All checks
Critical
SNS topic access policies should not allow public access
Checks whether an SNS topic's access policy lets everyone ("*") use the topic with no condition that pins the caller and no Deny that closes it. Depending on the actions granted, any AWS account can then publish to your subscribers or subscribe its own endpoints to your messages.
- service
- SNS
- severity
- Critical
- scope
- evaluated in every region
How to fix it
- Overwrites existing settings: The CLI and Terraform routes replace the whole access policy, so start from the current one and keep the statements you are not changing.
- Can break clients: Publishers that relied on the open statement are refused as soon as the policy is saved; existing subscriptions keep delivering.
In the console
Simple Notification Service → Topics → the topic → Access policy
- Principal
- Named accounts or services; not "*" or {"AWS": "*"} in an Allow, and no Allow with NotPrincipal
- Condition
- Keep "*" only with a fixed aws:SourceOwner, aws:SourceAccount, aws:PrincipalOrgID or aws:SourceArn; not aws:SourceIp
With the AWS CLI
aws sns set-topic-attributes --topic-arn <topic-arn> --attribute-name Policy --attribute-value file://topic-policy.json --region <region>With Terraform
resource "aws_sns_topic_policy" "this" {
arn = var.topic_arn
policy = data.aws_iam_policy_document.no_public_access.json
}See which of your accounts this check is failing on.
Book a live scan