SNS subscription uses an HTTPS endpoint
sns_subscription_not_using_http_endpoints
Amazon SNS subscriptions are evaluated for endpoint protocol. Subscriptions using http are identified, while HTTPS endpoints indicate encrypted delivery in transit.
Risk
Using HTTP leaves SNS deliveries unencrypted, compromising confidentiality via eavesdropping. MITM attackers can modify payloads or headers, damaging integrity, inject malicious content into downstream systems, or capture subscription data for spoofing and unauthorized actions.
prowler aws --checks sns_subscription_not_using_http_endpoints
Recommendation
Require HTTPS for all SNS subscription endpoints. Prefer domain-based endpoints, verify SNS message signatures, and apply least privilege. Enforce TLS using IAM conditions like aws:SecureTransport, and use private connectivity (VPC endpoints) where possible for defense in depth.
Remediation
- Open the Amazon SNS console and go to Subscriptions
- Select the subscription with Protocol set to HTTP and click Delete
- Click Create subscription
- Choose the same Topic ARN, set Protocol to HTTPS, and enter your HTTPS endpoint URL
- Create the subscription and confirm it from your endpoint if required
Source Code
Resource Type
AwsSnsTopic