sns-public-subscribe-access: Public Subscription Access of SNS Topics via Policy

id: sns-public-subscribe-access

info:
  name: Public Subscription Access of SNS Topics via Policy
  author: Ritesh_Gohil(#L4stPL4Y3R)
  severity: high
  description: |
    This template checks if Amazon SNS topics are configured to allow public subscription access via topic policies.
  reference:
    - https://docs.aws.amazon.com/sns/latest/api/API_GetTopicAttributes.html
  tags: cloud,devops,aws,amazon,sns,aws-cloud-config

flow: |
  code(1)
  for (let topicArn of iterate(template.topics)) {
    set("topicArn", topicArn)
    code(2)
  }

self-contained: true
code:
  - engine:
      - sh
      - bash
    source: |
      aws sns list-topics --query 'Topics[*].TopicArn'

    extractors:
      - type: json
        internal: true
        name: topics
        json:
          - '.[]'

  - engine:
      - sh
      - bash
    source: |
      aws sns get-topic-attributes --topic-arn $topicArn --query Attributes.Policy --output text

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"Effect":"Allow"'

      - type: word
        part: body
        words:
          - '"Principal":{"AWS":"*"}'

      - type: word
        part: body
        words:
          - '"Action":"SNS:Subscribe"'

      - type: regex
        part: body
        negative: true
        regex:
          - '"Condition"'

    extractors:
      - type: dsl
        dsl:
          - '"The SNS topic " + topicArn + " allows public subscription via Policy"'
# digest: 4a0a004730450221008a967d8e5c9942beefab71caa02bdc0fd01121f2c88254d8a37296a941f8e02c02200d45a3425f5011f61061b5004635f3ad9407bcd88ae47fcda6afc63e883b432d:366f2a24c8eb519f6968bd8801c08ebe

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.