Description

Detects AWS SNS Topics defined in CloudFormation templates that don't have server-side encryption (SSE) enabled. SNS Topics without encryption enabled could expose sensitive message data since messages are stored in plaintext.

Detection Strategy

• Scan CloudFormation template files for SNS Topic resource definitions

• Check if the SNS Topic resource exists and has Type: 'AWS::SNS::Topic'

• Verify if the Topic resource has server-side encryption configuration

• Report a vulnerability if an SNS Topic is found without encryption enabled

Vulnerable code example

Resources:
  Vuln:
    Type: 'AWS::SNS::Topic'  # Vulnerable: SNS Topic defined without encryption
    Properties:
      DisplayName: 'MySNSTopicDisplayName'  # Messages will be stored unencrypted

✅ Secure code example

Resources:
  Vuln:
    Type: 'AWS::SNS::Topic'
    Properties:
      DisplayName: 'MySNSTopicDisplayName'
      KmsMasterKeyId: !Ref 'TopicKMSKey'  # Added encryption using KMS key for message protection