AWS › Amazon SNS (Simple Notification Service)

What security controls are available to restrict who can publish to or subscribe from an SNS topic?

Advanced

Answer

SNS topics support resource based access policies, similar to those used with S3 buckets, letting you precisely control which AWS accounts, IAM users, or services are allowed to publish messages to a topic or subscribe to it, and SNS also supports server side encryption using AWS KMS to protect message content at rest, ensuring sensitive notification data remains secure both in terms of access control and encryption.

aws sns set-topic-attributes --topic-arn arn:aws:sns:us-east-1:123456789012:SensitiveAlerts --attribute-name Policy --attribute-value file://topic-policy.json

Real-world example A healthcare application restricts its SNS topic policy so that only a specific application role can publish patient related alert messages, while enabling KMS encryption to ensure the message content remains protected at rest.

Common follow-ups: How do you write an SNS topic policy that restricts access to a specific IAM role?;What is the performance impact of enabling KMS encryption on an SNS topic?

IAM;AWS KMS & Data Encryption