SNS Topics Should Have Subscription

Using Console

Sure, here are the step by step instructions to remediate the misconfiguration of SNS topics not having subscriptions in AWS:

Open the AWS Management Console and navigate to the SNS service.
Select the SNS topic which is not having any subscription.
Click on the “Create Subscription” button.
Choose the protocol for the subscription. For example, you can choose email, SMS, or HTTP/HTTPS.
Enter the endpoint details based on the protocol you have selected. For example, if you have chosen email, then enter the email address of the recipient.
Click on the “Create Subscription” button to create the subscription.
Once the subscription is created, you will receive a confirmation message on the endpoint you have specified.
Repeat the above steps for all the SNS topics which do not have any subscription.

By following the above steps, you will be able to remediate the misconfiguration of SNS topics not having subscriptions in AWS.

Using CLI

To remediate the misconfiguration “SNS Topics Should Have Subscription” for AWS using AWS CLI, follow these steps:

Open the AWS CLI on your local machine.
Run the following command to list all the SNS topics in your AWS account:
aws sns list-topics
Identify the SNS topic that does not have any subscription.
Run the following command to list all the subscriptions for that SNS topic:
aws sns list-subscriptions-by-topic --topic-arn <topic_arn>
Replace <topic_arn> with the ARN of the SNS topic that you identified in step 3.
If the output of the above command is empty, it means that the SNS topic does not have any subscription.
Run the following command to create a subscription for the SNS topic:
aws sns subscribe --topic-arn <topic_arn> --protocol <protocol> --notification-endpoint <endpoint>
Replace <topic_arn> with the ARN of the SNS topic that you identified in step 3. Replace <protocol> with the protocol that you want to use for the subscription (e.g. email, SMS, etc.). Replace <endpoint> with the endpoint that you want to use for the subscription (e.g. email address, phone number, etc.).
Verify that the subscription was created successfully by running the following command:
aws sns list-subscriptions-by-topic --topic-arn <topic_arn>
Replace <topic_arn> with the ARN of the SNS topic that you identified in step 3.
Repeat steps 3 to 7 for any other SNS topics that do not have any subscription.

Using Python

To remediate the misconfiguration where SNS topics should have a subscription, you can use the following steps in Python:

Import the necessary libraries:

import boto3

Create a boto3 client for SNS:

sns_client = boto3.client('sns')

Use the list_topics() method to get a list of all topics:

topics = sns_client.list_topics()

Loop through the list of topics and check if each topic has at least one subscription:

for topic in topics['Topics']:
    subscriptions = sns_client.list_subscriptions_by_topic(TopicArn=topic['TopicArn'])
    if len(subscriptions['Subscriptions']) == 0:
        # If the topic has no subscriptions, create a subscription
        # You can choose to subscribe to an email address or an endpoint, depending on your use case
        sns_client.subscribe(TopicArn=topic['TopicArn'], Protocol='email', Endpoint='youremail@example.com')

Run the script to create subscriptions for all SNS topics that do not have any subscriptions.

Note: Make sure that you have the necessary permissions to create subscriptions for SNS topics.

Using Terraform

# SNS topic (existing or new)
resource "aws_sns_topic" "THIS_TOPIC" {
  name = "REPLACE_WITH_TOPIC_NAME"
}

# Subscribe an endpoint to the SNS topic (preferred remediation)
# Replace:
#   PROTOCOL   with one of: "sqs", "lambda", "sms", "application", "firehose", "email", "email-json", "http", "https"
#   ENDPOINT   with the target (e.g., SQS queue ARN, Lambda ARN, email address, HTTPS URL)
resource "aws_sns_topic_subscription" "THIS_TOPIC_SUBSCRIPTION" {
  topic_arn = aws_sns_topic.THIS_TOPIC.arn
  protocol  = "REPLACE_WITH_PROTOCOL"
  endpoint  = "REPLACE_WITH_ENDPOINT"
}

To delete an unused SNS topic instead, remove its aws_sns_topic (and any aws_sns_topic_subscription) resources from Terraform; this is a destructive change that will permanently delete the topic and cannot be undone—ensure nothing publishes to it before doing so.For protocols that require confirmation (e.g., email, http, https), the subscription will be created in a pending state and must be confirmed by the endpoint owner outside Terraform.Verification: terraform plan should show either creation of aws_sns_topic_subscription.THIS_TOPIC_SUBSCRIPTION (adding a subscriber) or - (destroy) for the aws_sns_topic (and its subscriptions) if you chose deletion.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

SNS Topics Should Have Subscription

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​

​Additional Reading: