNS topic is encrypted at rest and in transit. You can use the following AWS CLI command to enable SNS encryption: ``` aws sns set-topic-attributes --topic-arn arn:aws:sns:us-east-1:123456789012:MyTopic --attribute-name KmsMasterKeyId --attribute-value "arn:aws:kms:us-east-1:123456789012:key/1234abcd-12ab-34cd-56ef-1234567890ab" ``` Note: Replace the topic ARN and KMS key ARN with the ARNs of the SNS topic and KMS key in your AWS account. By following these steps, you can remediate the misconfiguration "SNS Topics Should Not Be Exposed" in your AWS account using AWS CLI. To remediate the misconfiguration "SNS Topics Should Not Be Exposed" in AWS using Python, you can follow the below steps: Step 1: Create an AWS Lambda function with the following code: ```python theme={null} import boto3 def lambda_handler(event, context): sns = boto3.client('sns') topics = sns.list_topics()['Topics'] for topic in topics: topic_arn = topic['TopicArn'] response = sns.remove_permission( TopicArn=topic_arn, Label='Everyone' ) print(response) ``` Step 2: Save and deploy the Lambda function to your AWS account. Step 3: Create an AWS CloudWatch Event Rule that triggers the Lambda function on a schedule or based on a specific event. Step 4: Test the Lambda function to ensure that it removes the "Everyone" permission from all SNS topics in your AWS account. This code will remove the "Everyone" permission from all SNS topics in your AWS account, which will prevent unauthorized access to your SNS topics. ```hcl theme={null} resource "aws_sns_topic" "THIS_TOPIC" { name = "REPLACE_WITH_TOPIC_NAME" } # Replace ANY existing public topic policy with a restricted one. # Do NOT include any statement with Principal="*" resource "aws_sns_topic_policy" "this" { arn = aws_sns_topic.T HIS_TOPIC.arn policy = jsonencode({ Version = "2012-10-17" Statement = [ { Sid = "AllowSpecificAccountOrRoleOnly" # REPLACE_WITH_MEANINGFUL_SID Effect = "Allow" Principal = { AWS = "arn:aws:iam::ALLOWED_ACCOUNT_ID_OR_ROLE_ID:root" # REPLACE_WITH_ALLOWED_PRINCIPAL_ARN } Action = "sns:*" # TIGHTEN IF NEEDED Resource = aws_sns_topic.THIS_TOPIC.arn } # Add more statements here ONLY for explicitly allowed principals; # do not use "*" as a Principal. ] }) } ``` This Terraform replaces the SNS topic’s policy with one that has no public (`"Principal": "*"`) statements; it updates the policy in place and does not force topic replacement, but it can break callers that relied on the previous permissions, so mirror any necessary non-public statements from the old policy. For verification, `terraform plan` should show the `aws_sns_topic_policy.this` resource with a `~ update in-place` to its `policy` JSON, and no other changes unless you modified additional arguments. ### Additional Reading: * [https://docs.aws.amazon.com/sns/latest/dg/AccessPolicyLanguage.html](https://docs.aws.amazon.com/sns/latest/dg/AccessPolicyLanguage.html)