AWS sns

eventName	Description	Sample	Rule
any	Catch-all entry for AWS sns rules that match the service but not a specific eventName.	N	N
CreateTopic	Creates an SNS topic and returns its ARN; if the topic already exists, returns the ARN of the existing topic without modifying it.	Y	Y
Publish	Sends a message to an SNS topic, triggering delivery to all subscribed endpoints, or directly to a single endpoint such as an SQS queue, HTTP endpoint, or mobile device.	Y	Y
Subscribe	Subscribes an endpoint to an SNS topic; delivery of messages begins after the endpoint owner confirms the subscription.	Y	Y
AddPermission	Adds a statement to a topic's access control policy, granting access for the specified Amazon Web Services accounts to the specified actions.	Y	N
CheckIfPhoneNumberIsOptedOut	Accepts a phone number and indicates whether the phone holder has opted out of receiving SMS messages from your Amazon Web Services account.	Y	N
ConfirmSubscription	Verifies an endpoint owner's intent to receive messages by validating the token sent to the endpoint by an earlier Subscribe action.	Y	N
CreatePlatformApplication	Creates a platform application object for one of the supported push notification services, such as APNS and GCM (Firebase Cloud Messaging), to which devices and mobile apps may register.	Y	N
CreatePlatformEndpoint	Creates an endpoint for a device and mobile app on one of the supported push notification services, such as GCM (Firebase Cloud Messaging) and APNS.	N	N
CreateSMSSandboxPhoneNumber	Adds a destination phone number to an Amazon Web Services account in the SMS sandbox and sends a one-time password (OTP) to that phone number.	N	N
DeleteEndpoint	Deletes the endpoint for a device and mobile app from Amazon SNS.	N	N
DeletePlatformApplication	Deletes a platform application object for one of the supported push notification services, such as APNS and GCM (Firebase Cloud Messaging).	N	N
DeleteSMSSandboxPhoneNumber	Deletes an Amazon Web Services account's verified or pending phone number from the SMS sandbox.	N	N
DeleteTopic	Deletes a topic and all its subscriptions.	Y	N
GetDataProtectionPolicy	Retrieves the specified inline DataProtectionPolicy document that is stored in the specified Amazon SNS topic.	N	N
GetEndpointAttributes	Retrieves the endpoint attributes for a device on one of the supported push notification services, such as GCM (Firebase Cloud Messaging) and APNS.	N	N
GetPlatformApplicationAttributes	Retrieves the attributes of the platform application object for the supported push notification services, such as APNS and GCM (Firebase Cloud Messaging).	N	N
GetSMSAttributes	Returns the settings for sending SMS messages from your Amazon Web Services account.	Y	N
GetSMSSandboxAccountStatus	Retrieves the SMS sandbox status for the calling Amazon Web Services account in the target Amazon Web Services Region.	Y	N
GetSubscriptionAttributes	Returns all of the properties of a subscription.	N	N
GetTopicAttributes	Returns all of the properties of a topic.	Y	N
ListEndpointsByPlatformApplication	Lists the endpoints and endpoint attributes for devices in a supported push notification service, such as GCM (Firebase Cloud Messaging) and APNS.	N	N
ListOriginationNumbers	Lists the calling Amazon Web Services account's dedicated origination numbers and their metadata.	Y	N
ListPhoneNumbersOptedOut	Returns a list of phone numbers that are opted out, meaning you cannot send SMS messages to them.	Y	N
ListPlatformApplications	Lists the platform application objects for the supported push notification services, such as APNS and GCM (Firebase Cloud Messaging).	Y	N
ListSMSSandboxPhoneNumbers	Lists the calling Amazon Web Services account's current verified and pending destination phone numbers in the SMS sandbox.	Y	N
ListSubscriptions	Returns a list of the requester's subscriptions.	Y	N
ListSubscriptionsByTopic	Returns a list of the subscriptions to a specific topic.	N	N
ListTagsForResource	List all tags added to the specified Amazon SNS topic.	N	N
ListTopics	Returns a list of the requester's topics.	Y	N
OptInPhoneNumber	Use this request to opt in a phone number that is opted out, which enables you to resume sending SMS messages to the number.	N	N
PublishBatch	Publishes up to 10 messages to the specified topic in a single batch.	N	N
PutDataProtectionPolicy	Adds or updates an inline policy document that is stored in the specified Amazon SNS topic.	N	N
RemovePermission	Removes a statement from a topic's access control policy.	Y	N
SetEndpointAttributes	Sets the attributes for an endpoint for a device on one of the supported push notification services, such as GCM (Firebase Cloud Messaging) and APNS.	N	N
SetPlatformApplicationAttributes	Sets the attributes of the platform application object for the supported push notification services, such as APNS and GCM (Firebase Cloud Messaging).	N	N
SetSMSAttributes	Use this request to set the default settings for sending SMS messages and receiving daily SMS usage reports.	Y	N
SetSubscriptionAttributes	Allows a subscription owner to set an attribute of the subscription to a new value.	Y	N
SetTopicAttributes	Allows a topic owner to set an attribute of the topic to a new value.	Y	Y
TagResource	Add tags to the specified Amazon SNS topic.	Y	N
Unsubscribe	Deletes a subscription.	Y	N
UntagResource	Remove tags from the specified Amazon SNS topic.	Y	N
VerifySMSSandboxPhoneNumber	Verifies a destination phone number with a one-time password (OTP) for the calling Amazon Web Services account.	N	N

any: AWS sns (catch-all)

Service: sns

Description

Catch-all entry for AWS sns rules that match the service but not a specific eventName.

CreateTopic

Service: sns

Description

Creates an SNS topic and returns its ARN; if the topic already exists, returns the ARN of the existing topic without modifying it.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "userIdentity": {
    "type": "Root",
    "principalId": "123456789012",
    "arn": "arn:aws:iam::123456789012:root",
    "accountId": "123456789012",
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE"
  },
  "eventTime": "2026-07-28T21:00:12Z",
  "eventSource": "sns.amazonaws.com",
  "eventName": "CreateTopic",
  "awsRegion": "us-west-1",
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "aws-cli/2.34.28 md/awscrt#0.31.2 ua/2.1 os/linux#6.1.0-51-amd64 md/arch#x86_64 lang/python#3.14.3 md/pyimpl#CPython m/Z,E,n,b cfg/retry-mode#standard md/installer#exe md/distrib#debian.12 md/prompt#off md/command#sns.create-topic",
  "requestParameters": {
    "name": "dw-harn-sns-eb786637"
  },
  "responseElements": {
    "topicArn": "arn:aws:sns:us-west-1:123456789012:dw-harn-sns-eb786637"
  },
  "requestID": "0a989c64-3a41-5cea-a078-fe8720dd23a1",
  "eventID": "80172f19-eab6-4763-8fa6-7b09da53c83b",
  "readOnly": false,
  "eventType": "AwsApiCall",
  "managementEvent": true,
  "recipientAccountId": "123456789012",
  "eventCategory": "Management",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "sns.us-west-1.amazonaws.com"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

AWS SNS Topic Created by Rare User source low: Identifies when an SNS topic is created by a user who does not typically perform this action. Adversaries may create SNS topics to stage capabilities for data exfiltration or other malicious activities. This is a New Terms rule that only flags when this behavior is observed for the first time by a user or role.T1496, T1496.004, T1608

Publish

Service: sns

Description

Sends a message to an SNS topic, triggering delivery to all subscribed endpoints, or directly to a single endpoint such as an SQS queue, HTTP endpoint, or mobile device.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "userIdentity": {
    "type": "Root",
    "principalId": "123456789012",
    "arn": "arn:aws:iam::123456789012:root",
    "accountId": "123456789012",
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE"
  },
  "eventTime": "2026-07-28T21:00:17Z",
  "eventSource": "sns.amazonaws.com",
  "eventName": "Publish",
  "awsRegion": "us-west-1",
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "aws-cli/2.34.28 md/awscrt#0.31.2 ua/2.1 os/linux#6.1.0-51-amd64 md/arch#x86_64 lang/python#3.14.3 md/pyimpl#CPython m/Z,E,n,b cfg/retry-mode#standard md/installer#exe md/distrib#debian.12 md/prompt#off md/command#sns.publish",
  "requestParameters": {
    "topicArn": "arn:aws:sns:us-west-1:123456789012:dw-harn-sns-eb786637",
    "message": "HIDDEN_DUE_TO_SECURITY_REASONS"
  },
  "responseElements": {
    "messageId": "ebc2d3c1-3621-5ee0-8d04-b1222c80ae8c"
  },
  "requestID": "17e5fe3a-fcd5-57ed-9988-9cd9e6744781",
  "eventID": "cc2ed12f-e2bd-49f3-9519-d111c7b6a6c7",
  "readOnly": false,
  "resources": [
    {
      "accountId": "123456789012",
      "type": "AWS::SNS::Topic",
      "ARN": "arn:aws:sns:us-west-1:123456789012:dw-harn-sns-eb786637"
    }
  ],
  "eventType": "AwsApiCall",
  "managementEvent": false,
  "recipientAccountId": "123456789012",
  "eventCategory": "Data",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "sns.us-west-1.amazonaws.com"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

AWS SNS Topic Message Publish by Rare User source high: Identifies when an SNS topic message is published by a rare user in AWS. Adversaries may publish messages to SNS topics for phishing campaigns, data exfiltration, or lateral movement within the AWS environment. SNS topics are used to send notifications and messages to subscribed endpoints such as applications, mobile devices or email addresses, making them a valuable target for adversaries to distribute malicious content or exfiltrate sensitive data. This is a New Terms rule that only flags when this behavior is observed for the first time by a user or role.T1102, T1496, T1496.004, T1534, T1567

Service: sns

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "fdacd2d1-4094-4326-a117-2bc5f5a03119",
  "eventName": "Subscribe",
  "eventSource": "sns.amazonaws.com",
  "eventTime": "2026-06-29T19:11:55Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "fa22846a-159e-5725-a4ec-e6d6d025bbe9",
  "requestParameters": {
    "endpoint": "REDACTED",
    "protocol": "email",
    "returnSubscriptionArn": false,
    "topicArn": "arn:aws:sns:us-west-1:123456789012:dwfix-topic"
  },
  "resources": [
    {
      "ARN": "arn:aws:sns:us-west-1:123456789012:dwfix-topic",
      "accountId": "123456789012",
      "type": "AWS::SNS::Topic"
    }
  ],
  "responseElements": {
    "subscriptionArn": "pending confirmation"
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "sns.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,n,b,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

AddPermission

Service: sns

Description

Adds a statement to a topic's access control policy, granting access for the specified Amazon Web Services accounts to the specified actions.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "06cbda0a-82fb-4b87-b8cd-ca83cf132eb4",
  "eventName": "AddPermission",
  "eventSource": "sns.amazonaws.com",
  "eventTime": "2026-06-29T19:11:55Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "159aef83-5557-5552-96db-8d3f90ec799e",
  "requestParameters": {
    "aWSAccountId": [
      "123456789012"
    ],
    "actionName": [
      "Publish"
    ],
    "label": "dw",
    "topicArn": "arn:aws:sns:us-west-1:123456789012:dwfix-topic"
  },
  "resources": [
    {
      "ARN": "arn:aws:sns:us-west-1:123456789012:dwfix-topic",
      "accountId": "123456789012",
      "type": "AWS::SNS::Topic"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "sns.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,n,b,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

CheckIfPhoneNumberIsOptedOut

Service: sns

Description

Accepts a phone number and indicates whether the phone holder has opted out of receiving SMS messages from your Amazon Web Services account.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "InvalidParameterException",
  "errorMessage": "Invalid parameter: PhoneNumber Reason: input incorrectly formatted",
  "eventCategory": "Management",
  "eventID": "5804a2a0-fd25-4ffa-91c1-7d57943dd222",
  "eventName": "CheckIfPhoneNumberIsOptedOut",
  "eventSource": "sns.amazonaws.com",
  "eventTime": "2026-06-29T18:46:10Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "c135464c-ed70-5fbf-9ebc-24f052c2d04b",
  "requestParameters": {
    "phoneNumber": "HIDDEN_DUE_TO_SECURITY_REASONS"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "sns.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ConfirmSubscription

Service: sns

Description

Verifies an endpoint owner's intent to receive messages by validating the token sent to the endpoint by an earlier Subscribe action.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "InvalidParameterException",
  "errorMessage": "Invalid parameter: Token",
  "eventCategory": "Management",
  "eventID": "b2e9d522-9405-4ed2-a428-f55d9d94290e",
  "eventName": "ConfirmSubscription",
  "eventSource": "sns.amazonaws.com",
  "eventTime": "2026-06-29T20:58:49Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "6f84e391-f891-5ab8-91f3-812d2658f4e9",
  "requestParameters": {
    "token": "REDACTED",
    "topicArn": "arn:aws:sns:us-west-1:123456789012:dwfix-sns-d26d331a"
  },
  "resources": [
    {
      "ARN": "arn:aws:sns:us-west-1:123456789012:dwfix-sns-d26d331a",
      "accountId": "123456789012",
      "type": "AWS::SNS::Topic"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "sns.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

CreatePlatformApplication

Service: sns

Description

Creates a platform application object for one of the supported push notification services, such as APNS and GCM (Firebase Cloud Messaging), to which devices and mobile apps may register.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "InvalidParameterException",
  "errorMessage": "Invalid parameter: Attributes Reason: Platform credentials are invalid",
  "eventCategory": "Management",
  "eventID": "0e01b2c0-f06f-4803-8057-68d9fae52d49",
  "eventName": "CreatePlatformApplication",
  "eventSource": "sns.amazonaws.com",
  "eventTime": "2026-06-29T20:58:49Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "38d82d79-2f75-5616-9c8e-4fc5f1bc3847",
  "requestParameters": {
    "attributes": {
      "PlatformCredential": "REDACTED"
    },
    "name": "dwfix-sns-d26d331a",
    "platform": "GCM"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "sns.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

CreatePlatformEndpoint

Service: sns

Description

Creates an endpoint for a device and mobile app on one of the supported push notification services, such as GCM (Firebase Cloud Messaging) and APNS.

CreateSMSSandboxPhoneNumber

Service: sns

Description

Adds a destination phone number to an Amazon Web Services account in the SMS sandbox and sends a one-time password (OTP) to that phone number.

DeleteEndpoint

Service: sns

Description

Deletes the endpoint for a device and mobile app from Amazon SNS.

DeletePlatformApplication

Service: sns

Description

Deletes a platform application object for one of the supported push notification services, such as APNS and GCM (Firebase Cloud Messaging).

DeleteSMSSandboxPhoneNumber

Service: sns

Description

Deletes an Amazon Web Services account's verified or pending phone number from the SMS sandbox.

DeleteTopic

Service: sns

Description

Deletes a topic and all its subscriptions.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "125792d5-7dc1-46a8-a03f-77139bdb7ad7",
  "eventName": "DeleteTopic",
  "eventSource": "sns.amazonaws.com",
  "eventTime": "2026-06-29T19:11:55Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "749e214a-90bf-50a2-a364-43f655049c6e",
  "requestParameters": {
    "topicArn": "arn:aws:sns:us-west-1:123456789012:dwfix-topic"
  },
  "resources": [
    {
      "ARN": "arn:aws:sns:us-west-1:123456789012:dwfix-topic",
      "accountId": "123456789012",
      "type": "AWS::SNS::Topic"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "sns.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,n,b,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetDataProtectionPolicy

Service: sns

Description

Retrieves the specified inline DataProtectionPolicy document that is stored in the specified Amazon SNS topic.

Example CloudTrail Event #

This is a projected export row, not a complete CloudTrail record: it shows only the envelope columns a SIEM export retained. The export never carried userIdentity, requestParameters, responseElements, sourceIPAddress, recipientAccountId, eventCategory, so their absence here says nothing about the real event. Account identifiers, ARNs and endpoint hostnames in eventID, requestID, resources, tlsDetails, userAgent are replaced with the placeholders AWS uses in its own documentation, so those values are structurally real but not the originals. errorMessage is withheld: it is free-form prose that names customer resources, which no substitution rule can find reliably. eventTime is withheld because the export renders it in the exporting system's local timezone rather than the UTC a CloudTrail record carries.

{
  "eventVersion": "1.11",
  "eventID": "38cc58e7-d0ac-48fd-8667-356e80e9bb1f",
  "eventSource": "sns.amazonaws.com",
  "eventName": "GetDataProtectionPolicy",
  "awsRegion": "us-east-1",
  "eventType": "AwsApiCall",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "bd017557-d8df-504d-afbf-17b452c61ef8",
  "userAgent": "aws-sdk-go-v2/1.43.0 ua/2.1 os/linux lang/go#1.26.5 md/GOOS#linux md/GOARCH#arm64 api/sns#1.39.13 m/E,i",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "sns.us-east-1.amazonaws.com"
  },
  "resources": [
    {
      "accountId": "123456789012",
      "type": "AWS::SNS::Topic",
      "ARN": "arn:aws:sns:us-east-1:123456789012:EXAMPLE"
    }
  ]
}

GetEndpointAttributes

Service: sns

Description

Retrieves the endpoint attributes for a device on one of the supported push notification services, such as GCM (Firebase Cloud Messaging) and APNS.

GetPlatformApplicationAttributes

Service: sns

Description

Retrieves the attributes of the platform application object for the supported push notification services, such as APNS and GCM (Firebase Cloud Messaging).

GetSMSAttributes

Service: sns

Description

Returns the settings for sending SMS messages from your Amazon Web Services account.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "errorCode": "AccessDenied",
  "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: SNS:GetSMSAttributes on resource: arn:aws:sns:us-east-1:811596193553:*",
  "eventID": "404218-97b2-45dc-8016-a4ff9dc7b790",
  "eventName": "GetSMSAttributes",
  "eventSource": "sns.amazonaws.com",
  "eventTime": "2018-10-21T16:28:40Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.05",
  "recipientAccountId": "811596193553",
  "requestID": "3716ceba-1b2b-5b6d-b453-9afcb194113d3",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "9.245.1.85",
  "userAgent": "Boto3/1.7.4 Python/3.6.6 Linux/4.16.0-kali2-amd64 Botocore/1.10.4",
  "userIdentity": {
    "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD",
    "accountId": "811596193553",
    "arn": "arn:aws:iam::811596193553:user/Level6",
    "principalId": "AIDADO2GQD0K8TEF7KW1V",
    "type": "IAMUser",
    "userName": "Level6"
  }
}

References #

Sample log: flaws.cloud CloudTrail training logs

GetSMSSandboxAccountStatus

Service: sns

Description

Retrieves the SMS sandbox status for the calling Amazon Web Services account in the target Amazon Web Services Region.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "2d2bd44c-1485-46b6-846c-5f5c6ef77ec3",
  "eventName": "GetSMSSandboxAccountStatus",
  "eventSource": "sns.amazonaws.com",
  "eventTime": "2026-06-29T18:32:45Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "10422a0b-75e5-57b9-bc16-48b7c968e556",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "sns.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetSubscriptionAttributes

Service: sns

Description

Returns all of the properties of a subscription.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "eventID": "b3fc1c0a-a792-4463-a141-b1d0707d8b2c",
  "eventSource": "sns.amazonaws.com",
  "eventName": "GetSubscriptionAttributes",
  "awsRegion": "us-east-2",
  "eventType": "AwsApiCall",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "d647c32a-e839-58c9-82ee-a1c9ec2ebca1",
  "userAgent": "APN/1.0 HashiCorp/1.0 Terraform/1.15.5 (+https://www.terraform.io) terraform-provider-aws/6.50.0 (+https://registry.terraform.io/providers/hashicorp/aws) aws-sdk-go-v2/1.42.0 ua/2.1 os/linux lang/go#1.26.3 md/GOOS#linux md/GOARCH#arm64 api/sns#1.40.1 m/g",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "sns.us-east-2.amazonaws.com"
  },
  "resources": [
    {
      "accountId": "123456789012",
      "type": "AWS::SNS::PlatformEndpoint",
      "ARN": "arn:aws:sns:us-east-2:123456789012:guardduty-events:EXAMPLE"
    }
  ]
}

GetTopicAttributes

Service: sns

Description

Returns all of the properties of a topic.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "userIdentity": {
    "type": "Root",
    "principalId": "123456789012",
    "arn": "arn:aws:iam::123456789012:root",
    "accountId": "123456789012",
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE"
  },
  "eventTime": "2026-07-28T20:00:03Z",
  "eventSource": "sns.amazonaws.com",
  "eventName": "GetTopicAttributes",
  "awsRegion": "us-west-1",
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "aws-cli/2.34.28 md/awscrt#0.31.2 ua/2.1 os/linux#6.1.0-51-amd64 md/arch#x86_64 lang/python#3.14.3 md/pyimpl#CPython m/Z,E,n,b cfg/retry-mode#standard md/installer#exe md/distrib#debian.12 md/prompt#off md/command#sns.get-topic-attributes",
  "requestParameters": {
    "topicArn": "arn:aws:sns:us-west-1:123456789012:dw-harn-sns-bf42d165"
  },
  "responseElements": null,
  "requestID": "3dade640-4f6c-50a3-b0cc-84a343ef28ad",
  "eventID": "d2dc677d-8459-4c3f-87c6-d47d0ef25c9c",
  "readOnly": true,
  "resources": [
    {
      "accountId": "123456789012",
      "type": "AWS::SNS::Topic",
      "ARN": "arn:aws:sns:us-west-1:123456789012:dw-harn-sns-bf42d165"
    }
  ],
  "eventType": "AwsApiCall",
  "managementEvent": true,
  "recipientAccountId": "123456789012",
  "eventCategory": "Management",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "sns.us-west-1.amazonaws.com"
  }
}

ListEndpointsByPlatformApplication

Service: sns

Description

Lists the endpoints and endpoint attributes for devices in a supported push notification service, such as GCM (Firebase Cloud Messaging) and APNS.

ListOriginationNumbers

Service: sns

Description

Lists the calling Amazon Web Services account's dedicated origination numbers and their metadata.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "76eddb2f-e3b7-4e56-b44a-6a3906565c6f",
  "eventName": "ListOriginationNumbers",
  "eventSource": "sns.amazonaws.com",
  "eventTime": "2026-06-29T18:32:45Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "f72f44c6-7c7e-5857-b150-267ac0f3eab8",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "sns.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListPhoneNumbersOptedOut

Service: sns

Description

Returns a list of phone numbers that are opted out, meaning you cannot send SMS messages to them.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "errorCode": "AccessDenied",
  "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: SNS:ListPhoneNumbersOptedOut on resource: arn:aws:sns:us-east-1:811596193553:*",
  "eventID": "83d82ad3-6ec5-4546-9ded-3386c9faeb55",
  "eventName": "ListPhoneNumbersOptedOut",
  "eventSource": "sns.amazonaws.com",
  "eventTime": "2018-10-17T20:32:01Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.05",
  "recipientAccountId": "811596193553",
  "requestID": "5e6403f0-5d1b-579f-aae0-57b1c39a05dd",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "9.245.1.85",
  "userAgent": "Botocore/1.12.25 Python/2.7.15 Linux/4.16.0-kali2-amd64",
  "userIdentity": {
    "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD",
    "accountId": "811596193553",
    "arn": "arn:aws:iam::811596193553:user/Level6",
    "principalId": "AIDADO2GQD0K8TEF7KW1V",
    "type": "IAMUser",
    "userName": "Level6"
  }
}

References #

Sample log: flaws.cloud CloudTrail training logs

ListPlatformApplications

Service: sns

Description

Lists the platform application objects for the supported push notification services, such as APNS and GCM (Firebase Cloud Messaging).

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "errorCode": "AccessDenied",
  "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: SNS:ListPlatformApplications on resource: arn:aws:sns:us-east-1:811596193553:*",
  "eventID": "13fa62b8-021c-4d98-b6b9-550823f3347f5",
  "eventName": "ListPlatformApplications",
  "eventSource": "sns.amazonaws.com",
  "eventTime": "2018-10-17T20:32:01Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.05",
  "recipientAccountId": "811596193553",
  "requestID": "33b995483-9b98-5586-bbaf-06cbaa7ac68c",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "9.245.1.85",
  "userAgent": "Botocore/1.12.25 Python/2.7.15 Linux/4.16.0-kali2-amd64",
  "userIdentity": {
    "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD",
    "accountId": "811596193553",
    "arn": "arn:aws:iam::811596193553:user/Level6",
    "principalId": "AIDADO2GQD0K8TEF7KW1V",
    "type": "IAMUser",
    "userName": "Level6"
  }
}

References #

Sample log: flaws.cloud CloudTrail training logs

ListSMSSandboxPhoneNumbers

Service: sns

Description

Lists the calling Amazon Web Services account's current verified and pending destination phone numbers in the SMS sandbox.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "c1c85e6e-f475-47d7-826a-9961860d93f8",
  "eventName": "ListSMSSandboxPhoneNumbers",
  "eventSource": "sns.amazonaws.com",
  "eventTime": "2026-06-29T18:32:45Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "0355efbd-9277-5843-b905-8d012efa3aac",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "sns.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListSubscriptions

Service: sns

Description

Returns a list of the requester's subscriptions.

Example CloudTrail Event #

{
  "awsRegion": "us-west-2",
  "errorCode": "AccessDenied",
  "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: SNS:ListSubscriptions on resource: arn:aws:sns:us-west-2:811596193553:*",
  "eventID": "419cc92a-27ca-4b54-aa68-cc448bb244585",
  "eventName": "ListSubscriptions",
  "eventSource": "sns.amazonaws.com",
  "eventTime": "2017-03-01T17:21:05Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.04",
  "recipientAccountId": "811596193553",
  "requestID": "a1840f3f-7c59-5547-bf48-5e0e7918f330",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "3.239.132.95",
  "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-34-generic botocore/1.4.70",
  "userIdentity": {
    "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD",
    "accountId": "811596193553",
    "arn": "arn:aws:iam::811596193553:user/Level6",
    "principalId": "AIDADO2GQD0K8TEF7KW1V",
    "type": "IAMUser",
    "userName": "Level6"
  }
}

References #

Sample log: flaws.cloud CloudTrail training logs

ListSubscriptionsByTopic

Service: sns

Description

Returns a list of the subscriptions to a specific topic.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "eventID": "d735526e-ed59-45ab-ba64-0a6372059b09",
  "eventSource": "sns.amazonaws.com",
  "eventName": "ListSubscriptionsByTopic",
  "awsRegion": "us-east-1",
  "eventType": "AwsApiCall",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "5b3ba402-c687-5df8-b6a2-c6e14f0cec4c",
  "userAgent": "aws-sdk-java/2.38.4 md/io#async md/http#NettyNio ua/2.1 api/SNS#2.38.x os/Linux#5.4.0-1160-aws-fips lang/java#21.0.11 md/Java_HotSpot_TM__64-Bit_Server_VM#21.0.11+9-LTS-jvmci-23.1-b92 md/vendor#Oracle_Corporation md/en_US md/scala/2.12.20-bin-db-6-dda2050 md/kotlin m/D,N",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "example.us-east-1.amazonaws.com"
  },
  "resources": [
    {
      "accountId": "123456789012",
      "type": "AWS::SNS::Topic",
      "ARN": "arn:aws:sns:us-east-1:123456789012:EXAMPLE"
    }
  ]
}

ListTagsForResource

Service: sns

Description

List all tags added to the specified Amazon SNS topic.

ListTopics

Service: sns

Description

Returns a list of the requester's topics.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "userIdentity": {
    "type": "Root",
    "principalId": "123456789012",
    "arn": "arn:aws:iam::123456789012:root",
    "accountId": "123456789012",
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE"
  },
  "eventTime": "2026-07-28T21:00:18Z",
  "eventSource": "sns.amazonaws.com",
  "eventName": "ListTopics",
  "awsRegion": "us-west-1",
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "aws-cli/2.34.28 md/awscrt#0.31.2 ua/2.1 os/linux#6.1.0-51-amd64 md/arch#x86_64 lang/python#3.14.3 md/pyimpl#CPython m/n,Z,E,C,b cfg/retry-mode#standard md/installer#exe md/distrib#debian.12 md/prompt#off md/command#sns.list-topics",
  "requestParameters": null,
  "responseElements": null,
  "requestID": "7801e70e-56ff-5c2d-a714-85ed4c5d9700",
  "eventID": "b4107fa0-d154-47c0-9826-96ea5c46b2c7",
  "readOnly": true,
  "eventType": "AwsApiCall",
  "managementEvent": true,
  "recipientAccountId": "123456789012",
  "eventCategory": "Management",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "sns.us-west-1.amazonaws.com"
  }
}

OptInPhoneNumber

Service: sns

Description

Use this request to opt in a phone number that is opted out, which enables you to resume sending SMS messages to the number.

PublishBatch

Service: sns

Description

Publishes up to 10 messages to the specified topic in a single batch.

PutDataProtectionPolicy

Service: sns

Description

Adds or updates an inline policy document that is stored in the specified Amazon SNS topic.

RemovePermission

Service: sns

Description

Removes a statement from a topic's access control policy.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "d0845b3f-3034-4221-8286-fa1adc0c4b71",
  "eventName": "RemovePermission",
  "eventSource": "sns.amazonaws.com",
  "eventTime": "2026-06-29T19:11:55Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "4633aff4-28d1-51d7-aaa5-cd48ed6abd1b",
  "requestParameters": {
    "label": "dw",
    "topicArn": "arn:aws:sns:us-west-1:123456789012:dwfix-topic"
  },
  "resources": [
    {
      "ARN": "arn:aws:sns:us-west-1:123456789012:dwfix-topic",
      "accountId": "123456789012",
      "type": "AWS::SNS::Topic"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "sns.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,n,b,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

SetEndpointAttributes

Service: sns

Description

Sets the attributes for an endpoint for a device on one of the supported push notification services, such as GCM (Firebase Cloud Messaging) and APNS.

SetPlatformApplicationAttributes

Service: sns

Description

Sets the attributes of the platform application object for the supported push notification services, such as APNS and GCM (Firebase Cloud Messaging).

SetSMSAttributes

Service: sns

Description

Use this request to set the default settings for sending SMS messages and receiving daily SMS usage reports.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "6bd2bd36-6f7c-49d6-a063-814ae7192c91",
  "eventName": "SetSMSAttributes",
  "eventSource": "sns.amazonaws.com",
  "eventTime": "2026-06-29T20:58:49Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "3455b92b-0575-5092-81f3-db97dbbc8ec3",
  "requestParameters": {
    "attributes": {
      "DefaultSMSType": "Promotional"
    }
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "sns.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

SetSubscriptionAttributes

Service: sns

Description

Allows a subscription owner to set an attribute of the subscription to a new value.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "423c912f-1035-4ca1-ab12-a84567f9ef2e",
  "eventName": "SetSubscriptionAttributes",
  "eventSource": "sns.amazonaws.com",
  "eventTime": "2026-06-29T20:58:49Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "c1fbd9ec-1318-5147-bdbd-bb50cdd1ef16",
  "requestParameters": {
    "attributeName": "RawMessageDelivery",
    "attributeValue": "true",
    "subscriptionArn": "arn:aws:sns:us-west-1:123456789012:dwfix-sns-d26d331a:022fe4f8-23c8-4a43-ba96-5d48f8db9e9d"
  },
  "resources": [
    {
      "ARN": "arn:aws:sns:us-west-1:123456789012:dwfix-sns-d26d331a:022fe4f8-23c8-4a43-ba96-5d48f8db9e9d",
      "accountId": "123456789012",
      "type": "AWS::SNS::PlatformEndpoint"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "sns.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

SetTopicAttributes

Service: sns

Description

Allows a topic owner to set an attribute of the topic to a new value.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "5294f7e9-7dc7-401f-ac75-a7dece5e9b42",
  "eventName": "SetTopicAttributes",
  "eventSource": "sns.amazonaws.com",
  "eventTime": "2026-06-29T19:11:55Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "ca12a748-ad4f-5e51-b0ed-c5f468f4929d",
  "requestParameters": {
    "attributeName": "DisplayName",
    "attributeValue": "dw",
    "topicArn": "arn:aws:sns:us-west-1:123456789012:dwfix-topic"
  },
  "resources": [
    {
      "ARN": "arn:aws:sns:us-west-1:123456789012:dwfix-topic",
      "accountId": "123456789012",
      "type": "AWS::SNS::Topic"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "sns.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,n,b,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`aws::requestParameters` (panther rule field)	is_not_null		1 rule	panther

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Panther #

AWS Resource Made Public source medium: Some AWS resource was made publicly accessible over the internet. Checks ECR, Elasticsearch, KMS, S3, S3 Glacier, SNS, SQS, and Secrets Manager.T1537

TagResource

Service: sns

Description

Add tags to the specified Amazon SNS topic.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "ae516b52-c60c-46d6-b86b-6a00f2d81402",
  "eventName": "TagResource",
  "eventSource": "sns.amazonaws.com",
  "eventTime": "2026-06-29T19:11:55Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "b0edb458-18ce-5ecb-970a-d6e4dd75e207",
  "requestParameters": {
    "resourceArn": "arn:aws:sns:us-west-1:123456789012:dwfix-topic",
    "tags": [
      {
        "key": "dw",
        "value": "f"
      }
    ]
  },
  "resources": [
    {
      "ARN": "arn:aws:sns:us-west-1:123456789012:dwfix-topic",
      "accountId": "123456789012",
      "type": "AWS::SNS::Topic"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "sns.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,n,b,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

Unsubscribe

Service: sns

Description

Deletes a subscription.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "de6cb0dc-6b30-4308-b9d4-049cc9975d6f",
  "eventName": "Unsubscribe",
  "eventSource": "sns.amazonaws.com",
  "eventTime": "2026-06-29T20:58:50Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "95c2120d-e2aa-5ee9-af17-70b13c60e0b8",
  "requestParameters": {
    "subscriptionArn": "arn:aws:sns:us-west-1:123456789012:dwfix-sns-d26d331a:022fe4f8-23c8-4a43-ba96-5d48f8db9e9d"
  },
  "resources": [
    {
      "ARN": "arn:aws:sns:us-west-1:123456789012:dwfix-sns-d26d331a:022fe4f8-23c8-4a43-ba96-5d48f8db9e9d",
      "accountId": "123456789012",
      "type": "AWS::SNS::PlatformEndpoint"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "sns.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UntagResource

Service: sns

Description

Remove tags from the specified Amazon SNS topic.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "bf5ec92d-35f6-42d0-84c2-5fb823be4590",
  "eventName": "UntagResource",
  "eventSource": "sns.amazonaws.com",
  "eventTime": "2026-06-29T19:11:55Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "02db88c6-9483-56c8-b3bc-ea7a5138ba04",
  "requestParameters": {
    "resourceArn": "arn:aws:sns:us-west-1:123456789012:dwfix-topic",
    "tagKeys": [
      "dw"
    ]
  },
  "resources": [
    {
      "ARN": "arn:aws:sns:us-west-1:123456789012:dwfix-topic",
      "accountId": "123456789012",
      "type": "AWS::SNS::Topic"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "sns.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,n,b,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

VerifySMSSandboxPhoneNumber

Service: sns

Description

Verifies a destination phone number with a one-time password (OTP) for the calling Amazon Web Services account.