SNS Topics Should Not Allow Global Publishing
More Info:
Your AWS Simple Notification Service (SNS) topics should not allow Everyone to publish in order to protect against attackers or unauthorized users that can publish malicious messages to your topics.Risk Level
MediumAddress
SecurityCompliance Standards
HITRUST, AWSWAF, SOC2, NISTCSF, PCIDSSTriage and Remediation
Remediation
Using Console
Using Console
Sure, here are the step-by-step instructions to remediate the SNS topic global publishing misconfiguration in AWS:
- Open the AWS Management Console and navigate to the SNS service.
- Click on the SNS topic that needs to be remediated.
- In the topic details page, click on the “Access Policy” tab.
- Click on the “Edit” button to modify the access policy.
- In the access policy editor, remove the following statement:
- Click on the “Save Changes” button to save the updated access policy.
- Verify that the access policy no longer allows global publishing by checking that the
Principalis no longer set to"*". - Repeat these steps for any other SNS topics that need to be remediated.
Using CLI
Using CLI
To remediate the misconfiguration of SNS Topics allowing global publishing in AWS using AWS CLI, follow these steps:
- Open the AWS CLI on your system.
-
Run the following command to list all the SNS topics in your AWS account:
- Identify the ARN of the SNS topic that needs to be remediated.
-
Run the following command to update the SNS topic policy to disallow global publishing:
Replace
<topic-arn>with the ARN of the SNS topic identified in step 3 and<aws-account-id>with your AWS account ID. -
Verify that the SNS topic policy has been updated successfully by running the following command:
This command should return the updated policy that disallows global publishing.
- Repeat steps 3-5 for all the SNS topics in your AWS account that allow global publishing.
Using Python
Using Python
To remediate the misconfiguration in AWS where SNS Topics should not allow global publishing, you can follow the below steps using Python:
- Create an AWS SNS client using the Boto3 library in Python.
- Get the list of all SNS topics using the
list_topics()method.
- For each topic, check if it has the
Policyattribute set. If it does, retrieve the policy using theget_topic_attributes()method.
- If the policy exists, parse it using the
jsonmodule and check if it allows global publishing. If it does, update the policy to disallow global publishing using theset_topic_attributes()method.
- Once all the policies have been updated, the misconfiguration has been remediated.