aws-sns-topic-contains-secret

id: aws-sns-topic-contains-secret
emits: ContainsSecret
description: "An SNS topic without a DataProtectionPolicy may carry messages embedding secrets; any subscriber\
  \ can read them (POTENTIAL \u2014 content heuristic, not confirmed)."
match:
- - topic_policy: null
  - HasPolicy
  - topic: null
where:
- node_type(?topic) == Topic
- node_type(?topic_policy) == ResourcePolicy
- node_provider(?topic) == aws
- no DataProtectionPolicy is set on ?topic (sns:GetDataProtectionPolicy returns empty/null)
- 'heuristic: topic is used by an application that processes sensitive workloads (e.g. payments, auth,
  config) OR static message-sample analysis detects credential-shaped strings'
emit:
  source_type: Messaging
  target_type: Secret
  source: ?topic
  target: <GenericSecret (potential embedded credentials in published messages)>
  permissions: []
  conditions:
  - service_state
  state_logic: "POTENTIAL by default \u2014 message content is not statically observable from the topic\
    \ configuration; the presence of embedded secrets depends on what applications publish. Upgrade to\
    \ ACTIVE only when message samples or static analysis of publisher code confirms credential-shaped\
    \ payloads. CONDITIONAL when a DataProtectionPolicy is set but does not cover all sensitive field\
    \ patterns (partial masking). Set to BLOCKED/suppressed when a comprehensive DataProtectionPolicy\
    \ covers all known secret patterns."
  confidence: 0.5
  derived_from:
  - ?topic has no DataProtectionPolicy (sns:GetDataProtectionPolicy)
  false_positive_note: "This is a POTENTIAL edge (content heuristic) \u2014 do not emit as ACTIVE without\
    \ positive evidence (message-content analysis, publisher-code static analysis, or explicit annotation).\
    \ A DataProtectionPolicy that masks all sensitive patterns (e.g. CREDIT_CARD_NUMBER, ACCESS_KEY, PASSWORD)\
    \ is a real control \u2014 downgrade to BLOCKED. Topics used exclusively for status notifications\
    \ or infrastructure events (no credential-shaped data) should have this suppressed. The edge feeds\
    \ credential-chains only when CanReadData is also present on the topic (a subscriber can receive the\
    \ messages)."
  narrative: SNS topic {topic.name} has no DataProtectionPolicy; published messages may carry embedded
    secrets (API keys, tokens, connection strings) that any subscriber can receive. Combined with CanReadData
    on the topic, credential-chains can derive further impersonation capability.