Find Public SNS Topics and SQS Queues

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ListRegionsTopicsQueues",
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeRegions",
        "sns:ListTopics",
        "sqs:ListQueues"
      ],
      "Resource": "*"
    },
    {
      "Sid": "ReadPolicies",
      "Effect": "Allow",
      "Action": [
        "sns:GetTopicAttributes",
        "sqs:GetQueueAttributes"
      ],
      "Resource": [
        "arn:aws:sns:*:111122223333:*",
        "arn:aws:sqs:*:111122223333:*"
      ]
    }
  ]
}

// find-public-sns-topics-and-sqs-queues.ts
// Reads the access policy of every SNS topic and SQS queue in each Region and reports Allow statements that
// grant access to everyone (Principal "*" or {"AWS": "*"}) without a condition that narrows it to your
// account, organization, a source ARN or a VPC endpoint. Also flags service principals with no source check.
// Report-only: it never changes a policy.
// Usage: npx tsx find-public-sns-topics-and-sqs-queues.ts [--regions=us-east-1,eu-west-1]
import { EC2Client, DescribeRegionsCommand } from "@aws-sdk/client-ec2";
import { SNSClient, paginateListTopics, GetTopicAttributesCommand } from "@aws-sdk/client-sns";
import { SQSClient, paginateListQueues, GetQueueAttributesCommand } from "@aws-sdk/client-sqs";

const args = process.argv.slice(2);
const regionArg = args.find((a) => a.startsWith("--regions="))?.split("=")[1]?.split(",").map((s) => s.trim()).filter(Boolean);

type Severity = "HIGH" | "MEDIUM";
interface Finding {
  Region: string;
  Type: "SNS" | "SQS";
  Resource: string;
  Sid: string;
  Actions: string;
  Severity: Severity;
  Reason: string;
}
interface Statement {
  Sid?: string;
  Effect?: string;
  Action?: string | string[];
  Principal?: string | Record<string, string | string[]>;
  Condition?: Record<string, Record<string, string | string[]>>;
}

// Condition keys that tie a wildcard principal to specific callers or sources (compared lowercased).
const LIMITING = new Set([
  "aws:sourceowner", "aws:sourceaccount", "aws:sourcearn", "aws:sourceorgid", "aws:sourceorgpaths",
  "aws:principalaccount", "aws:principalarn", "aws:principalorgid", "aws:principalorgpaths",
  "aws:sourcevpce", "aws:sourcevpc", "aws:sourceip",
]);
const SOURCE_KEYS = ["aws:sourcearn", "aws:sourceaccount", "aws:sourceowner", "aws:sourceorgid", "aws:sourceorgpaths"];

const asArray = (v: string | string[] | undefined): string[] => (v === undefined ? [] : Array.isArray(v) ? v : [v]);

// Limiting condition keys whose values are not just "*".
function limitingKeys(st: Statement): string[] {
  const keys: string[] = [];
  for (const block of Object.values(st.Condition ?? {})) {
    for (const [key, value] of Object.entries(block)) {
      const k = key.toLowerCase();
      if (LIMITING.has(k) && asArray(value).some((v) => v !== "*")) keys.push(k);
    }
  }
  return keys;
}

function analyze(policyJson: string | undefined): { sid: string; actions: string; severity: Severity; reason: string }[] {
  if (!policyJson) return [];
  const doc = JSON.parse(policyJson) as { Statement?: Statement | Statement[] };
  const statements = Array.isArray(doc.Statement) ? doc.Statement : doc.Statement ? [doc.Statement] : [];
  const out: { sid: string; actions: string; severity: Severity; reason: string }[] = [];

  statements.forEach((st, i) => {
    if (st.Effect !== "Allow") return;
    const sid = st.Sid ?? `#${i}`;
    const actions = asArray(st.Action).join(",") || "?";
    const limits = limitingKeys(st);
    const aws = st.Principal === "*" ? ["*"] : typeof st.Principal === "object" ? asArray(st.Principal.AWS) : [];
    const services = typeof st.Principal === "object" ? asArray(st.Principal.Service) : [];

    if (aws.includes("*") && limits.length === 0) {
      out.push({ sid, actions, severity: "HIGH", reason: "Principal * with no limiting condition" });
    } else if (services.length && !limits.some((k) => SOURCE_KEYS.includes(k))) {
      out.push({ sid, actions, severity: "MEDIUM", reason: `${services.join(",")} without aws:SourceArn/SourceAccount` });
    }
  });
  return out;
}

async function listRegions(): Promise<string[]> {
  if (regionArg) return regionArg;
  const out = await new EC2Client({}).send(new DescribeRegionsCommand({}));
  return (out.Regions ?? []).map((r) => r.RegionName ?? "").filter(Boolean).sort();
}

async function scanRegion(region: string, findings: Finding[]): Promise<number> {
  let count = 0;
  const sns = new SNSClient({ region });
  for await (const page of paginateListTopics({ client: sns }, {})) {
    for (const t of page.Topics ?? []) {
      if (!t.TopicArn) continue;
      count++;
      try {
        const attrs = (await sns.send(new GetTopicAttributesCommand({ TopicArn: t.TopicArn }))).Attributes ?? {};
        for (const f of analyze(attrs.Policy)) {
          findings.push({ Region: region, Type: "SNS", Resource: t.TopicArn.split(":").pop() ?? t.TopicArn, Sid: f.sid, Actions: f.actions, Severity: f.severity, Reason: f.reason });
        }
      } catch (err) {
        console.error(`${region} SNS ${t.TopicArn}: ${err instanceof Error ? err.name : String(err)}`);
      }
    }
  }

  const sqs = new SQSClient({ region });
  for await (const page of paginateListQueues({ client: sqs }, { MaxResults: 1000 })) {
    for (const url of page.QueueUrls ?? []) {
      count++;
      try {
        const attrs = (await sqs.send(new GetQueueAttributesCommand({ QueueUrl: url, AttributeNames: ["Policy"] }))).Attributes ?? {};
        for (const f of analyze(attrs.Policy)) {
          findings.push({ Region: region, Type: "SQS", Resource: url.split("/").pop() ?? url, Sid: f.sid, Actions: f.actions, Severity: f.severity, Reason: f.reason });
        }
      } catch (err) {
        console.error(`${region} SQS ${url}: ${err instanceof Error ? err.name : String(err)}`);
      }
    }
  }
  return count;
}

async function main(): Promise<void> {
  const findings: Finding[] = [];
  let scanned = 0;
  for (const region of await listRegions()) {
    try {
      scanned += await scanRegion(region, findings);
    } catch (err) {
      console.error(`${region}: ${err instanceof Error ? err.name : String(err)}`);
    }
  }
  findings.sort((a, b) => a.Severity.localeCompare(b.Severity) || a.Region.localeCompare(b.Region));
  console.table(findings);
  const high = findings.filter((f) => f.Severity === "HIGH").length;
  console.log(`${scanned} topic(s) and queue(s) checked; ${findings.length} finding(s), ${high} HIGH.`);
  if (high) process.exitCode = 2;
}

main().catch((err) => {
  console.error(err instanceof Error ? `${err.name}: ${err.message}` : err);
  process.exit(1);
});

npm install @aws-sdk/client-sns @aws-sdk/client-sqs @aws-sdk/client-ec2
npm install --save-dev tsx typescript

# Every enabled Region
AWS_PROFILE=security-audit npx tsx find-public-sns-topics-and-sqs-queues.ts

# Two Regions only
AWS_PROFILE=security-audit npx tsx find-public-sns-topics-and-sqs-queues.ts --regions=us-east-1,eu-west-1

┌─────────┬─────────────┬───────┬──────────────────┬──────────────────┬─────────────────────────────┬──────────┬────────────────────────────────────────────────────────┐
│ (index) │ Region      │ Type  │ Resource         │ Sid              │ Actions                     │ Severity │ Reason                                                 │
├─────────┼─────────────┼───────┼──────────────────┼──────────────────┼─────────────────────────────┼──────────┼────────────────────────────────────────────────────────┤
│ 0       │ 'eu-west-1' │ 'SQS' │ 'legacy-import'  │ '#0'             │ 'sqs:*'                     │ 'HIGH'   │ 'Principal * with no limiting condition'               │
│ 1       │ 'us-east-1' │ 'SNS' │ 'order-events'   │ 'AllowSubscribe' │ 'SNS:Subscribe,SNS:Receive' │ 'HIGH'   │ 'Principal * with no limiting condition'               │
│ 2       │ 'us-east-1' │ 'SQS' │ 'webhook-intake' │ 'PublicSend'     │ 'sqs:SendMessage'           │ 'HIGH'   │ 'Principal * with no limiting condition'               │
│ 3       │ 'us-east-1' │ 'SNS' │ 'bucket-uploads' │ 'S3Publish'      │ 'SNS:Publish'               │ 'MEDIUM' │ 's3.amazonaws.com without aws:SourceArn/SourceAccount' │
└─────────┴─────────────┴───────┴──────────────────┴──────────────────┴─────────────────────────────┴──────────┴────────────────────────────────────────────────────────┘
87 topic(s) and queue(s) checked; 4 finding(s), 3 HIGH.