66 lines
1.6 KiB
YAML
66 lines
1.6 KiB
YAML
id: sns-topic-public-accessible
|
|
|
|
info:
|
|
name: Public Access of SNS Topics via Policy
|
|
author: Ritesh_Gohil(#L4stPL4Y3R)
|
|
severity: high
|
|
description: |
|
|
This template checks if Amazon SNS topics are configured to prevent public access via topic policies.
|
|
reference:
|
|
- https://docs.aws.amazon.com/sns/latest/api/API_GetTopicAttributes.html
|
|
metadata:
|
|
max-request: 2
|
|
tags: cloud,devops,aws,amazon,sns,aws-cloud-config
|
|
|
|
flow: |
|
|
code(1)
|
|
for (let topicArn of iterate(template.topics)) {
|
|
set("topicArn", topicArn)
|
|
code(2)
|
|
}
|
|
|
|
self-contained: true
|
|
code:
|
|
- engine:
|
|
- sh
|
|
- bash
|
|
source: |
|
|
aws sns list-topics --query 'Topics[*].TopicArn'
|
|
|
|
extractors:
|
|
- type: json
|
|
internal: true
|
|
name: topics
|
|
json:
|
|
- '.[]'
|
|
|
|
- engine:
|
|
- sh
|
|
- bash
|
|
source: |
|
|
aws sns get-topic-attributes --topic-arn $topicArn --query Attributes.Policy --output text
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: word
|
|
part: body
|
|
words:
|
|
- '"Effect":"Allow"'
|
|
|
|
- type: word
|
|
part: body
|
|
words:
|
|
- '"Principal":{"AWS":"*"}'
|
|
|
|
- type: regex
|
|
part: body
|
|
negative: true
|
|
regex:
|
|
- '"Condition"'
|
|
|
|
extractors:
|
|
- type: dsl
|
|
dsl:
|
|
- '"The SNS topic " + topicArn + " is publicly accessible via Policy"'
|
|
|
|
# digest: 4b0a00483046022100cbb02679b206daa0a1138c3c7d400ca3ccf3aea22840064633a6ac54fbe6a44d022100f23545b9fc5cdb35c1c853d68c2cb35904bd22385117daa75cf0923441d212d4:922c64590222798bb761d5b6d8e72950 |