aws-sns-modify-topic-configuration

id: aws-sns-modify-topic-configuration
emits: CanModifyConfiguration
description: sns:SetTopicAttributes can modify topic configuration including KmsMasterKeyId (SSE), DeliveryPolicy,
  SignatureVersion, etc., enabling data-exposure and delivery attacks.
match:
- - principal: null
  - HasPermission
  - topic: null
where:
- node_type(?topic) == Topic
- node_provider(?topic) == aws
- ?principal has EFFECTIVE sns:SetTopicAttributes on ?topic
emit:
  source_type: Identity
  target_type: Messaging
  source: ?principal
  target: ?topic
  permissions:
  - sns:SetTopicAttributes
  conditions:
  - iam_permission
  - resource_policy
  - scp_or_org_policy
  state_logic: ACTIVE when the principal has effective sns:SetTopicAttributes on the topic (can modify
    all topic attributes including KmsMasterKeyId, DeliveryPolicy, SignatureVersion). CONDITIONAL(resource_policy)
    if the topic policy or SCP requires additional constraints. BLOCKED when SCP or permission-boundary
    denies the action.
  confidence: 0.94
  derived_from:
  - ?principal HasPermission ?topic (sns:SetTopicAttributes effective)
  false_positive_note: "sns:SetTopicAttributes is a superset capability: it covers BOTH policy modification\
    \ (CanModifyPolicy) and configuration mutation (CanModifyConfiguration). This rule targets the non-policy\
    \ attributes (KmsMasterKeyId, DeliveryPolicy, SignatureVersion, DisplayName, etc.) that are also attack\
    \ surfaces. KmsMasterKeyId can be cleared, disabling SSE-KMS encryption and exposing messages in plaintext.\
    \ DeliveryPolicy can be weakened to skip retry or increase failure rates. These are lower-value attack\
    \ surfaces than policy rewrite but still represent capability to modify the topic. Avoid double-emitting\
    \ both edges for the same principal/topic when both CanModifyPolicy and CanModifyConfiguration fire\
    \ from the same sns:SetTopicAttributes permission \u2014 deduplication is expected; emit once per\
    \ (CanModifyPolicy, principal, policy) and once per (CanModifyConfiguration, principal, topic)."
  narrative: '{principal.name} can modify SNS topic {topic.name} configuration (sns:SetTopicAttributes),
    including disabling SSE-KMS encryption (KmsMasterKeyId), weakening delivery retry policy, and other
    configuration changes that can enable data-exposure attacks.'