> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # SNS Topics Should Not Allow Global Subscribe ### More Info: Your AWS Simple Notification Service (SNS) topics should not allow Everyone to subscribe in order to protect the messages published to your topics against attackers or unauthorized personnel. ### Risk Level Medium ### Address Security ### Compliance Standards * APRA CPS 234 (Australia) * AWS Well Architected Framework * BSI C5 (Germany) * Brazil LGPD * CCPA / CPRA (California) * CIS Critical Security Controls v8 * CMMC 2.0 * CSA Cloud Controls Matrix v4 * DPDPA * Digital Operational Resilience Act (EU) * Essential 8 * HITRUST CSF * ISO/IEC 27017 * ISO/IEC 27018 * ISO/IEC 27701 * KSA PDPL * MAS Technology Risk Management (Singapore) * MITRE ATT\&CK (Cloud) * NIS2 Directive * NIST CSF * NIST SP 800-171 * NYDFS 23 NYCRR 500 * PCI * SOC2 * SWIFT Customer Security Controls Framework * Sarbanes-Oxley IT General Controls * Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework ### Triage and Remediation ### Remediation Sure, here are the step-by-step instructions to remediate this misconfiguration in AWS using the AWS console: 1. Open the Amazon SNS console at [https://console.aws.amazon.com/sns/](https://console.aws.amazon.com/sns/). 2. In the navigation pane, choose Topics. 3. Select the SNS topic that you want to remediate. 4. Choose the Access policy tab. 5. In the Access policy editor, locate the statement that grants global subscribe permissions. It should look like this: ``` { "Effect": "Allow", "Principal": "*", "Action": "SNS:Subscribe", "Resource": "arn:aws:sns:us-east-1:123456789012:MyTopic", "Condition": { "StringEquals": { "AWS:SourceOwner": "123456789012" } } } ``` 6. Remove the `"Principal": "*"` line from the statement to restrict subscriptions to only AWS accounts that you explicitly specify. 7. Choose Save changes to update the access policy for the SNS topic. That's it! You have successfully remediated the misconfiguration by removing global subscribe permissions from the SNS topic. # To remediate the misconfiguration "SNS Topics Should Not Allow Global Subscribe" in AWS using AWS CLI, you can follow these steps: 1. Open the AWS CLI on your local machine or EC2 instance. 2. Run the following command to list all the SNS topics in your AWS account: ``` aws sns list-topics ``` 3. Identify the SNS topic(s) that have global subscription enabled. 4. Run the following command to update the policy of the identified SNS topic(s) to disallow global subscription: ``` aws sns set-topic-attributes --topic-arn --attribute-name Policy --attribute-value '{"Version":"2008-10-17","Id":"__default_policy_ID","Statement":[{"Effect":"Deny","Principal":{"AWS":"*"},"Action":"SNS:Subscribe","Resource":""}]}' ``` Replace `` with the ARN of the identified SNS topic. 5. Verify that the policy has been updated successfully by running the following command: ``` aws sns get-topic-attributes --topic-arn --attribute-names Policy ``` Replace `` with the ARN of the identified SNS topic. 6. Repeat steps 3-5 for all the SNS topics that have global subscription enabled. By following these steps, you can remediate the misconfiguration "SNS Topics Should Not Allow Global Subscribe" in AWS using AWS CLI. To remediate the misconfiguration "SNS Topics Should Not Allow Global Subscribe" in AWS using Python, you can follow the below steps: 1. First, you need to get a list of all the SNS topics in your AWS account using the boto3 library in Python. You can use the following code snippet to achieve this: ``` import boto3 sns = boto3.client('sns') response = sns.list_topics() topics = response['Topics'] ``` 2. Once you have the list of all SNS topics, you can iterate through each topic and check if it allows global subscriptions. To do this, you need to get the policy of the SNS topic using the `get_topic_attributes` method and then check if the policy allows global subscriptions. You can use the following code snippet to achieve this: ``` for topic in topics: topic_arn = topic['TopicArn'] attributes = sns.get_topic_attributes(TopicArn=topic_arn) policy = attributes['Attributes']['Policy'] if 'AllowEveryoneToSubscribe' in policy: # Remove the global subscription permission policy = policy.replace('"AllowEveryoneToSubscribe": "true"', '"AllowEveryoneToSubscribe": "false"') # Update the policy sns.set_topic_attributes(TopicArn=topic_arn, AttributeName='Policy', AttributeValue=policy) ``` 3. Finally, you need to test the remediation by checking if the SNS topics still allow global subscriptions. You can use the same code snippet in step 2 to check the policy of each SNS topic and make sure that the "AllowEveryoneToSubscribe" parameter is set to "false". By following these steps, you can remediate the misconfiguration "SNS Topics Should Not Allow Global Subscribe" in AWS using Python. ```hcl theme={null} resource "aws_sns_topic" "this" { name = "TOPIC_NAME" # replace with your SNS topic name } data "aws_iam_policy_document" "sns_topic_policy" { # Keep only the allowed principals/actions here. # DO NOT include any statement with: # Effect = "Allow" # Principal = "*" # (or AWS = "*") # and Action including "sns:Subscribe" statement { sid = "AllowSpecificPublisher" # example; adjust to your needs effect = "Allow" principals { type = "AWS" identifiers = ["ARN_OF_ALLOWED_PUBLISHER"] # replace with allowed principal ARN(s) } actions = [ "sns:Publish", ] resources = [ aws_sns_topic.this.arn, ] } # Add any other required statements here, but never with public subscribe. # Example of DENYing public Subscribe explicitly, if you want defense in depth: # statement { # sid = "DenyPublicSubscribe" # effect = "Deny" # # principals { # type = "*" # identifiers = ["*"] # } # # actions = ["sns:Subscribe"] # resources = [aws_sns_topic.this.arn] # } } resource "aws_sns_topic_policy" "this" { arn = aws_sns_topic.this.arn policy = data.aws_iam_policy_document.sns_topic_policy.json } ``` Modifying `aws_sns_topic_policy` replaces the entire existing SNS topic policy document (logically destructive), but it does not force replacement of the SNS topic itself. For verification, `terraform plan` should show an update to `aws_sns_topic_policy.this.policy` that removes any statement where `Principal` is `"*"` (or `"AWS": "*"`) and `Action` includes `"sns:Subscribe"`, with no resource replacements. ### Additional Reading: * [https://docs.aws.amazon.com/sns/latest/dg/AccessPolicyLanguage.html](https://docs.aws.amazon.com/sns/latest/dg/AccessPolicyLanguage.html)