#422 · bluetape4k-aws · 1.0.0 · SNS security

Trust the notification only after every gate passes.

Play an SNS HTTP notification through parsing, exact TopicArn policy, certificate retrieval and chain validation, SignatureVersion 1/2 verification, and the post-verification handler boundary.

Choose a signed SNS story

Post-verification branch × 8

Security sequence

Step 0 / 7
Verification progress1 · Parse the envelope

Scroll horizontally to inspect the full security sequence →

SNS HTTP endpointuntrusted raw JSON
SnsHttpMessageParsershape and URL checks
TopicArn policyexact allowlist
SnsMessageManagercertificate and signature
Application boundaryverified handler or confirmation
  1. raw SNS HTTP JSON + optional x-amz-sns-message-type
    1 · Parse the envelopewaiting
  2. parsed.topicArn === expectedTopicArn
    2 · Enforce exact TopicArnwaiting
  3. SigningCertURL = https://sns.<region>.amazonaws.com/...pem
    3 · Check certificate URL and hostwaiting
  4. SnsMessageManager.parseMessage → certificate retrieval/cache → X.509 chain validation
    4 · Retrieve, cache, and validate the chainwaiting
  5. SignatureVersion 1 / SignatureVersion 2 · canonical SNS fields
    5 · Verify SignatureVersion 1 or 2waiting
  6. SnsHttpMessageVerifier.verify(...) returns SnsHttpMessage
    6 · Release only verified datawaiting
  7. NotificationMessage / NotificationSubject / NotificationRawMessage
    7 · Dispatch Notification handlerwaiting
  8. NotificationStatus → confirmSubscription() (explicit caller action)
    8 · Handle SubscriptionConfirmationwaiting

1 · Parse the envelope

waiting

raw SNS HTTP JSON + optional x-amz-sns-message-type

What happens

Guardrail

What follows

Visible signal

Trust boundary

No certificate or handler access before trust

│ fail closed │
Policy-owned

This offline explorer models the ordering and failure boundaries. The AWS SDK owns the concrete certificate cache and cryptographic implementation; the application owns its exact allowlist, runtime dependency, authorization, idempotency, and confirmation policy.

Use the step buttons or Left/Right/Home/End. Play advances this offline explanation only.