> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Is subscription secure only remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        Sure, here are the step-by-step instructions to remediate the issue of "AWS SNS Subscription Should Not Use HTTP As Delivery Protocol" for AWS using the AWS console:

        1. Login to the AWS Management Console.
        2. Navigate to the SNS service from the Services dropdown.
        3. Click on the Subscriptions option from the left-hand menu.
        4. Select the subscription that is using HTTP as the delivery protocol.
        5. Click on the Edit button from the subscription details page.
        6. From the Protocol dropdown, select HTTPS as the delivery protocol.
        7. Enter the endpoint URL that supports HTTPS delivery.
        8. Click on the Update button to save the changes.

        Once the above steps are completed, the SNS subscription will use HTTPS as the delivery protocol instead of HTTP, which will remediate the issue of "AWS SNS Subscription Should Not Use HTTP As Delivery Protocol".

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration of AWS SNS Subscription using HTTP as delivery protocol, follow the below steps:

        1. Open the AWS CLI on your local machine.

        2. Run the following command to list all the SNS subscriptions in your AWS account:

           `aws sns list-subscriptions`

        3. Identify the subscription that uses HTTP as the delivery protocol.

        4. Run the following command to update the subscription to use HTTPS as the delivery protocol:

           `aws sns set-subscription-attributes --subscription-arn <subscription-arn> --attribute-name DeliveryPolicy --attribute-value '{"http":{"defaultHealthyRetryPolicy":{"minDelayTarget":20,"maxDelayTarget":20,"numRetries":3,"numMaxDelayRetries":0,"numNoDelayRetries":0,"numMinDelayRetries":0,"backoffFunction":"linear"}},"https":{"defaultHealthyRetryPolicy":{"minDelayTarget":20,"maxDelayTarget":20,"numRetries":3,"numMaxDelayRetries":0,"numNoDelayRetries":0,"numMinDelayRetries":0,"backoffFunction":"linear"}}}'`

           Replace `<subscription-arn>` with the ARN of the subscription that needs to be updated.

        5. Verify that the subscription has been updated by running the following command:

           `aws sns get-subscription-attributes --subscription-arn <subscription-arn>`

           This command will return the attributes of the subscription. Verify that the `DeliveryPolicy` attribute has been updated with the new value.

        6. Repeat the above steps for all the SNS subscriptions that use HTTP as the delivery protocol.

        By following these steps, you can remediate the misconfiguration of AWS SNS Subscription using HTTP as delivery protocol and update it to use HTTPS instead.
      </Accordion>

      <Accordion title="Using Python">
        Sure, here are the step-by-step instructions to remediate the AWS SNS Subscription that uses HTTP as the delivery protocol using Python:

        1. First, you need to import the necessary libraries:

        ```
        import boto3
        ```

        2. Next, create a new boto3 client for SNS:

        ```
        sns_client = boto3.client('sns')
        ```

        3. Then, you need to get a list of all the subscriptions for your SNS topic:

        ```
        response = sns_client.list_subscriptions_by_topic(TopicArn='your_topic_arn')
        ```

        4. Loop through the response and check if any of the subscriptions are using HTTP as the delivery protocol:

        ```
        for subscription in response['Subscriptions']:
            if subscription['Protocol'] == 'http':
                subscription_arn = subscription['SubscriptionArn']
        ```

        5. If you find a subscription using HTTP, you need to update it to use HTTPS instead. To do this, you can use the `set_subscription_attributes` method:

        ```
        sns_client.set_subscription_attributes(
            SubscriptionArn=subscription_arn,
            AttributeName='DeliveryPolicy',
            AttributeValue='{"http": {"defaultHealthyRetryPolicy": {"numRetries": 3,"numNoDelayRetries": 0,"minDelayTarget": 20,"maxDelayTarget": 20,"numMinDelayRetries": 0,"numMaxDelayRetries": 0,"backoffFunction": "linear"},"disableSubscriptionOverrides": false,"defaultThrottlePolicy": {"numRetries": 0,"numNoDelayRetries": 0,"minDelayTarget": 0,"maxDelayTarget": 0,"numMinDelayRetries": 0,"numMaxDelayRetries": 0,"backoffFunction": "linear"}},"https": {"defaultHealthyRetryPolicy": {"numRetries": 3,"numNoDelayRetries": 0,"minDelayTarget": 20,"maxDelayTarget": 20,"numMinDelayRetries": 0,"numMaxDelayRetries": 0,"backoffFunction": "linear"},"disableSubscriptionOverrides": false,"defaultThrottlePolicy": {"numRetries": 0,"numNoDelayRetries": 0,"minDelayTarget": 0,"maxDelayTarget": 0,"numMinDelayRetries": 0,"numMaxDelayRetries": 0,"backoffFunction": "linear"}}}'
        )
        ```

        This will update the subscription to use HTTPS as the delivery protocol.

        That's it! You have successfully remediated the AWS SNS Subscription that uses HTTP as the delivery protocol using Python.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        # Existing SNS topic
        resource "aws_sns_topic" "example" {
          name = "EXAMPLE_TOPIC_NAME" # replace with your topic name
        }

        # 1) Fix existing HTTP subscription by using HTTPS instead
        # NOTE: Changing protocol from "http" to "https" forces replacement of the subscription.
        # This destroys the HTTP subscription and creates a new HTTPS one; traffic to the old
        # endpoint will stop. A confirmation will be sent to the HTTPS endpoint.
        resource "aws_sns_topic_subscription" "example" {
          topic_arn = aws_sns_topic.example.arn

          protocol = "https"                     # was "http"
          endpoint = "https://EXAMPLE_ENDPOINT"  # replace with your HTTPS endpoint URL

          # add any other arguments you already use (filter_policy, raw_message_delivery, etc.)
        }

        # 2) Harden the topic by denying any future HTTP subscriptions via topic policy
        data "aws_iam_policy_document" "sns_topic" {
          # Merge this with your existing statements as needed

          statement {
            sid     = "DenyHTTPProtocol"
            effect  = "Deny"
            actions = ["sns:Subscribe"]

            principals {
              type        = "*"
              identifiers = ["*"]
            }

            resources = [aws_sns_topic.example.arn]

            condition {
              test     = "StringEquals"
              variable = "sns:Protocol"
              values   = ["http"]
            }
          }
        }

        resource "aws_sns_topic_policy" "example" {
          arn    = aws_sns_topic.example.arn
          policy = data.aws_iam_policy_document.sns_topic.json
        }
        ```

        Changing the `aws_sns_topic_subscription` `protocol` from `http` to `https` will show in `terraform plan` as the subscription being destroyed and re-created with `protocol = "https"`, and the `aws_sns_topic_policy` being created/updated to include the `DenyHTTPProtocol` statement.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>