Check ID: sns_subscription_not_using_http_endpoints
Provider: AWS
Service: sns
Severity: HIGH
Categories: encryption
Resource type: AwsSnsTopic

​
What this check verifies

Amazon SNS subscriptions are evaluated for endpoint protocol. Subscriptions using http are identified, while HTTPS endpoints indicate encrypted delivery in transit.

​
Risk

Using HTTP leaves SNS deliveries unencrypted, compromising confidentiality via eavesdropping. MITM attackers can modify payloads or headers, damaging integrity, inject malicious content into downstream systems, or capture subscription data for spoofing and unauthorized actions.

​
Recommendation

Require HTTPS for all SNS subscription endpoints. Prefer domain-based endpoints, verify SNS message signatures, and apply least privilege. Enforce TLS using IAM conditions like aws:SecureTransport, and use private connectivity (VPC endpoints) where possible for defense in depth.

​
Remediation

# Terraform: Ensure SNS subscription uses HTTPS
resource "aws_sns_topic_subscription" "<example_resource_name>" {
  topic_arn = "<example_resource_id>"
  protocol  = "https"                      # Critical: enforce HTTPS protocol
  endpoint  = "https://<example_endpoint>" # Critical: HTTPS endpoint URL
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = sns_subscription_not_using_http_endpoints. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks