L2 SNS Topic: Setting enforceSSL prop to true does not create AWS::SNS::TopicPolicy

[jaychung-aws]

Describe the bug

CDK Version used:
2.147.2

Steps to Reproduce:

1. Create a L2 SNS Topic construct with enforceSSL prop set to true.

import * as cdk from 'aws-cdk-lib';
import * as sns from 'aws-cdk-lib/aws-sns';

const stack = new cdk.Stack();

const topic = new sns.Topic(stack, 'MySNSTopic', {
  topicName: 'my-sns-topic',
  enforceSSL: true,
});

3. cdk synth.
4. Inspect the synthesized CloudFormation template.
5. Check if CDK generated an AWS::SNS::TopicPolicy with a statement that denies any sns::Publish if aws:SecureTransport is false, as follows:

{
       "Action": "sns:Publish",
       "Condition": {
        "Bool": {
         "aws:SecureTransport": "false"
        }
       },
       "Effect": "Deny",
       "Principal": "*",
       "Resource": {
        "Ref": "SnsTopicStdAllProps5206973F"
       },
       "Sid": "AllowPublishThroughSSLOnly"
}

6. CDK does not create the expected AWS::SNS::TopicPolicy. However, if you haven a policy statement being added as follows to the Topic via .addToResourcePolicy(..):

import * as cdk from 'aws-cdk-lib';
import * as sns from 'aws-cdk-lib/aws-sns';

const stack = new cdk.Stack();

const topic = new sns.Topic(stack, 'MySNSTopic', {
  topicName: 'my-sns-topic',
  enforceSSL: true,
});
topic.addToResourcePolicy(new iam.PolicyStatement({
      effect: iam.Effect.ALLOW,
      principals: [
        new iam.ServicePrincipal('sns.amazonaws.com'),
      ],
      actions: [
        'SNS:Publish',
      ],
      resources: [
        '*',
      ],
    }));

then CDK correctly creates an AWS::SNS::TopicPolicy and appends the above statement to it:

"SnsTopicStdAllPropsPolicy76A2A260": {
   "Type": "AWS::SNS::TopicPolicy",
   "Properties": {
    "PolicyDocument": {
     "Statement": [
      {
       "Action": "SNS:Publish",
       "Effect": "Allow",
       "Principal": {
        "Service": "sns.amazonaws.com"
       },
       "Resource": "*",
       "Sid": "0"
      },
      {
       "Action": "sns:Publish",
       "Condition": {
        "Bool": {
         "aws:SecureTransport": "false"
        }
       },
       "Effect": "Deny",
       "Principal": "*",
       "Resource": {
        "Ref": "SnsTopicStdAllProps5206973F"
       },
       "Sid": "AllowPublishThroughSSLOnly"
      }
     ],
     "Version": "2012-10-17"
    },
    "Topics": [
     {
      "Ref": "SnsTopicStdAllProps5206973F"
     }
    ]
   },
   "UpdateReplacePolicy": "Delete",
   "DeletionPolicy": "Delete",
   "Metadata": {
    "aws:cdk:path": "TestedConstructStacks-SNSTopicStdAllProperties-stack/SnsTopicStdAllProps/Policy/Resource"
   }
  }

Regression Issue

• Select this option if this issue appears to be a regression.

Last Known Working CDK Version

No response

Expected Behavior

When a user synthesizes a CDK stack containing L2 SNS Topic with enforceSSL set to true, then CDK should output a CloudFormation stack that contains an AWS::SNS::TopicPolicy with a statement that "Adds a statement to enforce encryption of data in transit when publishing to the topic" as defined in the CDK documentation.

Current Behavior

When a user synthesizes a CDK stack containing L2 SNS Topic with enforceSSL set to true, CDK does not output a CloudFormation stack that contains an AWS::SNS::TopicPolicy with a statement that "Adds a statement to enforce encryption of data in transit when publishing to the topic" as defined in the CDK documentation.

CDK however handles this correctly when there is a policy being added to the Topic via .addToResourcePolicy(). In this case, a AWS::SNS::TopicPolicy is included in the synthesized CloudFormation template where the statement that blocks sns::Publish from sources that do not use SSL.

Reproduction Steps

aws-cdk-lib Version used:
2.147.2

Steps to Reproduce:

1. Create a L2 SNS Topic construct with enforceSSL prop set to true.

import * as cdk from 'aws-cdk-lib';
import * as sns from 'aws-cdk-lib/aws-sns';

const stack = new cdk.Stack();

const topic = new sns.Topic(stack, 'MySNSTopic', {
  topicName: 'my-sns-topic',
  enforceSSL: true,
});

3. cdk synth.
4. Inspect the synthesized CloudFormation template.
5. Check if CDK generated an AWS::SNS::TopicPolicy with a statement that denies any sns::Publish if aws:SecureTransport is false, as follows:

{
       "Action": "sns:Publish",
       "Condition": {
        "Bool": {
         "aws:SecureTransport": "false"
        }
       },
       "Effect": "Deny",
       "Principal": "*",
       "Resource": {
        "Ref": "SnsTopicStdAllProps5206973F"
       },
       "Sid": "AllowPublishThroughSSLOnly"
}

6. CDK does not create the expected AWS::SNS::TopicPolicy. However, if you haven a policy statement being added as follows to the Topic via .addToResourcePolicy(..):

import * as cdk from 'aws-cdk-lib';
import * as sns from 'aws-cdk-lib/aws-sns';

const stack = new cdk.Stack();

const topic = new sns.Topic(stack, 'MySNSTopic', {
  topicName: 'my-sns-topic',
  enforceSSL: true,
});
topic.addToResourcePolicy(new iam.PolicyStatement({
      effect: iam.Effect.ALLOW,
      principals: [
        new iam.ServicePrincipal('sns.amazonaws.com'),
      ],
      actions: [
        'SNS:Publish',
      ],
      resources: [
        '*',
      ],
    }));

then CDK correctly creates an AWS::SNS::TopicPolicy and appends the above statement to it:

"SnsTopicStdAllPropsPolicy76A2A260": {
   "Type": "AWS::SNS::TopicPolicy",
   "Properties": {
    "PolicyDocument": {
     "Statement": [
      {
       "Action": "SNS:Publish",
       "Effect": "Allow",
       "Principal": {
        "Service": "sns.amazonaws.com"
       },
       "Resource": "*",
       "Sid": "0"
      },
      {
       "Action": "sns:Publish",
       "Condition": {
        "Bool": {
         "aws:SecureTransport": "false"
        }
       },
       "Effect": "Deny",
       "Principal": "*",
       "Resource": {
        "Ref": "SnsTopicStdAllProps5206973F"
       },
       "Sid": "AllowPublishThroughSSLOnly"
      }
     ],
     "Version": "2012-10-17"
    },
    "Topics": [
     {
      "Ref": "SnsTopicStdAllProps5206973F"
     }
    ]
   },
   "UpdateReplacePolicy": "Delete",
   "DeletionPolicy": "Delete",
   "Metadata": {
    "aws:cdk:path": "TestedConstructStacks-SNSTopicStdAllProperties-stack/SnsTopicStdAllProps/Policy/Resource"
   }
  }

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.156.0

Framework Version

No response

Node.js Version

18.20.2

OS

MacOS Sonoma 14.6.1

Language

TypeScript

Language Version

No response

Other information

No response

[ashishdhingra]

Reproducible using customer provided code. Simply using the below code doesn't create AWS::SNS::TopicPolicy at all (AWS CDK version 2.160.0 (build 7a8ae02)):

import * as cdk from 'aws-cdk-lib';
import * as sns from 'aws-cdk-lib/aws-sns';

export class CdktestStack extends cdk.Stack {
  constructor(scope: cdk.App, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    const topic = new sns.Topic(this, 'MySNSTopic', {
      topicName: 'my-sns-topic',
      enforceSSL: true,
    });
  }
}

PR #31569 contributed by community addresses the issue.

[github-actions]

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.

[github-actions]

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.