From 5aa112d4383df241f13e80f22d634c0a21cdfc0d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rub=C3=A9n=20De=20la=20Torre=20Vico?= Date: Tue, 16 Dec 2025 12:33:49 +0100 Subject: [PATCH] chore(aws): enhance metadata for `sns` service (#9428) Co-authored-by: Daniel Barranquero --- prowler/CHANGELOG.md | 1 + ...ion_not_using_http_endpoints.metadata.json | 29 +++++++++------ ...s_encryption_at_rest_enabled.metadata.json | 35 ++++++++++++------- ...pics_not_publicly_accessible.metadata.json | 33 ++++++++++------- 4 files changed, 63 insertions(+), 35 deletions(-) diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md index 1c53554948..2e47ce3006 100644 --- a/prowler/CHANGELOG.md +++ b/prowler/CHANGELOG.md @@ -16,6 +16,7 @@ All notable changes to the **Prowler SDK** are documented in this file. - Update AWS MemoryDB service metadata to new format [(#9266)](https://github.com/prowler-cloud/prowler/pull/9266) - Update AWS Inspector v2 service metadata to new format [(#9260)](https://github.com/prowler-cloud/prowler/pull/9260) - Update AWS Service Catalog service metadata to new format [(#9410)](https://github.com/prowler-cloud/prowler/pull/9410) +- Update AWS SNS service metadata to new format [(#9428)](https://github.com/prowler-cloud/prowler/pull/9428) --- diff --git a/prowler/providers/aws/services/sns/sns_subscription_not_using_http_endpoints/sns_subscription_not_using_http_endpoints.metadata.json b/prowler/providers/aws/services/sns/sns_subscription_not_using_http_endpoints/sns_subscription_not_using_http_endpoints.metadata.json index ecf858163d..66d0ce1488 100644 --- a/prowler/providers/aws/services/sns/sns_subscription_not_using_http_endpoints/sns_subscription_not_using_http_endpoints.metadata.json +++ b/prowler/providers/aws/services/sns/sns_subscription_not_using_http_endpoints/sns_subscription_not_using_http_endpoints.metadata.json @@ -1,26 +1,33 @@ { "Provider": "aws", "CheckID": "sns_subscription_not_using_http_endpoints", - "CheckTitle": "Ensure there are no SNS subscriptions using HTTP endpoints", - "CheckType": [], + "CheckTitle": "SNS subscription uses an HTTPS endpoint", + "CheckType": [ + "Software and Configuration Checks/AWS Security Best Practices/Network Reachability", + "Effects/Data Exposure" + ], "ServiceName": "sns", "SubServiceName": "", - "ResourceIdTemplate": "arn:aws:sns:region:account-id:topic", + "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "AwsSnsTopic", - "Description": "Ensure there are no SNS subscriptions using HTTP endpoints", - "Risk": "When you use HTTPS, messages are automatically encrypted during transit, even if the SNS topic itself isn't encrypted. Without HTTPS, a network-based attacker can eavesdrop on network traffic or manipulate it using an attack such as man-in-the-middle.", - "RelatedUrl": "https://docs.aws.amazon.com/sns/latest/dg/sns-security-best-practices.html#enforce-encryption-data-in-transit", + "Description": "Amazon SNS subscriptions are evaluated for endpoint protocol. Subscriptions using `http` are identified, while **HTTPS** endpoints indicate encrypted delivery in transit.", + "Risk": "Using **HTTP** leaves SNS deliveries unencrypted, compromising **confidentiality** via eavesdropping. MITM attackers can modify payloads or headers, damaging **integrity**, inject malicious content into downstream systems, or capture subscription data for spoofing and unauthorized actions.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-sns-subscription.html", + "https://docs.aws.amazon.com/sns/latest/dg/sns-security-best-practices.html#enforce-encryption-data-in-transit" + ], "Remediation": { "Code": { "CLI": "", - "NativeIaC": "", - "Other": "", - "Terraform": "" + "NativeIaC": "```yaml\n# CloudFormation: Ensure SNS subscription uses HTTPS\nResources:\n :\n Type: AWS::SNS::Subscription\n Properties:\n TopicArn: \n Protocol: https # Critical: use HTTPS protocol to remediate HTTP usage\n Endpoint: https:// # Critical: HTTPS endpoint URL\n```", + "Other": "1. Open the Amazon SNS console and go to Subscriptions\n2. Select the subscription with Protocol set to HTTP and click Delete\n3. Click Create subscription\n4. Choose the same Topic ARN, set Protocol to HTTPS, and enter your HTTPS endpoint URL\n5. Create the subscription and confirm it from your endpoint if required", + "Terraform": "```hcl\n# Terraform: Ensure SNS subscription uses HTTPS\nresource \"aws_sns_topic_subscription\" \"\" {\n topic_arn = \"\"\n protocol = \"https\" # Critical: enforce HTTPS protocol\n endpoint = \"https://\" # Critical: HTTPS endpoint URL\n}\n```" }, "Recommendation": { - "Text": "To enforce only encrypted connections over HTTPS, add the aws:SecureTransport condition in the IAM policy that's attached to unencrypted SNS topics. This forces message publishers to use HTTPS instead of HTTP", - "Url": "https://docs.aws.amazon.com/sns/latest/dg/sns-security-best-practices.html#enforce-encryption-data-in-transit" + "Text": "Require **HTTPS** for all SNS subscription endpoints. Prefer domain-based endpoints, verify SNS message signatures, and apply **least privilege**. Enforce TLS using IAM conditions like `aws:SecureTransport`, and use private connectivity (VPC endpoints) where possible for defense in depth.", + "Url": "https://hub.prowler.com/check/sns_subscription_not_using_http_endpoints" } }, "Categories": [ diff --git a/prowler/providers/aws/services/sns/sns_topics_kms_encryption_at_rest_enabled/sns_topics_kms_encryption_at_rest_enabled.metadata.json b/prowler/providers/aws/services/sns/sns_topics_kms_encryption_at_rest_enabled/sns_topics_kms_encryption_at_rest_enabled.metadata.json index 0826f89219..59b74f5fba 100644 --- a/prowler/providers/aws/services/sns/sns_topics_kms_encryption_at_rest_enabled/sns_topics_kms_encryption_at_rest_enabled.metadata.json +++ b/prowler/providers/aws/services/sns/sns_topics_kms_encryption_at_rest_enabled/sns_topics_kms_encryption_at_rest_enabled.metadata.json @@ -1,26 +1,37 @@ { "Provider": "aws", "CheckID": "sns_topics_kms_encryption_at_rest_enabled", - "CheckTitle": "Ensure there are no SNS Topics unencrypted", - "CheckType": [], + "CheckTitle": "SNS topic is encrypted at rest with KMS", + "CheckType": [ + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/NIST 800-53 Controls (USA)", + "Software and Configuration Checks/Industry and Regulatory Standards/NIST CSF Controls (USA)", + "Software and Configuration Checks/Industry and Regulatory Standards/PCI-DSS", + "Software and Configuration Checks/Industry and Regulatory Standards/ISO 27001 Controls" + ], "ServiceName": "sns", "SubServiceName": "", - "ResourceIdTemplate": "arn:aws:sns:region:account-id:topic", + "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "AwsSnsTopic", - "Description": "Ensure there are no SNS Topics unencrypted", - "Risk": "If not enabled sensitive information at rest is not protected.", - "RelatedUrl": "https://docs.aws.amazon.com/sns/latest/dg/sns-server-side-encryption.html", + "Description": "**Amazon SNS topics** are assessed for **server-side encryption** with **AWS KMS**. Topics lacking a configured KMS key (e.g., missing `kms_master_key_id`) are identified as unencrypted at rest.", + "Risk": "Without KMS-backed SSE, SNS stores message bodies unencrypted at rest, undermining **confidentiality**.\n\nPrivileged insiders or compromised service components could access plaintext during persistence windows, causing data exposure. You also lose KMS controls such as key policies, rotation, and detailed audit trails.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/SNS/topic-encrypted-with-kms-customer-master-keys.html", + "https://docs.aws.amazon.com/sns/latest/dg/sns-server-side-encryption.html" + ], "Remediation": { "Code": { - "CLI": "aws sns set-topic-attributes --topic-arn --attribute-name 'KmsMasterKeyId' --attribute-value ", - "NativeIaC": "https://docs.prowler.com/checks/aws/general-policies/general_15#cloudformation", - "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/SNS/topic-encrypted-with-kms-customer-master-keys.html", - "Terraform": "https://docs.prowler.com/checks/aws/general-policies/general_15#terraform" + "CLI": "aws sns set-topic-attributes --topic-arn --attribute-name KmsMasterKeyId --attribute-value alias/aws/sns", + "NativeIaC": "```yaml\n# CloudFormation: Enable SSE for an SNS topic\nResources:\n :\n Type: AWS::SNS::Topic\n Properties:\n KmsMasterKeyId: alias/aws/sns # Critical: Enables encryption at rest with AWS managed KMS key\n```", + "Other": "1. Open the AWS Console and go to Amazon SNS > Topics\n2. Select the topic and click Edit\n3. Under Encryption, enable encryption and choose the AWS managed key for SNS (alias/aws/sns)\n4. Click Save changes", + "Terraform": "```hcl\n# Enable SSE for an SNS topic\nresource \"aws_sns_topic\" \"\" {\n name = \"\"\n kms_master_key_id = \"alias/aws/sns\" # Critical: Enables encryption at rest\n}\n```" }, "Recommendation": { - "Text": "Use Amazon SNS with AWS KMS.", - "Url": "https://docs.aws.amazon.com/sns/latest/dg/sns-server-side-encryption.html" + "Text": "Enable **server-side encryption** on all SNS topics with **AWS KMS**; prefer **customer-managed keys** for control.\n\nApply **least privilege** on key use, enforce rotation, and monitor key/access logs. Minimize sensitive data in messages and use end-to-end encryption *where feasible* to add defense in depth.", + "Url": "https://hub.prowler.com/check/sns_topics_kms_encryption_at_rest_enabled" } }, "Categories": [ diff --git a/prowler/providers/aws/services/sns/sns_topics_not_publicly_accessible/sns_topics_not_publicly_accessible.metadata.json b/prowler/providers/aws/services/sns/sns_topics_not_publicly_accessible/sns_topics_not_publicly_accessible.metadata.json index 0102dfb664..446a287c38 100644 --- a/prowler/providers/aws/services/sns/sns_topics_not_publicly_accessible/sns_topics_not_publicly_accessible.metadata.json +++ b/prowler/providers/aws/services/sns/sns_topics_not_publicly_accessible/sns_topics_not_publicly_accessible.metadata.json @@ -1,26 +1,35 @@ { "Provider": "aws", "CheckID": "sns_topics_not_publicly_accessible", - "CheckTitle": "Check if SNS topics have policy set as Public", - "CheckType": [], + "CheckTitle": "SNS topic is not publicly accessible", + "CheckType": [ + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Effects/Data Exposure", + "TTPs/Initial Access" + ], "ServiceName": "sns", "SubServiceName": "", - "ResourceIdTemplate": "arn:aws:sns:region:account-id:topic", + "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "AwsSnsTopic", - "Description": "Check if SNS topics have policy set as Public", - "Risk": "Publicly accessible services could expose sensitive data to bad actors.", - "RelatedUrl": "https://docs.aws.amazon.com/config/latest/developerguide/sns-topic-policy.html", + "Description": "**SNS topic policies** are analyzed for **public principals** (e.g., `*`). Topics that grant access without restrictive conditions such as `aws:SourceArn`, `aws:SourceAccount`, `aws:PrincipalOrgID`, or `sns:Endpoint` scoping are treated as publicly accessible.", + "Risk": "**Public SNS topics** allow anyone or unknown accounts to:\n- **Subscribe** and siphon messages (confidentiality)\n- **Publish** spoofed payloads that alter workflows (integrity)\n- **Flood** messages causing outages and costs (availability)\nThey also enable cross-account abuse and bypass expected trust boundaries.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/SNS/topics-everyone-publish.html", + "https://docs.aws.amazon.com/config/latest/developerguide/sns-topic-policy.html" + ], "Remediation": { "Code": { - "CLI": "", - "NativeIaC": "", - "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/SNS/topics-everyone-publish.html", - "Terraform": "https://docs.prowler.com/checks/aws/general-policies/ensure-sns-topic-policy-is-not-public-by-only-allowing-specific-services-or-principals-to-access-it#terraform" + "CLI": "aws sns set-topic-attributes --topic-arn --attribute-name Policy --attribute-value '{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"AWS\":\"arn:aws:iam:::root\"},\"Action\":\"sns:Publish\",\"Resource\":\"\"}]}'", + "NativeIaC": "```yaml\n# CloudFormation: restrict SNS topic policy to the account (not public)\nResources:\n :\n Type: AWS::SNS::TopicPolicy\n Properties:\n Topics:\n - arn:aws:sns:::\n PolicyDocument:\n Version: '2012-10-17'\n Statement:\n - Effect: Allow\n Action: sns:Publish\n Resource: arn:aws:sns:::\n Principal:\n AWS: arn:aws:iam:::root # Critical: restrict to account root to remove public access\n```", + "Other": "1. Open the Amazon SNS console and select Topics\n2. Choose the topic and go to the Access policy tab\n3. Edit the policy and remove any Principal set to \"*\" (Everyone/Public)\n4. Add a statement allowing only your account root: Principal = arn:aws:iam:::root with Action sns:Publish and Resource set to the topic ARN\n5. Save changes", + "Terraform": "```hcl\n# Restrict SNS topic policy to the account (not public)\nresource \"aws_sns_topic_policy\" \"\" {\n arn = \"\"\n policy = jsonencode({\n Version = \"2012-10-17\"\n Statement = [{\n Effect = \"Allow\"\n Action = \"sns:Publish\"\n Resource = \"\"\n Principal = { AWS = \"arn:aws:iam:::root\" } # Critical: restrict principal to the account to remove public access\n }]\n })\n}\n```" }, "Recommendation": { - "Text": "Ensure there is a business requirement for service to be public.", - "Url": "https://docs.aws.amazon.com/config/latest/developerguide/sns-topic-policy.html" + "Text": "Restrict the **topic policy** to specific principals and minimal actions:\n- Avoid `Principal:*`\n- Allow only needed actions (e.g., `sns:Publish`)\n- Add conditions like `aws:SourceArn`, `aws:SourceAccount`, `aws:PrincipalOrgID`, or `sns:Endpoint`\nApply **least privilege**, separate duties, and review policies regularly.", + "Url": "https://hub.prowler.com/check/sns_topics_not_publicly_accessible" } }, "Categories": [