SNS topic is not publicly accessible

Check ID: sns_topics_not_publicly_accessible
Provider: AWS
Service: sns
Severity: HIGH
Categories: internet-exposed
Resource type: AwsSnsTopic

What this check verifies

SNS topic policies are analyzed for public principals (e.g., *). Topics that grant access without restrictive conditions such as aws:SourceArn, aws:SourceAccount, aws:PrincipalOrgID, or sns:Endpoint scoping are treated as publicly accessible.

Risk

Public SNS topics allow anyone or unknown accounts to:

Subscribe and siphon messages (confidentiality)
Publish spoofed payloads that alter workflows (integrity)
Flood messages causing outages and costs (availability) They also enable cross-account abuse and bypass expected trust boundaries.

Recommendation

Restrict the topic policy to specific principals and minimal actions:

Avoid Principal:*
Allow only needed actions (e.g., sns:Publish)
Add conditions like aws:SourceArn, aws:SourceAccount, aws:PrincipalOrgID, or sns:Endpoint Apply least privilege, separate duties, and review policies regularly.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws sns set-topic-attributes --topic-arn <TOPIC_ARN> --attribute-name Policy --attribute-value '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::<ACCOUNT_ID>:root"},"Action":"sns:Publish","Resource":"<TOPIC_ARN>"}]}'

# Restrict SNS topic policy to the account (not public)
resource "aws_sns_topic_policy" "<example_resource_name>" {
  arn    = "<TOPIC_ARN>"
  policy = jsonencode({
    Version   = "2012-10-17"
    Statement = [{
      Effect    = "Allow"
      Action    = "sns:Publish"
      Resource  = "<TOPIC_ARN>"
      Principal = { AWS = "arn:aws:iam::<ACCOUNT_ID>:root" } # Critical: restrict principal to the account to remove public access
    }]
  })
}

# CloudFormation: restrict SNS topic policy to the account (not public)
Resources:
  <example_resource_name>:
    Type: AWS::SNS::TopicPolicy
    Properties:
      Topics:
        - arn:aws:sns:<region>:<account_id>:<example_resource_name>
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action: sns:Publish
            Resource: arn:aws:sns:<region>:<account_id>:<example_resource_name>
            Principal:
              AWS: arn:aws:iam::<account_id>:root  # Critical: restrict to account root to remove public access

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = sns_topics_not_publicly_accessible. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

SNS topic is encrypted at rest with KMS SQS queue policy does not allow public access

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires