cyberstrikeus CIS Control 2.13: Ensure creating an SNS subscription (Manual)
Profile Applicability
- Level 2
Description
SNS (Simple Notification Service) subscriptions enable real-time alerts and notifications for AWS CloudWatch alarms and events, ensuring administrators are immediately informed of critical issues with EC2 instances and EBS volumes.
Rationale
Creating SNS subscriptions is essential for timely incident response and proactive monitoring. By receiving immediate notifications about CloudWatch alarms, administrators can quickly address performance issues, security events, or resource failures before they impact operations.
Impact
Without SNS subscriptions, CloudWatch alarms may go unnoticed, leading to delayed incident response, prolonged downtime, and potential data loss. Real-time notifications ensure that critical issues are addressed promptly, minimizing operational disruptions and maintaining service availability.
Audit Procedure
Via AWS Management Console
- Navigate to SNS → Subscriptions
- Verify subscriptions exist for critical CloudWatch alarms
- Confirm subscription endpoints (email, SMS, Lambda) are active
- Test notification delivery
Via AWS CLI
```bash
List SNS topics
aws sns list-topics
List subscriptions
aws sns list-subscriptions
Get topic attributes
aws sns get-topic-attributes --topic-arn
List subscriptions for specific topic
aws sns list-subscriptions-by-topic --topic-arn ```
Expected Result
- SNS topics exist for critical alarm categories
- Subscriptions are configured for appropriate notification channels
- Subscription endpoints are confirmed and active
- Test notifications are successfully delivered
Remediation
Via AWS Management Console
- Navigate to SNS → Create Topic
- Provide topic name and display name
- Create subscription to the topic
- Choose protocol (Email, SMS, HTTPS, Lambda, SQS)
- Enter endpoint details
- Confirm subscription
- Link topic to CloudWatch alarms
Via AWS CLI
```bash
Create SNS topic
aws sns create-topic --name CloudWatchAlerts
Create email subscription
aws sns subscribe
--topic-arn arn:aws:sns:region:account:CloudWatchAlerts
--protocol email
--notification-endpoint admin@example.com
Confirm subscription (check email for confirmation link)
Associate CloudWatch alarm with SNS topic
aws cloudwatch put-metric-alarm
--alarm-name HighCPUUtilization
--alarm-actions arn:aws:sns:region:account:CloudWatchAlerts
--metric-name CPUUtilization
--namespace AWS/EC2
--statistic Average
--period 300
--threshold 80
--comparison-operator GreaterThanThreshold
```
Default Value
No SNS topics or subscriptions are created by default.
References
CIS Controls
Not explicitly mapped in the provided documentation.
Notes
- This is a manual control requiring SNS configuration verification
- Configure multiple notification channels for redundancy
- Use SNS message filtering to reduce notification noise
- Regularly test SNS subscriptions to ensure delivery
- Consider integrating with incident management systems (PagerDuty, OpsGenie)