AWS config: AWS Config rule: update SNS delivery notification rule description
Summary
Rewrites the managed rule description to state it checks that an SNS topic has IAM roles set for both successful and failed deliveries for any endpoint type, is NON_COMPLIANT otherwise (including email/SMS-only topics), and does not check subscriptions, role existence, or log delivery.
Security assessment
The updated description clarifies the scope of a compliance rule about SNS delivery-status logging (IAM roles for success/failure delivery), which is audit/logging-adjacent, but it is only a description wording change with no new control.
Evidence
+Checks if an Amazon SNS topic has IAM roles for both successful and failed deliveries set for any endpoint type. The rule is NON_COMPLIANT otherwise, including email/SMS-only topics. The rule does not check subscriptions, role existence, or log delivery.
Diff
diff --git a/config/latest/developerguide/sns-topic-message-delivery-notification-enabled.md b/config/latest/developerguide/sns-topic-message-delivery-notification-enabled.md index 7059661..3493899 100644 --- a//config/latest/developerguide/sns-topic-message-delivery-notification-enabled.md +++ b//config/latest/developerguide/sns-topic-message-delivery-notification-enabled.md @@ -11 +11 @@ AWS CloudFormation template -Checks if Amazon Simple Notification Service (SNS) logging is enabled for the delivery status of notification messages sent to a topic for the endpoints. The rule is NON_COMPLIANT if the delivery status notification for messages is not enabled. +Checks if an Amazon SNS topic has IAM roles for both successful and failed deliveries set for any endpoint type. The rule is NON_COMPLIANT otherwise, including email/SMS-only topics. The rule does not check subscriptions, role existence, or log delivery.