SNS策略

仅允许组织范围内的资源代入role：替换组织id，"<my-org-id>"；

还可以通过限制访问者的IP段以增加安全性。替换"<my-corporate-cidr>"为公司的办公网IP段。

或者也可以指定允许使用代入角色的某个iam role，替换"arn:aws:iam::<my-account-id>:role/aws-service-role/*"为可信的角色ARN。

请求者使用标签network-perimeter-exception:true可以绕过访问控制。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "EnforceIdentityPerimeter",
            "Effect": "Deny",
            "Principal": {
                "AWS": "*"
            },
            "Action": [
                "sns:GetTopicAttributes",
                "sns:SetTopicAttributes",
                "sns:AddPermission",
                "sns:RemovePermission",
                "sns:DeleteTopic",
                "sns:Subscribe",
                "sns:ListSubscriptionsByTopic",
                "sns:Publish"
            ],
            "Resource": "*",
            "Condition": {
                "StringNotEqualsIfExists": {
                  "aws:PrincipalOrgID": "<my-org-id>",
                  "aws:PrincipalAccount": [
                      "<third-party-account-a>",
                      "<third-party-account-b>"
                  ]
                },
                "BoolIfExists": {
                   "aws:PrincipalIsAWSService": "false"
                }
            }
        },
        {
            "Sid": "EnforceNetworkPerimeter",
            "Effect": "Deny",
            "Principal": {
                "AWS": "*"
            },
            "Action": [
                "sns:GetTopicAttributes",
                "sns:SetTopicAttributes",
                "sns:AddPermission",
                "sns:RemovePermission",
                "sns:DeleteTopic",
                "sns:Subscribe",
                "sns:ListSubscriptionsByTopic",
                "sns:Publish"
            ],
            "Resource": "*",
            "Condition": {
                "NotIpAddressIfExists": {
                    "aws:SourceIp": "<my-corporate-cidr>"
                },
                "StringNotEqualsIfExists": {
                    "aws:SourceVpc": "<my-vpc>",
                    "aws:PrincipalTag/network-perimeter-exception": "true",
                    "aws:PrincipalAccount": [
                        "<third-party-account-a>",
                        "<third-party-account-b>"
                    ]
                },
                "BoolIfExists": {
                    "aws:PrincipalIsAWSService": "false",
                    "aws:ViaAWSService": "false"
                },
                "ArnNotLikeIfExists": {
                    "aws:PrincipalArn": "arn:aws:iam::<my-account-id>:role/aws-service-role/*"
                },
                "StringEquals": {
                    "aws:PrincipalTag/data-perimeter-include": "true"
                }
            }
        }
    ]
}