SNS
Amazon Simple Notification Service (SNS) delivers messages from a topic to its subscribers: email addresses, HTTPS endpoints, queues or functions. The AWS Baseline uses a single topic in the security account as the place every security alert lands.
What it does
A publisher writes a message to a topic. SNS fans it out to every subscription on that topic. Publishing is an IAM action, so a topic policy decides which services and accounts may write to it. Topics can be encrypted with KMS.
How BuiltForProd uses it
The security-remediation unit in the security account creates the topic acme-security-alerts with two design choices:
- Encryption with the AWS-managed SNS key by default, or a customer key if you provide one.
- A topic policy that lets the EventBridge service and the CloudWatch service publish, and nothing else.
One email subscription is created when security_alert_email is set in environments/core/security/security.hcl. Leave it empty and the topic exists with no subscriber; the subscription is the one thing on the alerting path a customer must fill in.
Two producers publish to the topic:
| Producer | Unit | What arrives |
|---|---|---|
| EventBridge rules | security-remediation | GuardDuty findings of severity 7 or higher; Security Hub findings for open security groups; AWS Config non-compliance for unencrypted volumes and unrotated access keys |
| CIS CloudWatch alarms | cis-alarms | Root account use, unauthorized API calls, console sign-in failures, IAM policy changes, CloudTrail changes, S3 bucket policy changes and VPC changes |
The alarms are worth a note. The CIS metric filters run in the management account, where the organization CloudTrail log group is, but the alarms live in the security account and read those metrics across accounts through the CloudWatch OAM link. The cis-alarms unit takes the topic ARN as a dependency output of security-remediation, so there is exactly one topic and no duplicate to drift.
Terms you will see
| Term | Meaning |
|---|---|
| Topic | The named channel messages are published to. |
| Subscription | One delivery target on a topic, such as an email address. |
| Topic policy | The resource policy that lists who may publish. |
| Alarm action | The CloudWatch alarm setting that publishes to a topic when the alarm fires. |
| Fan-out | One message delivered to every subscriber. |
Where to read more
- AWS Baseline overview
- EventBridge for the rules that publish
- CloudWatch for the CIS alarms
- GuardDuty for the findings that start the chain