aws-sns-subscribe-exfiltrate

sns:Subscribe lets an attacker add their own endpoint as a subscriber and receive all messages published to the topic, including embedded secrets.

derived aws emits CanReadData

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`Topic`
source	`?principal`
target	`?topic`
permissions	`sns:Subscribe`
conditions	`iam_permission` `resource_policy`
state logic	ACTIVE when the principal has effective sns:Subscribe on the topic and can confirm a subscription (sns:ConfirmSubscription is implicit — the subscriber confirms via the token SNS sends to the endpoint). No additional IAM permission is required for confirmation once Subscribe is called. CONDITIONAL(resource_policy) when the topic policy restricts Subscribe to specific protocols or conditions. BLOCKED when a topic policy explicit Deny or SCP overrides the Allow.

source type

Identity

target type

Topic

source

?principal

target

?topic

permissions

sns:Subscribe

conditions

iam_permission resource_policy

state logic

ACTIVE when the principal has effective sns:Subscribe on the topic and can confirm a subscription (sns:ConfirmSubscription is implicit — the subscriber confirms via the token SNS sends to the endpoint). No additional IAM permission is required for confirmation once Subscribe is called. CONDITIONAL(resource_policy) when the topic policy restricts Subscribe to specific protocols or conditions. BLOCKED when a topic policy explicit Deny or SCP overrides the Allow.

Narrative

{principal.name} can subscribe an attacker-controlled endpoint to SNS topic {topic.name} (sns:Subscribe), receiving all published messages. If the topic carries sensitive data (ContainsSecret), credential-chains derives further impersonation capability.

Raw rule rules/derived/aws/sns.yaml

id: aws-sns-subscribe-exfiltrate
emits: CanReadData
description: sns:Subscribe lets an attacker add their own endpoint as a subscriber and receive all messages
  published to the topic, including embedded secrets.
match:
- - principal: null
  - HasPermission
  - topic: null
where:
- node_type(?topic) == Topic
- node_provider(?topic) == aws
- ?principal has EFFECTIVE sns:Subscribe on ?topic
emit:
  source_type: Identity
  target_type: Topic
  source: ?principal
  target: ?topic
  permissions:
  - sns:Subscribe
  conditions:
  - iam_permission
  - resource_policy
  state_logic: "ACTIVE when the principal has effective sns:Subscribe on the topic and can confirm a subscription\
    \ (sns:ConfirmSubscription is implicit \u2014 the subscriber confirms via the token SNS sends to the\
    \ endpoint). No additional IAM permission is required for confirmation once Subscribe is called. CONDITIONAL(resource_policy)\
    \ when the topic policy restricts Subscribe to specific protocols or conditions. BLOCKED when a topic\
    \ policy explicit Deny or SCP overrides the Allow."
  confidence: 0.9
  derived_from:
  - ?principal HasPermission ?topic (sns:Subscribe effective)
  false_positive_note: "An SNS subscription for protocols that require confirmation (HTTP/S, email, SQS)\
    \ needs the endpoint to respond to the confirmation token SNS sends. An attacker must control the\
    \ endpoint to complete confirmation; if they cannot confirm, the subscription stays pending and delivers\
    \ no messages. Model this as CONDITIONAL when the endpoint reachability is unverified. Email-JSON\
    \ / SMS subscriptions deliver to attacker-controlled addresses / phone numbers (lower security impact\
    \ than Lambda/SQS execution but still data exfiltration). The topic policy may require a specific\
    \ Protocol \u2014 honor that constraint. This CanReadData feeds credential-chains (read-secret-yields-identity)\
    \ when the topic has ContainsSecret; the credential-chains roll-up is CITED, not re-derived here."
  narrative: '{principal.name} can subscribe an attacker-controlled endpoint to SNS topic {topic.name}
    (sns:Subscribe), receiving all published messages. If the topic carries sensitive data (ContainsSecret),
    credential-chains derives further impersonation capability.'