aws-sns-modify-topic-policy

sns:SetTopicAttributes (Policy attribute) or sns:AddPermission rewrites or extends the SNS topic access policy, enabling self-grant of Publish/Subscribe or cross-account trust.

derived aws emits CanModifyPolicy

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`ResourcePolicy`
source	`?principal`
target	`<topic ResourcePolicy of ?topic>`
permissions	`sns:SetTopicAttributes` `sns:AddPermission`
conditions	`iam_permission` `resource_policy` `scp_or_org_policy`
state logic	ACTIVE when the principal has effective sns:SetTopicAttributes on the topic (can rewrite the full Policy attribute) or sns:AddPermission (can append any statement, including cross-account Publish/Subscribe grants). CONDITIONAL(resource_policy) if the topic policy Condition or SCP requires additional constraints. BLOCKED when SCP or permission-boundary denies both actions.

source type

Identity

target type

ResourcePolicy

source

?principal

target

<topic ResourcePolicy of ?topic>

permissions

sns:SetTopicAttributes sns:AddPermission

conditions

iam_permission resource_policy scp_or_org_policy

state logic

ACTIVE when the principal has effective sns:SetTopicAttributes on the topic (can rewrite the full Policy attribute) or sns:AddPermission (can append any statement, including cross-account Publish/Subscribe grants). CONDITIONAL(resource_policy) if the topic policy Condition or SCP requires additional constraints. BLOCKED when SCP or permission-boundary denies both actions.

Narrative

{principal.name} can modify the access policy of SNS topic {topic.name} (sns:SetTopicAttributes / sns:AddPermission), enabling self-grant of Publish or Subscribe rights, or granting cross-account access to the topic.

Raw rule rules/derived/aws/sns.yaml

id: aws-sns-modify-topic-policy
emits: CanModifyPolicy
description: sns:SetTopicAttributes (Policy attribute) or sns:AddPermission rewrites or extends the SNS
  topic access policy, enabling self-grant of Publish/Subscribe or cross-account trust.
match:
- - principal: null
  - HasPermission
  - topic: null
where:
- node_type(?topic) == Topic
- node_provider(?topic) == aws
- ?principal has EFFECTIVE sns:SetTopicAttributes OR sns:AddPermission on ?topic
emit:
  source_type: Identity
  target_type: ResourcePolicy
  source: ?principal
  target: <topic ResourcePolicy of ?topic>
  permissions:
  - sns:SetTopicAttributes
  - sns:AddPermission
  conditions:
  - iam_permission
  - resource_policy
  - scp_or_org_policy
  state_logic: ACTIVE when the principal has effective sns:SetTopicAttributes on the topic (can rewrite
    the full Policy attribute) or sns:AddPermission (can append any statement, including cross-account
    Publish/Subscribe grants). CONDITIONAL(resource_policy) if the topic policy Condition or SCP requires
    additional constraints. BLOCKED when SCP or permission-boundary denies both actions.
  confidence: 0.95
  derived_from:
  - ?principal HasPermission ?topic (sns:SetTopicAttributes or sns:AddPermission effective)
  false_positive_note: "sns:AddPermission can only ADD statements \u2014 it cannot remove existing Deny\
    \ statements or change the Effect of existing statements. An attacker who only has sns:AddPermission\
    \ can self-grant Publish or cross-account access but cannot remove a Deny that blocks them. sns:SetTopicAttributes\
    \ with the Policy attribute is the stronger form (full rewrite). Distinguish: sns:AddPermission is\
    \ scoped to adding Allow statements for specific AWS accounts; sns:SetTopicAttributes (Policy) is\
    \ a full policy PUT. When only sns:AddPermission is available, model the capability accordingly. Both\
    \ are high value as they enable cross-account publish grants (new CrossAccountTrust) or Subscribe\
    \ grants (new CanReadData for the attacker's account). An SCP denying sns:SetTopicAttributes blocks\
    \ the full rewrite but may not block AddPermission \u2014 check both."
  narrative: '{principal.name} can modify the access policy of SNS topic {topic.name} (sns:SetTopicAttributes
    / sns:AddPermission), enabling self-grant of Publish or Subscribe rights, or granting cross-account
    access to the topic.'