aws-sns-create-subscription-schedule

id: aws-sns-create-subscription-schedule
emits: CanSchedule
description: sns:Subscribe lets an attacker create a new subscription (EventRule binding) on the topic,
  routing future publishes to a chosen Lambda or SQS endpoint.
match:
- - principal: null
  - HasPermission
  - topic: null
where:
- node_type(?topic) == Topic
- node_provider(?topic) == aws
- ?principal has EFFECTIVE sns:Subscribe on ?topic
emit:
  source_type: Identity
  target_type: EventRule
  source: ?principal
  target: <new SNS subscription (EventRule) on ?topic>
  permissions:
  - sns:Subscribe
  conditions:
  - iam_permission
  - resource_policy
  state_logic: ACTIVE when the principal has effective sns:Subscribe on the topic. Confirmation is required
    for HTTP/S endpoints (the endpoint must respond to the SNS confirmation POST) and for SQS queues (auto-confirmed
    by SNS if sqs:SendMessage is allowed by the queue policy for the topic ARN). CONDITIONAL(service_state)
    when the subscription target does not yet have the required resource-policy permission (lambda:AddPermission
    / sqs:SendMessage from the topic) to complete confirmation.
  confidence: 0.85
  derived_from:
  - ?principal HasPermission ?topic (sns:Subscribe effective)
  false_positive_note: "Adding a Lambda subscription requires the Lambda function's resource-based policy\
    \ to grant lambda:InvokeFunction to sns.amazonaws.com for the source topic ARN. An attacker without\
    \ lambda:AddPermission on the target Lambda cannot complete the Lambda subscription \u2014 the subscription\
    \ confirms but SNS cannot invoke the function. Track whether the attacker also holds lambda:AddPermission.\
    \ For SQS subscriptions, the SQS queue policy must allow sqs:SendMessage from the topic ARN \u2014\
    \ without it, the subscription is confirmed but delivery is rejected. CanSchedule models the ability\
    \ to CREATE the binding; the binding's usefulness for CanExecuteAs requires the consumer to already\
    \ execute as an identity of interest (messaging-chains rule 2) \u2014 that roll-up is the linchpin's\
    \ job, CITED not re-derived here."
  narrative: '{principal.name} can subscribe a chosen endpoint (Lambda or SQS) to SNS topic {topic.name}
    (sns:Subscribe), creating a persistent trigger binding (SNS subscription EventRule) that routes all
    future publishes to that endpoint. This is the Phase-10 "create a trigger" primitive; messaging-chains
    derives further execution consequences.'