AWS SNS Security

Correct Answer: Apply IAM policies

For securing access to your SNS topics, you should apply IAM policies which allow granular control over who can access the topics. AWS KMS, GuardDuty, VPC endpoints, APNs certificates, and S3 bucket policies serve other use-cases and would not specifically help in securing access to an SNS topic.

Correct Answer: Attach a resource-based policy (SNS topic access policy) with an IpAddress condition on aws:SourceIp.

To restrict who can access an SNS topic by client IP, you enforce the control on the resource using an SNS topic access policy. In that resource policy, use a Condition with IpAddress on aws:SourceIp to allow only the specified CIDR blocks to perform actions such as sns:Publish (and optionally sns:Subscribe). This works for requests coming to the public SNS endpoint and is the canonical, resource-scoped way to constrain access by source IP. VPC endpoint policies only apply to traffic routed through an interface VPC endpoint and do not control public internet access. Security groups do not apply to the public SNS service endpoint. AWS WAF does not integrate with SNS.

Correct Answer: Enable AWS CloudTrail

AWS CloudTrail is the auditing service that records API activity for AWS services, including Amazon SNS. Enabling a trail captures who made which SNS API calls, from where, and when, and delivers immutable logs to an S3 bucket (and optionally to CloudWatch Logs) for retention and analysis. AWS Config focuses on resource configuration state and changes rather than full API access auditing, Amazon GuardDuty provides threat detection rather than logging, and AWS Trusted Advisor offers best-practice checks and cost/optimization guidance, not access logging.