68 lines
1.6 KiB
YAML
68 lines
1.6 KiB
YAML
|
id: sns-public-subscribe-access
|
||
|
|
||
|
|
info:
|
||
|
|
name: Public Subscription Access of SNS Topics via Policy
|
||
|
|
author: Ritesh_Gohil(#L4stPL4Y3R)
|
||
|
|
severity: high
|
||
|
|
description: |
|
||
|
|
This template checks if Amazon SNS topics are configured to allow public subscription access via topic policies.
|
||
|
|
reference:
|
||
|
|
- https://docs.aws.amazon.com/sns/latest/api/API_GetTopicAttributes.html
|
||
|
|
tags: cloud,devops,aws,amazon,sns,aws-cloud-config
|
||
|
|
|
||
|
|
flow: |
|
||
|
|
code(1)
|
||
|
|
for (let topicArn of iterate(template.topics)) {
|
||
|
|
set("topicArn", topicArn)
|
||
|
|
code(2)
|
||
|
|
}
|
||
|
|
|
||
|
|
self-contained: true
|
||
|
|
code:
|
||
|
|
- engine:
|
||
|
|
- sh
|
||
|
|
- bash
|
||
|
|
source: |
|
||
|
|
aws sns list-topics --query 'Topics[*].TopicArn'
|
||
|
|
|
||
|
|
extractors:
|
||
|
|
- type: json
|
||
|
|
internal: true
|
||
|
|
name: topics
|
||
|
|
json:
|
||
|
|
- '.[]'
|
||
|
|
|
||
|
|
- engine:
|
||
|
|
- sh
|
||
|
|
- bash
|
||
|
|
source: |
|
||
|
|
aws sns get-topic-attributes --topic-arn $topicArn --query Attributes.Policy --output text
|
||
|
|
|
||
|
|
matchers-condition: and
|
||
|
|
matchers:
|
||
|
|
- type: word
|
||
|
|
part: body
|
||
|
|
words:
|
||
|
|
- '"Effect":"Allow"'
|
||
|
|
|
||
|
|
- type: word
|
||
|
|
part: body
|
||
|
|
words:
|
||
|
|
- '"Principal":{"AWS":"*"}'
|
||
|
|
|
||
|
|
- type: word
|
||
|
|
part: body
|
||
|
|
words:
|
||
|
|
- '"Action":"SNS:Subscribe"'
|
||
|
|
|
||
|
|
- type: regex
|
||
|
|
part: body
|
||
|
|
negative: true
|
||
|
|
regex:
|
||
|
|
- '"Condition"'
|
||
|
|
|
||
|
|
extractors:
|
||
|
|
- type: dsl
|
||
|
|
dsl:
|
||
|
|
- '"The SNS topic " + topicArn + " allows public subscription via Policy"'
|
||
|
|
# digest: 4a0a004730450221008a967d8e5c9942beefab71caa02bdc0fd01121f2c88254d8a37296a941f8e02c02200d45a3425f5011f61061b5004635f3ad9407bcd88ae47fcda6afc63e883b432d:366f2a24c8eb519f6968bd8801c08ebe
|