Skip to main content

​
More Info:

None of the Amazon SNS subscriptions created within your AWS account should use HTTP instead of HTTPS as delivery protocol in order to enforce SSL encryption for all subscription requests.

​
Risk Level

Medium

​
Address

Security

​
Compliance Standards

SOC2, HIPAA, ISO27001, AWSWAF

​
Triage and Remediation

  • Remediation

​
Remediation

Using Console

Sure, here are the step-by-step instructions to remediate the issue of “AWS SNS Subscription Should Not Use HTTP As Delivery Protocol” for AWS using the AWS console:
  1. Login to the AWS Management Console.
  2. Navigate to the SNS service from the Services dropdown.
  3. Click on the Subscriptions option from the left-hand menu.
  4. Select the subscription that is using HTTP as the delivery protocol.
  5. Click on the Edit button from the subscription details page.
  6. From the Protocol dropdown, select HTTPS as the delivery protocol.
  7. Enter the endpoint URL that supports HTTPS delivery.
  8. Click on the Update button to save the changes.
Once the above steps are completed, the SNS subscription will use HTTPS as the delivery protocol instead of HTTP, which will remediate the issue of “AWS SNS Subscription Should Not Use HTTP As Delivery Protocol”.

​

To remediate the misconfiguration of AWS SNS Subscription using HTTP as delivery protocol, follow the below steps:
  1. Open the AWS CLI on your local machine.
  2. Run the following command to list all the SNS subscriptions in your AWS account: aws sns list-subscriptions
  3. Identify the subscription that uses HTTP as the delivery protocol.
  4. Run the following command to update the subscription to use HTTPS as the delivery protocol: aws sns set-subscription-attributes --subscription-arn <subscription-arn> --attribute-name DeliveryPolicy --attribute-value '{"http":{"defaultHealthyRetryPolicy":{"minDelayTarget":20,"maxDelayTarget":20,"numRetries":3,"numMaxDelayRetries":0,"numNoDelayRetries":0,"numMinDelayRetries":0,"backoffFunction":"linear"}},"https":{"defaultHealthyRetryPolicy":{"minDelayTarget":20,"maxDelayTarget":20,"numRetries":3,"numMaxDelayRetries":0,"numNoDelayRetries":0,"numMinDelayRetries":0,"backoffFunction":"linear"}}}' Replace <subscription-arn> with the ARN of the subscription that needs to be updated.
  5. Verify that the subscription has been updated by running the following command: aws sns get-subscription-attributes --subscription-arn <subscription-arn> This command will return the attributes of the subscription. Verify that the DeliveryPolicy attribute has been updated with the new value.
  6. Repeat the above steps for all the SNS subscriptions that use HTTP as the delivery protocol.
By following these steps, you can remediate the misconfiguration of AWS SNS Subscription using HTTP as delivery protocol and update it to use HTTPS instead.
Sure, here are the step-by-step instructions to remediate the AWS SNS Subscription that uses HTTP as the delivery protocol using Python:
  1. First, you need to import the necessary libraries:
import boto3
  1. Next, create a new boto3 client for SNS:
sns_client = boto3.client('sns')
  1. Then, you need to get a list of all the subscriptions for your SNS topic:
response = sns_client.list_subscriptions_by_topic(TopicArn='your_topic_arn')
  1. Loop through the response and check if any of the subscriptions are using HTTP as the delivery protocol:
for subscription in response['Subscriptions']:
    if subscription['Protocol'] == 'http':
        subscription_arn = subscription['SubscriptionArn']
  1. If you find a subscription using HTTP, you need to update it to use HTTPS instead. To do this, you can use the set_subscription_attributes method:
sns_client.set_subscription_attributes(
    SubscriptionArn=subscription_arn,
    AttributeName='DeliveryPolicy',
    AttributeValue='{"http": {"defaultHealthyRetryPolicy": {"numRetries": 3,"numNoDelayRetries": 0,"minDelayTarget": 20,"maxDelayTarget": 20,"numMinDelayRetries": 0,"numMaxDelayRetries": 0,"backoffFunction": "linear"},"disableSubscriptionOverrides": false,"defaultThrottlePolicy": {"numRetries": 0,"numNoDelayRetries": 0,"minDelayTarget": 0,"maxDelayTarget": 0,"numMinDelayRetries": 0,"numMaxDelayRetries": 0,"backoffFunction": "linear"}},"https": {"defaultHealthyRetryPolicy": {"numRetries": 3,"numNoDelayRetries": 0,"minDelayTarget": 20,"maxDelayTarget": 20,"numMinDelayRetries": 0,"numMaxDelayRetries": 0,"backoffFunction": "linear"},"disableSubscriptionOverrides": false,"defaultThrottlePolicy": {"numRetries": 0,"numNoDelayRetries": 0,"minDelayTarget": 0,"maxDelayTarget": 0,"numMinDelayRetries": 0,"numMaxDelayRetries": 0,"backoffFunction": "linear"}}}'
)
This will update the subscription to use HTTPS as the delivery protocol.That’s it! You have successfully remediated the AWS SNS Subscription that uses HTTP as the delivery protocol using Python.

​
Additional Reading:

⌘I