Back to Checks
aws

SNS subscription uses an HTTPS endpoint

sns_subscription_not_using_http_endpoints
Service: snsSeverity: high
OfficialBuilt-inVerified
Categories:encryption
Resource Type:AwsSnsTopic

Amazon SNS subscriptions are evaluated for endpoint protocol. Subscriptions using http are identified, while HTTPS endpoints indicate encrypted delivery in transit.

Prowler logoProwlerprowler-provider-aws

Risk

Using HTTP leaves SNS deliveries unencrypted, compromising confidentiality via eavesdropping. MITM attackers can modify payloads or headers, damaging integrity, inject malicious content into downstream systems, or capture subscription data for spoofing and unauthorized actions.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks sns_subscription_not_using_http_endpoints

Recommendation

Require HTTPS for all SNS subscription endpoints. Prefer domain-based endpoints, verify SNS message signatures, and apply least privilege. Enforce TLS using IAM conditions like aws:SecureTransport, and use private connectivity (VPC endpoints) where possible for defense in depth.

Remediation

Terraform

# Terraform: Ensure SNS subscription uses HTTPS
resource "aws_sns_topic_subscription" "<example_resource_name>" {
  topic_arn = "<example_resource_id>"
  protocol  = "https"                      # Critical: enforce HTTPS protocol
  endpoint  = "https://<example_endpoint>" # Critical: HTTPS endpoint URL
}

NativeIaC

# CloudFormation: Ensure SNS subscription uses HTTPS
Resources:
  <example_resource_name>:
    Type: AWS::SNS::Subscription
    Properties:
      TopicArn: <example_resource_id>
      Protocol: https              # Critical: use HTTPS protocol to remediate HTTP usage
      Endpoint: https://<example_endpoint>  # Critical: HTTPS endpoint URL

Other

1Open the Amazon SNS console and go to Subscriptions
2Select the subscription with Protocol set to HTTP and click Delete
3Click Create subscription
4Choose the same Topic ARN, set Protocol to HTTPS, and enter your HTTPS endpoint URL
5Create the subscription and confirm it from your endpoint if required

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.sns.sns_client import sns_client


class sns_subscription_not_using_http_endpoints(Check):
    def execute(self):
        findings = []
        for topic in sns_client.topics:
            for subscription in topic.subscriptions:
                if subscription.arn == "PendingConfirmation":
                    continue
                report = Check_Report_AWS(
                    metadata=self.metadata(), resource=subscription
                )
                report.resource_details = topic.arn
                report.status = "PASS"
                report.status_extended = (
                    f"Subscription {subscription.arn} is using an HTTPS endpoint."
                )

                if subscription.protocol == "http":
                    report.status = "FAIL"
                    report.status_extended = (
                        f"Subscription {subscription.arn} is using an HTTP endpoint."
                    )

                findings.append(report)

        return findings

References