SNS Topic should have restrictions set for publishing
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel,
n'hésitez pas à nous contacter.
Description
Update your Amazon Simple Notification Service (SNS) topic publishing permissions.
Rationale
A resource-based policy attached to an SNS topic with a Principal of * and an Action of sns:Publish allows anyone to publish to a topic. Unauthenticated users can publish arbitrary messages, potentially leading to an impact for downstream applications.
From the console
Follow the Preventative best practices docs to learn how to implement least-privilege access or use IAM roles for your applications and AWS services.
From the command line
- Update your access control policy with an appropriate
Principal ARN. Save the file as policy.json.
{
...
"Statement": [
...
{
"Sid": "console_pub",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::123456789012:root"
},
"Action": [
"SNS:Publish"
],
...
}
]
}
- Run
set-topic-attributes with the ARN of the SNS topic.
aws sns set-topic-attributes
--topic-arn arn:aws:sns:region:123456789012:YourTopic
--attribute-name Policy
--attribute-value file://policy.json
