SNS Topics Should Not Allow Global Publishing

More Info:

Your AWS Simple Notification Service (SNS) topics should not allow Everyone to publish in order to protect against attackers or unauthorized users that can publish malicious messages to your topics.

Risk Level

Medium

Address

Security

Compliance Standards

• APRA CPS 234 (Australia)
• AWS Well Architected Framework
• BSI C5 (Germany)
• Brazil LGPD
• CCPA / CPRA (California)
• CIS Critical Security Controls v8
• CMMC 2.0
• CSA Cloud Controls Matrix v4
• DPDPA
• Digital Operational Resilience Act (EU)
• Essential 8
• HITRUST CSF
• ISO/IEC 27017
• ISO/IEC 27018
• ISO/IEC 27701
• KSA PDPL
• MAS Technology Risk Management (Singapore)
• MITRE ATT&CK (Cloud)
• NIS2 Directive
• NIST CSF
• NIST SP 800-171
• NYDFS 23 NYCRR 500
• PCI
• SOC2
• SWIFT Customer Security Controls Framework
• Sarbanes-Oxley IT General Controls
• Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework
• UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

Sure, here are the step-by-step instructions to remediate the SNS topic global publishing misconfiguration in AWS:

1. Open the AWS Management Console and navigate to the SNS service.
2. Click on the SNS topic that needs to be remediated.
3. In the topic details page, click on the “Access Policy” tab.
4. Click on the “Edit” button to modify the access policy.
5. In the access policy editor, remove the following statement:

{
  "Effect": "Allow",
  "Principal": "*",
  "Action": "SNS:Publish",
  "Resource": "arn:aws:sns:*:*:*"
}

6. Click on the “Save Changes” button to save the updated access policy.
7. Verify that the access policy no longer allows global publishing by checking that the Principal is no longer set to "*".
8. Repeat these steps for any other SNS topics that need to be remediated.

That’s it! By following these steps, you have successfully remediated the SNS topic global publishing misconfiguration in AWS.

Using CLI

To remediate the misconfiguration of SNS Topics allowing global publishing in AWS using AWS CLI, follow these steps:

1. Open the AWS CLI on your system.

2. Run the following command to list all the SNS topics in your AWS account:

   aws sns list-topics
   

3. Identify the ARN of the SNS topic that needs to be remediated.

4. Run the following command to update the SNS topic policy to disallow global publishing:

   aws sns set-topic-attributes --topic-arn <topic-arn> --attribute-name Policy --attribute-value '{"Version":"2008-10-17","Id":"__default_policy_ID","Statement":[{"Effect":"Deny","Principal":"*","Action":"SNS:Publish","Resource":"<topic-arn>","Condition":{"StringEquals":{"AWS:SourceOwner":"<aws-account-id>"}}}]}'
   

   Replace <topic-arn> with the ARN of the SNS topic identified in step 3 and <aws-account-id> with your AWS account ID.

5. Verify that the SNS topic policy has been updated successfully by running the following command:

   aws sns get-topic-attributes --topic-arn <topic-arn> --attribute-names Policy
   

   This command should return the updated policy that disallows global publishing.

6. Repeat steps 3-5 for all the SNS topics in your AWS account that allow global publishing.

By following these steps, you can remediate the misconfiguration of SNS topics allowing global publishing in AWS using AWS CLI.

Using Python

To remediate the misconfiguration in AWS where SNS Topics should not allow global publishing, you can follow the below steps using Python:

1. Create an AWS SNS client using the Boto3 library in Python.

import boto3

sns_client = boto3.client('sns')

2. Get the list of all SNS topics using the list_topics() method.

response = sns_client.list_topics()
topics = response['Topics']

3. For each topic, check if it has the Policy attribute set. If it does, retrieve the policy using the get_topic_attributes() method.

for topic in topics:
    topic_arn = topic['TopicArn']
    response = sns_client.get_topic_attributes(TopicArn=topic_arn)
    policy = response.get('Attributes', {}).get('Policy')

4. If the policy exists, parse it using the json module and check if it allows global publishing. If it does, update the policy to disallow global publishing using the set_topic_attributes() method.

import json

if policy:
    policy_json = json.loads(policy)
    if 'Statement' in policy_json:
        for statement in policy_json['Statement']:
            if (statement.get('Effect') == 'Allow' and 
                statement.get('Principal') == '*'):
                policy_json['Statement'].remove(statement)
        new_policy = json.dumps(policy_json)
        sns_client.set_topic_attributes(TopicArn=topic_arn, 
                                         AttributeName='Policy', 
                                         AttributeValue=new_policy)

5. Once all the policies have been updated, the misconfiguration has been remediated.

Note: Make sure to have the appropriate AWS credentials and permissions set up for the Python script to access and modify SNS topics.

Using Terraform

resource "aws_sns_topic" "this" {
  name = "SNS_TOPIC_NAME" # replace with your SNS topic name
}

# Attach a restrictive policy to the SNS topic that does NOT allow global ("*") publishing
resource "aws_sns_topic_policy" "this" {
  arn    = aws_sns_topic.this.arn
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid       = "AllowSpecificPublisher"
        Effect    = "Allow"
        Principal = {
          AWS = [
            "arn:aws:iam::PUBLISHER_ACCOUNT_ID:role/PUBLISHER_ROLE_NAME", # replace with allowed publisher(s)
          ]
        }
        Action   = "SNS:Publish"
        Resource = aws_sns_topic.this.arn
      },
      # keep any other required non-public statements here, but ensure none have Principal "*" or {"AWS":"*"}
    ]
  })
}

This replaces the entire existing topic policy with one that no longer has any "Principal": "*" or "AWS": "*" statements while still allowing explicitly listed principals to publish. Updating aws_sns_topic_policy does not replace the SNS topic itself, only the policy document will be updated in place.

Verification: terraform plan should show an update to aws_sns_topic_policy.this (old policy JSON replaced with the new policy) and no other changes.

Additional Reading:

• https://docs.aws.amazon.com/sns/latest/dg/AccessPolicyLanguage.html