aws-sns-publish-can-write-data

A principal with effective sns:Publish on an SNS topic can send messages to it, potentially triggering all bound subscribers.

derived aws emits CanWriteData

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`Topic`
source	`?principal`
target	`?topic`
permissions	`sns:Publish`
conditions	`iam_permission` `resource_policy` `scp_or_org_policy`
state logic	ACTIVE when the principal's effective permissions (identity policy + resource policy evaluation) allow sns:Publish on the topic ARN and no SCP/permission-boundary deny overrides it. CONDITIONAL(resource_policy) when the topic policy includes a Condition (e.g. aws:SourceVpc, aws:SourceAccount, aws:SourceArn) that the principal must satisfy. BLOCKED when an explicit deny (topic policy Deny, SCP, or permission boundary) overrides.

source type

Identity

target type

Topic

source

?principal

target

?topic

permissions

sns:Publish

conditions

iam_permission resource_policy scp_or_org_policy

state logic

ACTIVE when the principal's effective permissions (identity policy + resource policy evaluation) allow sns:Publish on the topic ARN and no SCP/permission-boundary deny overrides it. CONDITIONAL(resource_policy) when the topic policy includes a Condition (e.g. aws:SourceVpc, aws:SourceAccount, aws:SourceArn) that the principal must satisfy. BLOCKED when an explicit deny (topic policy Deny, SCP, or permission boundary) overrides.

Narrative

{principal.name} can publish messages to SNS topic {topic.name} (sns:Publish). Every active subscriber receives an attacker-controlled payload; messaging-chains rule 1 derives CanTrigger to each bound consumer from this CanWriteData fact.

Raw rule rules/derived/aws/sns.yaml

id: aws-sns-publish-can-write-data
emits: CanWriteData
description: A principal with effective sns:Publish on an SNS topic can send messages to it, potentially
  triggering all bound subscribers.
match:
- - principal: null
  - HasPermission
  - topic: null
where:
- node_type(?topic) == Topic
- node_provider(?topic) == aws
- ?principal has EFFECTIVE sns:Publish on ?topic (permission evaluator confirms; not denied by topic policy,
  SCP, or permission boundary)
emit:
  source_type: Identity
  target_type: Topic
  source: ?principal
  target: ?topic
  permissions:
  - sns:Publish
  conditions:
  - iam_permission
  - resource_policy
  - scp_or_org_policy
  state_logic: ACTIVE when the principal's effective permissions (identity policy + resource policy evaluation)
    allow sns:Publish on the topic ARN and no SCP/permission-boundary deny overrides it. CONDITIONAL(resource_policy)
    when the topic policy includes a Condition (e.g. aws:SourceVpc, aws:SourceAccount, aws:SourceArn)
    that the principal must satisfy. BLOCKED when an explicit deny (topic policy Deny, SCP, or permission
    boundary) overrides.
  confidence: 0.97
  derived_from:
  - ?principal HasPermission ?topic (sns:Publish effective)
  false_positive_note: "Verify the effective permission (identity policy PLUS topic resource policy):\
    \ a topic policy explicit Deny on sns:Publish overrides any identity-policy Allow. Honor aws:SourceVpce\
    \ / aws:SourceVpc / aws:SourceAccount conditions \u2014 a Publish allowed only from a specific VPC\
    \ endpoint is CONDITIONAL(condition_expression), not ACTIVE for an arbitrary caller. Cross-account\
    \ publish to a topic in another account requires BOTH the caller's identity policy to allow sns:Publish\
    \ on the remote topic ARN AND the topic's resource policy to allow it \u2014 if either is missing,\
    \ do not emit. An SCP denying sns:Publish at the account level -> BLOCKED."
  narrative: '{principal.name} can publish messages to SNS topic {topic.name} (sns:Publish). Every active
    subscriber receives an attacker-controlled payload; messaging-chains rule 1 derives CanTrigger to
    each bound consumer from this CanWriteData fact.'