By using AWS re:Post, you agree to the Terms of Use
/Enforce Encryption on SNS creation by SCP/

Enforce Encryption on SNS creation by SCP

0

I would like to create an SCP to enforce encryption on SNS creation. I am creating the below policy but it failed.

{ "Version": "2012-10-17", "Statement": [ { "Sid": "Statement1", "Effect": "Deny", "Action": [ "sns:CreateTopic" ], "Resource": "*", "Condition": { "StringNotEquals": { "KmsMasterKeyId": "alias/aws/sns" } } } ] }

1 Answers
0

Unfortunately I do not believe that the SNS service supports the KmsMasterKeyId as a conditional:
https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonsns.html
As such the policy will not work as the string will always "not equal" and then fail through the Deny.

answered 3 months ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions